[alexey-max-fedorov]

Root cause

CI was red because the BetterDependabot scheduled workflow (.github/workflows/BetterDependabot.yml) used pnpm/action-setup@v6 with version: latest. On 2026-07-13 that resolved to the freshly-published pnpm 11.12.0, whose self-installer crashes while switching pnpm versions:

Switching pnpm from v11.7.0 to v11.12.0...
[ERROR] Cannot use 'in' operator to search for 'integrity' in undefined
    at createFullPkgId (.../pnpm.mjs:154891:19)
    at lockfileToDepGraph (.../pnpm.mjs:154840:20)
    ...
    at installPnpmToGlobalDir (.../pnpm.mjs:238350:7)
##[error]Something went wrong, self-installer exits with code 1

This happens inside pnpm's own self-install/version-switch logic, before any repo dependency install, typecheck, or build step ever runs (see failed run 29232206286, and the failing update-dependencies check on the master HEAD commit).

Hypotheses considered

1. TypeScript v7 incompatible with the deploy target (the suspected cause) — ruled out. This repo has no Next.js/Vercel deployment for its code (only the marketing site playorig.in uses Vercel Analytics, unrelated to this repo's build). Dependabot did bump typescript 6.0.3 → 7.0.2 across all 4 packages (PRs [typings]: Bump typescript from 6.0.3 to 7.0.2 in /typings #22–[extension/firefox]: Bump typescript from 6.0.3 to 7.0.2 in /extension/firefox #25) since dependabot.yml has no major-version ignore rule — that part of the theory is real — but the actual build workflow (Autobuild originGUI) ran and succeeded on 2026-07-10, after that bump landed. TypeScript v7 is not what's failing CI here.
2. Broken auto-update workflow (confirmed, but not the TS angle) — BetterDependabot.yml's use of version: latest for pnpm/action-setup let a brand-new, broken pnpm release (11.12.0) into CI. This is the actual failure.
3. Unrelated test/build regression — ruled out. No other workflow (originGUI-build.yml, dependency-review.yml) is failing; gh api .../check-runs on HEAD shows exactly one failing check, update-dependencies, matching hypothesis 2.
4. Flaky external dependency — partially true in spirit: pnpm 11.12.0's self-installer is broken/incomplete upstream, but it's deterministic (every run against latest will hit it until pnpm patches it), not transient.

Fix

Pin pnpm/action-setup to the last known-good release, 11.11.0, instead of latest — the same pattern originGUI-build.yml already uses (version: 9) for its own pnpm setup.

Verification

• Reproduced the exact original failure via the check-runs API on master HEAD (update-dependencies → failure, same "integrity" stack trace).
• Manually triggered BetterDependabot.yml on this branch with the fix applied (gh workflow run → run 29267895663): all steps passed, including Run pnpm/action-setup@v6 and Commit and push, which produced this branch's chore: update dependencies commit — proof the pipeline runs end-to-end again.

Test plan

• BetterDependabot.yml runs green on this branch (see run 29267895663 above)
• Confirmed no Next.js/Vercel build exists in this repo to be affected by the TypeScript version
• Confirmed Autobuild originGUI already succeeds with typescript@7.0.2

[Copilot]

Pull request overview

This PR addresses a CI failure in the scheduled BetterDependabot workflow by avoiding pnpm “latest” auto-resolution (which pulled a broken upstream release) and restores the workflow’s ability to run dependency updates end-to-end.

Changes:

• Pin pnpm/action-setup’s installed pnpm version in BetterDependabot.yml from latest to 11.11.0.
• Update originGUI’s postcss devDependency from ^8.5.16 to ^8.5.17.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/BetterDependabot.yml	Pins pnpm to a known-good version to prevent CI breakage from upstream latest installs.
originGUI/package.json	Includes a patch-level postcss devDependency bump alongside the CI change.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.