chore: bump pnpm to 11.9.0

- package.json5: packageManager: pnpm@9.15.0 → pnpm@11.9.0
- Dockerfile: 3 references updated (corepack + npm-install fallback)
- .github/workflows/publish.yml: corepack reference updated

pnpm 11 changes that affect this repo:
1. Postinstall scripts are disabled by default for supply-chain
   safety. The whitelist lives in `pnpm-workspace.yaml` under
   the `allowBuilds` key (a map of <pkg>: true). Earlier attempts
   to put this in `pnpm.onlyBuiltDependencies` (deprecated) and
   in `.npmrc` (rejected — only scalar settings allowed there)
   failed; only project-level pnpm-workspace.yaml works.
   Approved builds: @prisma/client, @prisma/client-runtime-utils,
   @prisma/engines, esbuild, msw, prisma, sharp, unrs-resolver.
2. .npmrc no longer carries the (incorrect) `allow-builds[…]`
   entries — that syntax was being silently ignored. Just leaves
   the scalar settings and a comment pointing at pnpm-workspace.yaml.
3. Dockerfile now copies `pnpm-workspace.yaml` into the build
   context alongside package.json5/pnpm-lock.yaml/.npmrc so
   pnpm can read the allowBuilds config during docker build.

Verified end-to-end:
- `pnpm install` succeeds (was: ERR_PNPM_IGNORED_BUILDS)
- `pnpm run build` compiles all routes
- Docker image builds (~1.51 GB, down from 1.75 GB on pnpm 9)

Note: pnpm run check (oxlint/oxfmt/tsgo) was already broken on
main before this change — oxlint complains about a rule
`no-unresolved` not being found in plugin `import`. Pre-existing
issue, not introduced here. Filed in a separate thread.

Author: IamCoder18

.github/workflows/publish.yml

@@ -97,7 +97,7 @@ jobs:
         # same failure mode on runners where /pnpm is root-owned.
         run: |
           corepack enable
-          corepack prepare pnpm@9.15.0 --activate
+          corepack prepare pnpm@11.9.0 --activate
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

.npmrc

@@ -6,4 +6,10 @@
 # root-owned and unwritable (e.g. GitHub Actions runners).
 shamefully-hoist=false
 strict-peer-dependencies=false
-auto-install-peers=true
+auto-install-peers=true
+
+# pnpm 10+ blocks postinstall scripts by default for supply-chain
+# safety. The whitelist lives in `pnpm-workspace.yaml` under the
+# `allowBuilds` key — see that file for the actual list. (`.npmrc` only
+# supports scalar settings, and pnpm requires this one to be project-
+# level config, so it goes in pnpm-workspace.yaml instead.)

Dockerfile

@@ -21,16 +21,16 @@ FROM node:${NODE_VERSION} AS fetcher
 
 WORKDIR /app
 
-# Pin pnpm 9.15.0. Prefer corepack (it's the official Node way to
+# Pin pnpm 11.9.0. Prefer corepack (it's the official Node way to
 # provision pnpm) but fall back to `npm install -g` for Node 26+ Alpine
 # images where corepack was dropped from the image.
 RUN if command -v corepack >/dev/null 2>&1; then \
-      corepack enable && corepack prepare pnpm@9.15.0 --activate; \
+      corepack enable && corepack prepare pnpm@11.9.0 --activate; \
     else \
-      npm install -g pnpm@9.15.0; \
+      npm install -g pnpm@11.9.0; \
     fi
 
-COPY package.json5 pnpm-lock.yaml .npmrc ./
+COPY package.json5 pnpm-lock.yaml .npmrc pnpm-workspace.yaml ./
 
 # --config.store-dir=/pnpm/store points pnpm at the BuildKit cache mount
 # above. Inlining this (rather than committing it to .npmrc) keeps the
@@ -48,9 +48,9 @@ FROM node:${NODE_VERSION} AS builder
 WORKDIR /app
 
 RUN if command -v corepack >/dev/null 2>&1; then \
-      corepack enable && corepack prepare pnpm@9.15.0 --activate; \
+      corepack enable && corepack prepare pnpm@11.9.0 --activate; \
     else \
-      npm install -g pnpm@9.15.0; \
+      npm install -g pnpm@11.9.0; \
     fi
 
 COPY --from=fetcher /app/node_modules ./node_modules

package.json5

@@ -2,7 +2,7 @@
   name: "openblog",
   version: "0.1.0",
   private: true,
-  packageManager: "pnpm@9.15.0",
+  packageManager: "pnpm@11.9.0",
   scripts: {
     dev: "next dev -p 4000",
     build: "next build",