🔧 chore(deps): bump pnpm to 11.20.0

[xdanger]

Summary

• update the package manager from pnpm 11.18.0 to 11.20.0
• adopt pnpm security fixes for named-registry substitution and lockfile path traversal
• keep the lockfile unchanged because this repository does not configure namedRegistries

Validation

• frozen install with pnpm 11.20.0
• full repository lint suite

Risk

Low. This is a same-major, packageManager-only update. pnpm 11.20.0 is semi-breaking only for projects using namedRegistries; no migration is required here.

[Copilot]

Pull request overview

Updates the repository’s declared package manager version to pnpm 11.20.0 via the packageManager field in package.json, enabling consumers (e.g., Corepack) to consistently use the intended pnpm version.

Changes:

• Bumped packageManager from pnpm@11.18.0 to pnpm@11.20.0 (including updated integrity hash).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4a6bc58545

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Encode the Corepack hash as hexadecimal

When pnpm is invoked through Corepack, the base64 characters / and = make the portion after @ invalid SemVer build metadata, so Corepack rejects this manifest with expected a semver version before running any pnpm command. Corepack's packageManager syntax represents the digest after sha512. as hexadecimal; convert this integrity value to hex (as the previous value was) so installs, linting, and other pnpm scripts can run.

Useful? React with 👍 / 👎.