chore: upgrade pnpm to 11.10, turbo to latest, fix dependabot alert

[sriramveeraghanta]

Changes

• pnpm: 11.3.0 → 11.10.0 (packageManager in root package.json)
• turbo: 2.9.18 → 2.10.11 (latest, via catalog in pnpm-workspace.yaml)
• dependabot: fixes open alert fix: add pagination for github repositories endpoint #345 (low severity) — postcss-selector-parser DoS via uncontrolled AST recursion (>=7.1.0 <7.1.3). Pulled in transitively by postcss-modules-local-by-default / postcss-modules-scope; pinned to 7.1.3 with a scoped override in pnpm-workspace.yaml.

Verification

• pnpm install passes on pnpm v11.10.0; lockfile resolves only postcss-selector-parser@7.1.3
• turbo --version → 2.10.11; turbo run check:types --dry passes against existing turbo.json

Summary by CodeRabbit

• Security

  • Improved protection against a potential denial-of-service issue related to stylesheet processing.

• Maintenance

  • Updated package management tooling and build infrastructure versions to improve reliability and compatibility.
  • Applied a targeted safeguard for affected stylesheet-processing components.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: b27972dd-c839-4620-91a8-4bd537d88376

📥 Commits

Reviewing files that changed from the base of the PR and between d5785f4 and 612f7e0.

📒 Files selected for processing (1)

• pnpm-workspace.yaml

💤 Files with no reviewable changes (1)

• pnpm-workspace.yaml

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The repository updates its required pnpm version, upgrades the Turbo catalog entry, and pins affected postcss-selector-parser versions to 7.1.3.

Changes

Toolchain updates

Layer / File(s)	Summary
Toolchain and dependency resolution package.json, pnpm-workspace.yaml	The required pnpm version changes to 11.10.0. The Turbo catalog changes to 2.10.11. The workspace pins postcss-selector-parser versions in the affected range to 7.1.3.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 612f7

This PR updates pnpm and Turbo and pins the affected transitive dependency to a fixed version; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies all primary changes: the pnpm upgrade, the Turbo upgrade, and the Dependabot alert fix.
Description check	✅ Passed	The description clearly explains the version updates, the security override, the affected dependency path, and the verification results. It does not use the template headings or include a Type of Chan…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description clearly explains the version updates, the security override, the affected dependency path, and the verification results. It does not use the template headings or include a Type of Change selection, but the required change and test information is present.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/upgrade-pnpm-turbo-dependabot

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates the repo’s tooling baseline (pnpm + Turborepo) and mitigates a low-severity security advisory by forcing a safe transitive dependency version via pnpm overrides.

Changes:

• Bumped packageManager in root package.json to pnpm@11.10.0.
• Updated the workspace catalog entry for turbo to 2.10.11 and reflected it in the lockfile.
• Added a scoped pnpm override to pin vulnerable postcss-selector-parser versions to 7.1.3, with corresponding lockfile resolution.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
pnpm-workspace.yaml	Updates turbo catalog version and adds a scoped override to pin postcss-selector-parser to a non-vulnerable version.
pnpm-lock.yaml	Regenerates lockfile to reflect the turbo upgrade and the postcss-selector-parser override (resolving to 7.1.3).
package.json	Updates the root packageManager field to pnpm 11.10.0.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.