fix: update pnpm to v11.19.0

[jamietanna]

Summary

• Bump the bundled/bootstrap pnpm version to v11.19.0, following the same pattern as fix: update pnpm to v11.7.0 #267.
• Regenerated src/install-pnpm/bootstrap/{pnpm,exe}-lock.json via node scripts/update-bootstrap.mjs 11.13.1.
• Rebuilt dist/index.js.
• Closes Error after installing in standalone mode when trying to install packages with a CLI globally - This: not found #277

Test plan

• node scripts/update-bootstrap.mjs 11.19.0 regenerated lockfiles with matching versions/integrity hashes
• pnpm run build rebuilt dist/index.js and confirmed it embeds @pnpm/exe":"11.19.0"

Summary by CodeRabbit

Chores

• Updated the bundled pnpm tooling to version 11.19.0.
• Refreshed platform-specific package references and verification metadata included with the installation process.
• Updated package registry information to ensure the bundled tooling can be retrieved and validated consistently across supported platforms.
• Improved consistency and reliability when installing pnpm across supported environments.

[coderabbitai]

Warning

Review limit reached

@jamietanna, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 7 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ec07a22-4ad2-4de6-a0bd-98d1a9d5931b

📥 Commits

Reviewing files that changed from the base of the PR and between ddaf3cc and dc8abb5.

⛔ Files ignored due to path filters (1)

• dist/index.js is excluded by !**/dist/**

📒 Files selected for processing (2)

• src/install-pnpm/bootstrap/exe-lock.json
• src/install-pnpm/bootstrap/pnpm-lock.json

📝 Walkthrough

Walkthrough

The bootstrap lockfiles update pnpm, @pnpm/exe, and platform-specific packages from version 11.7.0 to 11.19.0. Registry URLs and integrity hashes are refreshed.

Changes

Bootstrap lockfile update

Layer / File(s)	Summary
Bootstrap version resolution src/install-pnpm/bootstrap/exe-lock.json, src/install-pnpm/bootstrap/pnpm-lock.json	The root @pnpm/exe and pnpm entries now resolve version 11.19.0 with updated metadata.
Platform package resolution src/install-pnpm/bootstrap/exe-lock.json	The Linux, macOS, and Windows optional packages now resolve version 11.19.0 with updated archive URLs and integrity hashes.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• pnpm/action-setup#248: Updates the same bootstrap lockfiles and package metadata.
• pnpm/action-setup#267: Updates the same bootstrap lockfiles and pnpm package versions.

Suggested reviewers: zkochan

Poem

A rabbit checks each hash in line,
pnpm hops to version nineteen.
Platform packages follow through,
With refreshed links and checksums too.
Bootstrap lockfiles now align.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The lockfiles show the pnpm update, but the required dist/index.js rebuild is excluded from review by !/dist/.	Verify the excluded dist/index.js rebuild and confirm it embeds @pnpm/exe version 11.19.0 and resolves the standalone-mode failure.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the primary change: updating the bundled pnpm version to 11.19.0.
Out of Scope Changes check	✅ Passed	The reviewed changes only update pnpm bootstrap lockfiles, which directly supports the linked issue and stated pull request objective.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Bump bundled/bootstrap pnpm to 11.13.1

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Update bootstrap lockfiles to reference pnpm/@pnpm/exe v11.13.1.
• Refresh resolved tarball URLs and integrity hashes for all bundled platform binaries.

Diagram

graph TD
  Dev["Maintainer"] --> Script["update-bootstrap.mjs"] --> Locks["bootstrap lockfiles"] --> Installer["install-pnpm"] --> Registry{{"npm registry"}} --> Tool["pnpm/exe 11.13.1"]

Loading

High-Level Assessment

Updating the pinned bootstrap lockfiles via the existing regeneration workflow is the right approach here (keeps bootstrap installs deterministic and verifiable). Alternatives like relying on a system pnpm or floating versions would reduce determinism and increase install variability.

Files changed (2) +36 / -36

Other (2) +36 / -36

exe-lock.jsonBump @pnpm/exe and platform binaries to 11.13.1 +32/-32

Bump @pnpm/exe and platform binaries to 11.13.1

• Updates the pinned @pnpm/exe version from 11.7.0 to 11.13.1. Refreshes resolved tarball URLs and integrity hashes for all optional platform-specific @pnpm/* packages.

src/install-pnpm/bootstrap/exe-lock.json

pnpm-lock.jsonBump pnpm to 11.13.1 in bootstrap lockfile +4/-4

Bump pnpm to 11.13.1 in bootstrap lockfile

• Updates the pinned pnpm package version from 11.7.0 to 11.13.1. Refreshes the resolved tarball URL and integrity hash to match the new version.

src/install-pnpm/bootstrap/pnpm-lock.json

[zkochan]

Why not to the latest?

[jamietanna]

Wasn't sure if we had a policy around that :D Happy bumping to the literal latest, or should I do a version or two behind?

[zkochan]

The literal latest

[jamietanna]

Not sure why CI is failing - I couldn't seem to repro locally

#284 might be related? Nope

[jamietanna]

Claude Sonnet 5 believes:

- Root cause: check-dist rebuilds dist/index.js and diffs it against what's committed. esbuild's minified output isn't byte-identical across platforms (macOS arm64, where I built it, vs Linux x64, where CI builds it) — same esbuild version, same locked dependencies, just different bytes. Bumping CI's pnpm to v11 (#284) didn't touch this; it was solving a different problem.

[jamietanna]

I've re-pushed from my Linux machine, which seems to work - that seemed to have been the issue!