build(deps): track and enforce pnpm lockfile

.github/workflows/build.yml

@@ -51,7 +51,7 @@ jobs:
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Configure pnpm workspace for Windows ${{ matrix.arch }}
         run: pnpm run install:sharp
@@ -60,7 +60,7 @@ jobs:
           TARGET_ARCH: ${{ matrix.arch }}
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
         env:
           npm_config_build_from_source: true
           npm_config_platform: win32
@@ -173,7 +173,7 @@ jobs:
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Configure pnpm workspace for Linux ${{ matrix.arch }}
         run: pnpm run install:sharp
@@ -182,7 +182,7 @@ jobs:
           TARGET_ARCH: ${{ matrix.arch }}
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Verify OpenDAL native package for Linux
         run: pnpm run smoke:opendal:native -- --platform linux --arch ${{ matrix.arch }}
@@ -291,7 +291,7 @@ jobs:
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Configure pnpm workspace for macOS ${{ matrix.arch }}
         run: pnpm run install:sharp
@@ -300,7 +300,7 @@ jobs:
           TARGET_ARCH: ${{ matrix.arch }}
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Report RTK install token source
         shell: bash

.github/workflows/prcheck.yml

@@ -66,7 +66,7 @@ jobs:
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Lint
         run: pnpm run lint
@@ -104,7 +104,7 @@ jobs:
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Test main process
         run: pnpm run test:main
@@ -127,7 +127,7 @@ jobs:
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Test renderer
         run: pnpm run test:renderer
@@ -150,7 +150,7 @@ jobs:
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Build
         run: pnpm run build
@@ -173,7 +173,7 @@ jobs:
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Install and verify DuckDB VSS
         run: |

.github/workflows/release.yml

@@ -137,7 +137,7 @@ jobs:
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Configure pnpm workspace for Windows ${{ matrix.arch }}
         run: pnpm run install:sharp
@@ -146,7 +146,7 @@ jobs:
           TARGET_ARCH: ${{ matrix.arch }}
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
         env:
           npm_config_build_from_source: true
           npm_config_platform: win32
@@ -259,7 +259,7 @@ jobs:
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Configure pnpm workspace for Linux ${{ matrix.arch }}
         run: pnpm run install:sharp
@@ -268,7 +268,7 @@ jobs:
           TARGET_ARCH: ${{ matrix.arch }}
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Verify OpenDAL native package for Linux
         run: pnpm run smoke:opendal:native -- --platform linux --arch ${{ matrix.arch }}
@@ -379,7 +379,7 @@ jobs:
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Configure pnpm workspace for macOS ${{ matrix.arch }}
         run: pnpm run install:sharp
@@ -388,7 +388,7 @@ jobs:
           TARGET_ARCH: ${{ matrix.arch }}
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Report RTK install token source
         shell: bash

.github/workflows/windows-arm64-e2e.yml

@@ -25,7 +25,7 @@ jobs:
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093
 
       - name: Install dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
 
       - name: Configure pnpm workspace for Windows arm64
         run: pnpm run install:sharp
@@ -34,7 +34,7 @@ jobs:
           TARGET_ARCH: arm64
 
       - name: Install Windows arm64 dependencies
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
         env:
           npm_config_build_from_source: true
           npm_config_platform: win32

.gitignore

@@ -5,7 +5,6 @@ out
 *.log*
 package-lock.json
 yarn.lock
-pnpm-lock.yaml
 .vscode
 .idea
 build/linuxarm.json

docs/architecture/pr-check-quality-gates/spec.md

@@ -26,6 +26,8 @@ Memory sequence, and exposes one fail-closed aggregate check for branch protecti
 - Keep local test commands aligned with maintained test locations and Native SQLite ownership.
 - Run static analysis, main tests, renderer tests, Native Memory validation, and the production
   prebuild/build contract as independent PR jobs.
+- Consume the committed `pnpm-lock.yaml` with explicit frozen installs so manifest drift fails before
+  any quality gate runs.
 - Preserve required Native Memory ordering across portable tests, Node ABI rebuild, smoke validation,
   Native suites, evaluation, performance checks, and report upload.
 - Make one lightweight aggregate job fail when any required quality gate fails, is cancelled, or is
@@ -52,6 +54,7 @@ Memory sequence, and exposes one fail-closed aggregate check for branch protecti
 - `static` runs lint, formatting, localization parity, renderer architecture baseline, icon
   generation, and type checking.
 - `test-main` and `test-renderer` run their complete one-shot suites.
+- Every repository-root dependency install uses `pnpm install --frozen-lockfile`.
 - `build` runs the canonical `pnpm run build`, including its prebuild data refresh and full local
   build contract.
 - No single-element matrix, path filter, renderer sharding, packages job, dependency-cache policy
@@ -91,7 +94,8 @@ Memory sequence, and exposes one fail-closed aggregate check for branch protecti
   architecture.
 - Do not add a packages job when the repository has no packages test boundary.
 - Do not add path-based job skipping or test sharding before the always-on baseline is established.
-- Do not enable pnpm caching or change lockfile policy while `pnpm-lock.yaml` is not tracked.
+- Keep pnpm caching disabled; cache adoption is a separate performance change now that
+  `pnpm-lock.yaml` is tracked.
 - Do not rebuild the Native SQLite dependency during local validation.
 - Do not change remote branch-protection rules in this change.
 - Do not create or sync a GitHub issue for this architecture record.
@@ -100,7 +104,7 @@ Memory sequence, and exposes one fail-closed aggregate check for branch protecti
 
 - Reducing runner-minute usage through selective execution.
 - Splitting renderer tests into shards.
-- Changing dependency installation or generated-registry policies.
+- Enabling dependency caching or changing generated-registry policies.
 - Replacing the existing test framework or build pipeline.
 - Proving Windows ARM64 or Node-ABI Native behavior outside their owning workflows.
 
@@ -111,6 +115,8 @@ Memory sequence, and exposes one fail-closed aggregate check for branch protecti
 - Parallel jobs repeat dependency installation and increase aggregate runner minutes. They reduce
   wall-clock latency and isolate failures, but optimization is deferred until a reliable baseline
   exists.
+- Frozen installs fail immediately when `package.json` and `pnpm-lock.yaml` diverge, so dependency
+  changes must update and commit both files together.
 - `build` intentionally repeats type checking already performed by `static` because the canonical
   build command is itself a maintained release contract.
 - Native workflow behavior remains ABI-sensitive and must be verified after a push; local validation

package.json

@@ -121,7 +121,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@parcel/watcher": "^2.5.6",
     "ai": "^7.0.19",
-    "axios": "^1.16.1",
+    "axios": "^1.18.1",
     "better-sqlite3-multiple-ciphers": "12.9.0",
     "compare-versions": "^6.1.1",
     "cron-parser": "^5.6.1",
@@ -148,10 +148,10 @@
     "qrcode": "^1.5.4",
     "run-applescript": "^7.1.0",
     "safe-regex2": "^5.1.1",
-    "sharp": "^0.34.5",
+    "sharp": "^0.35.3",
     "tokenx": "^0.4.1",
     "turndown": "^7.2.4",
-    "undici": "^7.25.0",
+    "undici": "^7.28.0",
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
     "xml2js": "^0.6.2",
     "zod": "^4.4.3"
@@ -165,7 +165,7 @@
     "@iconify-json/lucide": "1.2.109",
     "@iconify-json/vscode-icons": "1.2.50",
     "@iconify/vue": "^5.0.1",
-    "@lingual/i18n-check": "0.8.12",
+    "@lingual/i18n-check": "0.9.5",
     "@lucide/vue": "^1.24.0",
     "@pinia/colada": "^0.20.0",
     "@playwright/test": "^1.60.0",
@@ -188,7 +188,7 @@
     "@unovis/ts": "1.6.4",
     "@unovis/vue": "1.6.4",
     "@vitejs/plugin-vue": "^6.0.7",
-    "@vitest/ui": "^3.2.4",
+    "@vitest/ui": "^3.2.7",
     "@vue/test-utils": "^2.4.10",
     "@vueuse/core": "^14.3.0",
     "@xterm/xterm": "^5.5.0",
@@ -221,11 +221,11 @@
     "tw-animate-css": "^1.4.0",
     "typescript": "^6.0.3",
     "vee-validate": "^4.15.1",
-    "vite": "^7.3.3",
+    "vite": "^7.3.6",
     "vite-plugin-monaco-editor-esm": "^2.0.2",
     "vite-plugin-vue-devtools": "^8.1.2",
     "vite-svg-loader": "^5.1.1",
-    "vitest": "^3.2.4",
+    "vitest": "^3.2.7",
     "vue": "^3.5.39",
     "vue-i18n": "^11.4.4",
     "vue-router": "4",
@@ -246,6 +246,9 @@
     "@opendal/lib-win32-x64-msvc": "0.49.2"
   },
   "pnpm": {
+    "overrides": {
+      "monaco-editor>dompurify": "3.4.12"
+    },
     "onlyBuiltDependencies": [
       "@tailwindcss/oxide",
       "classic-level",