Update pnpm version and use frozen lockfile (#181)

Update pnpm to v10.33.0 and enable `--frozen-lockfile` for dependency
installations in CI workflows and local commands. This ensures
reproducible builds and faster installs by skipping integrity checks.

Also update npm to v11.11.1 and adjust workspace settings for pnpm.

Author: ibolmo

.github/workflows/eval.yaml

@@ -28,11 +28,14 @@ jobs:
         with:
           node-version: 22
 
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - name: Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          version: 10.33.0
 
       - name: Install Dependencies
         id: install
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Build packages
         id: build

.github/workflows/js.yaml

@@ -29,8 +29,11 @@ jobs:
         uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: ${{ matrix.node-version }}
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-      - run: pnpm install
+      - name: Setup pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+        with:
+          version: 10.33.0
+      - run: pnpm install --frozen-lockfile
       - run: pnpm run test
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

CLAUDE.md

@@ -11,9 +11,9 @@ Autoevals is a dual-language library (TypeScript + Python) for evaluating AI mod
 ### TypeScript (in root directory)
 
 ```bash
-pnpm install          # Install dependencies
-pnpm run build        # Build JS (outputs to jsdist/)
-pnpm run test         # Run all JS tests with vitest
+pnpm install --frozen-lockfile          # Install dependencies
+pnpm run build                          # Build JS (outputs to jsdist/)
+pnpm run test                           # Run all JS tests with vitest
 pnpm run test -- js/llm.test.ts                    # Run single test file
 pnpm run test -- -t "test name"                    # Run specific test by name
 ```

Makefile

@@ -41,4 +41,4 @@ test-py:
 	source env.sh && python3 -m pytest
 
 test-js:
-	pnpm install && pnpm run test
+	pnpm install --frozen-lockfile && pnpm run test

mise.toml

@@ -9,4 +9,5 @@ _.python.venv = { path = "venv", create = true, uv_create_args = ['--seed']}
 _.file = ".env"
 
 [tools]
-pnpm = "10.26.2"
+pnpm = "10.33.0"
+npm = "11.11.1"

package.json

@@ -55,5 +55,5 @@
     "zod": "^3.25.76",
     "zod-to-json-schema": "^3.24.6"
   },
-  "packageManager": "pnpm@10.26.2"
+  "packageManager": "pnpm@10.33.0"
 }

pnpm-workspace.yaml

@@ -6,3 +6,11 @@ ignoredBuiltDependencies:
   - duckdb
   - esbuild
   - msw
+
+strictDepBuilds: true
+blockExoticSubdeps: true
+trustPolicy: no-downgrade
+# Ignore the check for packages published more than 30 days ago (pnpm 10.27+)
+# Useful for older packages that pre-date provenance support
+trustPolicyIgnoreAfter: 43200 # minutes (30 days)
+minimumReleaseAge: 20160 # 2 weeks (in minutes)