fix: make v0.1.42 release installs reproducible

.github/osv-release.toml

@@ -3,65 +3,11 @@ id = "GHSA-j965-2qgj-vjmq"
 reason = "aws-sdk v2 has no fixed version reported by OSV. It is retained only as a transitive package while release artifacts are built with scripts disabled, SBOM, and provenance attestations."
 
 [[IgnoredVulns]]
-id = "GHSA-gv7w-rqvm-qjhr"
-ignoreUntil = 2026-06-20
-reason = "esbuild fixed version 0.28.1 is still inside the repository minimum release-age window. Revisit after the release-age hold expires."
+id = "GHSA-4mjr-xmp4-gh2g"
+ignoreUntil = 2026-09-07
+reason = "qs 6.16.0 is the first fixed version but remains inside the enforced seven-day minimum release-age window. Revisit immediately after the hold expires."
 
 [[IgnoredVulns]]
-id = "GHSA-g7r4-m6w7-qqqr"
-ignoreUntil = 2026-06-20
-reason = "esbuild fixed version 0.28.1 is still inside the repository minimum release-age window. Revisit after the release-age hold expires."
-
-[[IgnoredVulns]]
-id = "GHSA-wcpc-wj8m-hjx6"
-ignoreUntil = 2026-06-17
-reason = "protobufjs fixed version 7.6.3 is still inside the repository minimum release-age window. Revisit after the release-age hold expires."
-
-[[IgnoredVulns]]
-id = "GHSA-f38q-mgvj-vph7"
-ignoreUntil = 2026-06-17
-reason = "protobufjs fixed version 7.6.3 is still inside the repository minimum release-age window. Revisit after the release-age hold expires."
-
-[[IgnoredVulns]]
-id = "GHSA-8988-4f7v-96qf"
-ignoreUntil = 2026-06-19
-reason = "OpenTelemetry fixed versions 2.8.0/0.219.0 are still inside the repository minimum release-age window. Revisit after the release-age hold expires."
-
-[[IgnoredVulns]]
-id = "GHSA-hmw2-7cc7-3qxx"
-ignoreUntil = 2026-06-20
-reason = "form-data fixed versions 2.5.6 and 4.0.6 are still inside the repository minimum release-age window. Revisit after the release-age hold expires."
-
-[[IgnoredVulns]]
-id = "GHSA-hpcv-96wg-7vj8"
-ignoreUntil = 2026-06-18
-reason = "DOMPurify fixed version 3.4.9 is still inside the repository minimum release-age window. Revisit after the release-age hold expires."
-
-[[IgnoredVulns]]
-id = "GHSA-r47g-fvhr-h676"
-ignoreUntil = 2026-06-18
-reason = "DOMPurify fixed version 3.4.9 is still inside the repository minimum release-age window. Revisit after the release-age hold expires."
-
-[[IgnoredVulns]]
-id = "GHSA-76mc-f452-cxcm"
-ignoreUntil = 2026-06-18
-reason = "DOMPurify fixed version 3.4.9 is still inside the repository minimum release-age window. Revisit after the release-age hold expires."
-
-[[IgnoredVulns]]
-id = "GHSA-rp9w-3fw7-7cwq"
-ignoreUntil = 2026-06-18
-reason = "DOMPurify fixed version 3.4.9 is still inside the repository minimum release-age window. Revisit after the release-age hold expires."
-
-[[IgnoredVulns]]
-id = "GHSA-gvmj-g25r-r7wr"
-ignoreUntil = 2026-06-18
-reason = "DOMPurify fixed version 3.4.9 is still inside the repository minimum release-age window. Revisit after the release-age hold expires."
-
-[[IgnoredVulns]]
-id = "GHSA-vxr8-fq34-vvx9"
-ignoreUntil = 2026-06-18
-reason = "DOMPurify fixed version 3.4.9 is still inside the repository minimum release-age window. Revisit after the release-age hold expires."
-
-[[IgnoredVulns]]
-id = "GHSA-x4vx-rjvf-j5p4"
-reason = "DOMPurify advisory has no fixed version reported by OSV. Retained temporarily with scripts disabled, SBOM, provenance attestations, and follow-up through Dependabot/security alerts."
+id = "GHSA-x5fp-wj9c-mxmx"
+ignoreUntil = 2026-09-07
+reason = "qs 6.16.0 is the first fixed version but remains inside the enforced seven-day minimum release-age window. Revisit immediately after the hold expires."

.github/workflows/dependency-review.yml

@@ -30,4 +30,6 @@ jobs:
         with:
           fail-on-severity: high
           deny-licenses: GPL-2.0, GPL-3.0, AGPL-1.0, AGPL-3.0
+          # These existing packages publish missing/non-canonical SPDX metadata; keep the license gate enabled for all other dependencies.
+          allow-dependencies-licenses: "pkg:npm/@pierre/diffs, pkg:npm/@openauthjs/openauth, pkg:npm/opencontrol"
           comment-summary-in-pr: always

.github/workflows/release.yml

@@ -79,7 +79,12 @@ jobs:
           docker run --rm \
             -v "$PWD:/src" \
             ghcr.io/google/osv-scanner:v2.3.8@sha256:64e86bec6df2466feea5137fc7c78fb3b7c21ec077f014d7130f64810e50676b \
-            scan --config /src/.github/osv-release.toml --lockfile /src/src/mendcode/bun.lock
+            scan --config /src/.github/osv-release.toml --lockfile /src/src/mendcode/pnpm-lock.yaml
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
+        with:
+          version: 11.0.9
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
@@ -91,7 +96,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          bun install --frozen-lockfile --ignore-scripts --os="*" --cpu="*"
+          pnpm --pm-on-fail=ignore install --frozen-lockfile --ignore-scripts
           bun run --cwd packages/opencode fix-node-pty
 
       - name: Build release assets
@@ -142,6 +147,11 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
+        with:
+          version: 11.0.9
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
@@ -151,7 +161,7 @@ jobs:
         working-directory: src/mendcode
         shell: pwsh
         run: |
-          bun install --frozen-lockfile --ignore-scripts --os="*" --cpu="*"
+          pnpm --pm-on-fail=ignore install --frozen-lockfile --ignore-scripts
           bun run --cwd packages/opencode fix-node-pty
 
       - name: Build native Windows release assets
@@ -219,6 +229,11 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
+        with:
+          version: 11.0.9
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
@@ -229,7 +244,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          bun install --frozen-lockfile --ignore-scripts --os="*" --cpu="*"
+          pnpm --pm-on-fail=ignore install --frozen-lockfile --ignore-scripts
           bun run --cwd packages/opencode fix-node-pty
 
       - name: Build native Darwin release asset

src/mendcode/.npmrc

@@ -0,0 +1,2 @@
+minimum-release-age=10080
+save-exact=true

src/mendcode/package.json

@@ -149,7 +149,9 @@
     "axios": "1.18.0",
     "body-parser": "2.3.0",
     "brace-expansion": "5.0.9",
-    "fast-uri": "3.1.5",
+    "browserslist": "4.28.7",
+    "fast-uri": "3.1.6",
+    "fastify": "5.12.1",
     "fast-xml-builder": "1.1.7",
     "find-my-way": "9.7.0",
     "fast-xml-parser": "5.7.0",
@@ -159,6 +161,8 @@
     "ip-address": "10.3.1",
     "postcss": "8.5.23",
     "js-yaml": "4.3.1",
+    "mysql2": "3.23.1",
+    "postcss-selector-parser": "7.1.3",
     "protobufjs": "7.6.3",
     "qs": "6.15.2",
     "seroval": "1.5.3",
@@ -170,6 +174,7 @@
     "undici": "8.9.0",
     "uuid": "13.0.1",
     "tar": "7.5.21",
+    "toml": "4.2.0",
     "valibot": "1.4.2",
     "ws": "8.21.0"
   },