chore: pin Node 20 (LTS) and pnpm 10.34.3

Unpinned `pnpm@latest` in the Dockerfile made fresh builds non-reproducible:
`latest` now resolves to pnpm 11, but the committed lockfile targets pnpm 10, so
`pnpm install --frozen-lockfile` fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH on
a clean host. Pin pnpm to 10.34.3 across the Dockerfile, the `packageManager`
field, and the release workflow; pin Node to 20 (LTS) via `.nvmrc` and `engines`
so Docker, CI, and from-source builds all use the same tested toolchain.

Also corrects the docs: the lockfile is v9.0 (requires pnpm 10, not "pnpm 8+"),
and "Node 20+" implied untested newer majors were supported.

This commit is contained in:

Jannis Braun

2026-07-06 01:04:59 +02:00

parent ef020601eb

commit 9d3f72be75

6 changed files with 16 additions and 9 deletions

									
										.github/workflows/release.yml
									
		+1
		-1
	
												View File
												
				@@ -67,7 +67,7 @@ jobs:

				      - name: Setup pnpm

				        uses: pnpm/action-setup@v4

				        with:

				          version: 10

				          version: 10.34.3

				      - name: Setup Node.js

				        uses: actions/setup-node@v4