From 6500b19bdb939bd6eece4ad903a284a57aa942a7 Mon Sep 17 00:00:00 2001
From: Test User <john.david.dalton@gmail.com>
Date: Tue, 14 Apr 2026 09:08:12 -0400
Subject: [PATCH] fix(config): align .npmrc and pnpm-workspace.yaml for pnpm
 v11

- .npmrc: keep only npm-valid settings (ignore-scripts, min-release-age)
- .npmrc: remove trust-policy/trust-policy-exclude (not valid npm settings)
- pnpm-workspace.yaml: remove ignoreDependencyScripts (invalid setting name)
- pnpm-workspace.yaml: remove linkWorkspacePackages (removed in pnpm v11)
- pnpm-workspace.yaml: add trustPolicy/trustPolicyExclude (pnpm equivalents)
- pnpm-workspace.yaml: un-nest settings block (minimumReleaseAge was under settings: key)
- Rely on pnpm v11 strictDepBuilds (default true) + allowBuilds for dep scripts
---
 .npmrc              |  7 ++-----
 pnpm-workspace.yaml | 23 ++++++++++++-----------
 2 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/.npmrc b/.npmrc
index dda4354e9..9c7382baf 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1,6 +1,3 @@
-# Minimum release age for npm v11+ (days).
+# npm v11+ settings (not pnpm — pnpm v11 only reads auth/registry from .npmrc).
+ignore-scripts=true
 min-release-age=7
-
-trust-policy=no-downgrade
-trust-policy-exclude[]=@yarnpkg/core@4.5.0
-trust-policy-exclude[]=@yarnpkg/libzip@3.2.2
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 7f4020926..c5d5aa09b 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,6 +1,8 @@
-ignoreDependencyScripts: true
-linkWorkspacePackages: false
 resolutionMode: highest
+trustPolicy: no-downgrade
+trustPolicyExclude:
+  - '@yarnpkg/core@4.5.0'
+  - '@yarnpkg/libzip@3.2.2'
 
 allowBuilds:
   esbuild: true
@@ -56,12 +58,11 @@ patchedDependencies:
   node-gyp@11.5.0: patches/node-gyp@11.5.0.patch
   minipass-sized@1.0.3: patches/minipass-sized@1.0.3.patch
 
-settings:
-  # Wait 7 days (10080 minutes) before installing newly published packages.
-  minimumReleaseAge: 10080
-  minimumReleaseAgeExclude:
-    - '@anthropic-ai/claude-code@2.1.92'
-    - '@socketaddon/*'
-    - '@socketbin/*'
-    - '@socketregistry/*'
-    - '@socketsecurity/*'
+# Wait 7 days (10080 minutes) before installing newly published packages.
+minimumReleaseAge: 10080
+minimumReleaseAgeExclude:
+  - '@anthropic-ai/claude-code@2.1.92'
+  - '@socketaddon/*'
+  - '@socketbin/*'
+  - '@socketregistry/*'
+  - '@socketsecurity/*'