chore: enable pnpm trustPolicy: no-downgrade (supply-chain defense-in-depth)

[anupamme]

Summary

Enable pnpm's trustPolicy: no-downgrade in pnpm-workspace.yaml as an optional supply-chain defense-in-depth measure.

 minimumReleaseAge: 1440
+
+trustPolicy: no-downgrade

This is the focused follow-up that a maintainer invited when closing #15326:

A focused proposal for trustPolicy may be considered separately with an appropriate rationale and clean, frozen-lockfile installation validation.

Framing

This is not a vulnerability fix — it is optional defense-in-depth. I've dropped the two unrelated changes from #15326 that were rightly rejected (see "Scope" below).

Rationale

trustPolicy was added in pnpm v10.21.0; this repo pins pnpm@11.13.0, so it's supported. Its default is off.

With no-downgrade, pnpm fails an install when a dependency's publishing trust level regresses relative to an earlier release — e.g. a package that was previously published by a trusted publisher now arrives with only provenance or no trust evidence. The check is based on publish date rather than semver, so a version can't be installed if an earlier-published version had stronger trust evidence.

This is an independent signal that complements the existing minimumReleaseAge: where minimumReleaseAge buys time for the ecosystem to catch and pull malicious releases, trustPolicy catches a sudden drop in publishing trust evidence — a distinct compromise indicator.

Scope (deliberately narrow)

Compared to #15326, this PR excludes:

• minimumReleaseAge bump (1440 → 10080) — kept at 1440 to stay consistent with .github/renovate.json5's minimumReleaseAge: '24 hours'.
• blockExoticSubdeps: true — already the default in pnpm 11, so it's redundant.

Net change: +2 -0, one file.

Validation — clean frozen-lockfile install

$ pnpm --version
11.13.0

$ pnpm install --frozen-lockfile
...
Done in 54s using pnpm v11.13.0

$ git diff --exit-code pnpm-lock.yaml && echo "lockfile unchanged ✓"
lockfile unchanged ✓

pnpm install --frozen-lockfile succeeds with no trust/lockfile errors, and pnpm-lock.yaml is byte-identical — enabling trustPolicy did not force any resolution changes.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added a workspace package policy that prevents dependency versions from being downgraded.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: afd148e4-3a40-44c2-8022-885eb16e2874

📥 Commits

Reviewing files that changed from the base of the PR and between a2b40db and 8c771fe.

📒 Files selected for processing (1)

• pnpm-workspace.yaml

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The pnpm workspace configuration now enforces trustPolicy: no-downgrade.

Changes

Workspace policy

Layer / File(s)	Summary
Configure trust enforcement pnpm-workspace.yaml	Adds the pnpm trustPolicy setting with no-downgrade enforcement.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 8c771

This localized change enables pnpm's no-downgrade trust policy without changing the lockfile or dependency resolutions, and normal checks are sufficient; no actionable merge-blocking risk remains.

Suggested reviewers: btea

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: enabling pnpm's trustPolicy: no-downgrade setting.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@vue/compiler-core

pnpm add https://pkg.pr.new/@vue/compiler-core@15330

npm i https://pkg.pr.new/@vue/compiler-core@15330

yarn add https://pkg.pr.new/@vue/compiler-core@15330.tgz

@vue/compiler-dom

pnpm add https://pkg.pr.new/@vue/compiler-dom@15330

npm i https://pkg.pr.new/@vue/compiler-dom@15330

yarn add https://pkg.pr.new/@vue/compiler-dom@15330.tgz

@vue/compiler-sfc

pnpm add https://pkg.pr.new/@vue/compiler-sfc@15330

npm i https://pkg.pr.new/@vue/compiler-sfc@15330

yarn add https://pkg.pr.new/@vue/compiler-sfc@15330.tgz

@vue/compiler-ssr

pnpm add https://pkg.pr.new/@vue/compiler-ssr@15330

npm i https://pkg.pr.new/@vue/compiler-ssr@15330

yarn add https://pkg.pr.new/@vue/compiler-ssr@15330.tgz

@vue/reactivity

pnpm add https://pkg.pr.new/@vue/reactivity@15330

npm i https://pkg.pr.new/@vue/reactivity@15330

yarn add https://pkg.pr.new/@vue/reactivity@15330.tgz

@vue/runtime-core

pnpm add https://pkg.pr.new/@vue/runtime-core@15330

npm i https://pkg.pr.new/@vue/runtime-core@15330

yarn add https://pkg.pr.new/@vue/runtime-core@15330.tgz

@vue/runtime-dom

pnpm add https://pkg.pr.new/@vue/runtime-dom@15330

npm i https://pkg.pr.new/@vue/runtime-dom@15330

yarn add https://pkg.pr.new/@vue/runtime-dom@15330.tgz

@vue/server-renderer

pnpm add https://pkg.pr.new/@vue/server-renderer@15330

npm i https://pkg.pr.new/@vue/server-renderer@15330

yarn add https://pkg.pr.new/@vue/server-renderer@15330.tgz

@vue/shared

pnpm add https://pkg.pr.new/@vue/shared@15330

npm i https://pkg.pr.new/@vue/shared@15330

yarn add https://pkg.pr.new/@vue/shared@15330.tgz

vue

pnpm add https://pkg.pr.new/vue@15330

npm i https://pkg.pr.new/vue@15330

yarn add https://pkg.pr.new/vue@15330.tgz

@vue/compat

pnpm add https://pkg.pr.new/@vue/compat@15330

npm i https://pkg.pr.new/@vue/compat@15330

yarn add https://pkg.pr.new/@vue/compat@15330.tgz

commit: 8c771fe

[github-actions]

Size Report

Bundles

File	Size	Gzip	Brotli
runtime-dom.global.prod.js	108 kB	40.7 kB	36.5 kB
vue.global.prod.js	167 kB	60.9 kB	54.2 kB

Usages

Name	Size	Gzip	Brotli
createApp (CAPI only)	49.7 kB	19.3 kB	17.7 kB
createApp	57.8 kB	22.3 kB	20.4 kB
createSSRApp	62.5 kB	24.3 kB	22.1 kB
defineCustomElement	64.1 kB	24.3 kB	22.1 kB
overall	72.1 kB	27.5 kB	25.1 kB