chore: update some pnpm configuration and security docs (#4879)

Author: mimarz

.vscode/settings.json

@@ -14,8 +14,8 @@
   "[css]": {
     "editor.defaultFormatter": "biomejs.biome"
   },
-  "typescript.tsdk": "node_modules/typescript/lib",
-  "typescript.enablePromptUseWorkspaceTsdk": true,
+  "js/ts.tsdk.path": "node_modules/typescript/lib",
+  "js/ts.tsdk.promptToUseWorkspaceVersion": true,
   "cssvar.files": [
     "packages/theme/src/themes/designsystemet.css",
   ],

SECURITY.md

@@ -17,5 +17,11 @@ We use several automated mechanisms to help detect and reduce risk:
 - Renovate is configured to *only propose updates for packages that have been published for at least 3 days*.  
   This allows time for the ecosystem to discover and revert problematic releases.
 
-### pnpm Policies
-pnpm is configured to ensure **no dependency version newer than 24 hours** is installed.
+### Dependency manager 
+We use [pnpm](https://pnpm.io) for managing dependencies.
+
+We have cofingured pnpm with the following:
+- No dependency version newer than 72 hours is installed.
+- Prevent transitive dependencies from using exotic sources.
+- By default block script execution for dependencies.
+  - See `allowedBuilds` in [pnpm-workspace-yaml](./pnpm-workspace.yaml) for whitelisted depedencies

package.json

@@ -47,7 +47,6 @@
     "@vitest/browser-playwright": "4.1.5",
     "@vitest/coverage-v8": "4.1.5",
     "chromatic": "16.6.3",
-    "just-pnpm": "1.0.2",
     "tsconfck": "3.1.6",
     "typescript": "5.9.3",
     "typescript-plugin-css-modules": "5.2.0",

pnpm-lock.yaml

@@ -3,23 +3,20 @@ packages:
   - apps/*
   - plugins/*
   - internal/*
-ignoredBuiltDependencies:
-  - '@bundled-es-modules/glob'
-  - '@parcel/watcher'
-  - rs-module-lexer
-  - sharp
+allowBuilds:
+  "@biomejs/biome": true
+  '@parcel/watcher': false
+  '@swc/core': true
+  esbuild: true
+  rs-module-lexer: false
+  style-dictionary: true
+blockExoticSubdeps: true
 injectWorkspacePackages: true
-minimumReleaseAge: 1440
+minimumReleaseAge: 4320
 minimumReleaseAgeExclude:
   - "@u-elements/*"
-onlyBuiltDependencies:
-  - '@biomejs/biome'
-  - '@swc/core'
-  - esbuild
-  - just-pnpm
-  - style-dictionary
 packageExtensions:
-  '@navikt/aksel-icons':
+  "@navikt/aksel-icons":
     peerDependencies:
       react: ">=18.3.1 || ^19.0.0"
     peerDependenciesMeta:
@@ -32,4 +29,3 @@ syncInjectedDepsAfterScripts:
   - build:themebuilder
   - build:storybook
 useNodeVersion: 24.15.0
-blockExoticSubdeps: true