## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Chore / dependency tooling update.
## What is the current behavior?
The repo is pinned to pnpm 10.24.0. Closes
https://linear.app/supabase/issue/FE-3673/migrate-the-repo-to-use-pnpm-v11.
## What is the new behavior?
The repo is pinned to pnpm 11.13.1, pnpm v11 workspace settings are
migrated to `allowBuilds`, and the Studio Dockerfile installs pnpm
11.13.1.
## Additional context
Validated with `CI=true mise exec node@22 -- pnpm install
--frozen-lockfile`, `mise exec node@22 -- pnpm run typecheck`, and `mise
exec node@22 -- pnpm run lint`; full Prettier check still fails on
existing generated docs/router files outside this migration.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated tooling requirements (pnpm **11.13.1**, Node **>=22.13**) and
aligned container build tooling accordingly.
* Adjusted package manager behavior (scoped registry override, update
notifications disabled) and workspace build/engine validation settings.
* **Maintenance**
* Updated `clean` scripts across apps/packages to remove only
build/cache artifacts (no longer delete installed dependencies).
* Reduced Turbo `clean` task output to **errors-only** for cleaner logs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This PR bumps various dependencies to fix vulnerabilities.
The logic for bumping packages has been taken out of
`fix-audit-vulnerability` into a `bump-package` script.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Removed unused development dependency from generator package
* Updated package version overrides and vulnerability management
configuration to address security concerns
* Enhanced internal package dependency maintenance tooling for improved
operational efficiency
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
* Bump @playwright/test to fix a playwright vuln.
* Deduplicate msw.
* Deduplicate yaml.
* Deduplicate tsx.
* Add vitest to the catalog and bump it.
* Deduplicate vitest extra packages.
* Bump and deduplicate vite to v7.
* Bump prismjs.
* Bump vite to v6 to get the newest esbuild.
* Bump tsx to get the newest esbuild.
* Fix lodash version.
* Make the www app use the catalog version of next.
* docs: Regenerate specs for all API docs references
* Fix the reference docs parsing.
* Update snapshots of docs tests.
* fix(ui): hide details panel for file params
* fix(ui): fix array display when inner type is not given
---------
Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com>
Co-authored-by: Charis Lam <26616127+charislam@users.noreply.github.com>
* Fix some missing and duplicate dependencies.
* Fix the types for jest in ai-commands package.
* Replace all npm commands with pnpm. Add pnpm files and workspace links.
* Fix rimraf to work with pnpm.
* Refactor the github actions to work with pnpm.
* Delete package-lock.json.
* Fix the tailwind configs to not include node_modules.
* Fix random files.
* Add preinstall scripts to all packages.
* Fix the Dockerfile to work with pnpm.
* Update the DEVELOPERS documentation.
* Move the spec/parser package into packages folder.
* Fix the spec generation with the new paths.
* Remove the spec folder from prettierignore.
* Run prettier on the spec folder (without regenerating, that's should be done by the product teams).
Ivan Vasilov