chore(deps): update pnpm to v12.6.0 with sanity-io/ui's pnpm setup

.github/actions/setup/action.yml

@@ -1,21 +1,19 @@
 name: 'Setup Environment'
-description: 'Sets up Node.js, pnpm, and installs dependencies'
+description: 'Sets up pnpm and a Node.js runtime, and installs dependencies'
 
 inputs:
-  node-version:
-    description: 'Node.js version to use'
-    required: true
-    default: lts/*
+  runtime:
+    description: 'Runtime to install, e.g. node@lts or node@latest'
+    required: false
+    default: node@lts
 
 runs:
   using: composite
   steps:
-    - uses: pnpm/action-setup@v6
-
-    - uses: actions/setup-node@v7
+    - uses: pnpm/setup@v3
       with:
-        cache: pnpm
-        node-version: ${{ inputs.node-version }}
-
-    - run: pnpm install
-      shell: bash
+        runtime: ${{ inputs.runtime }}
+        # The store cache would upload a new ~645 MiB entry after every job (its keys
+        # include the run id) and evict the Playwright browser caches. The lockfile
+        # verification cache is restored and saved regardless of this setting.
+        cache: false

.github/workflows/ailf-eval.yml

@@ -65,7 +65,7 @@ jobs:
 
       - uses: ./.github/actions/setup
         with:
-          node-version: lts/*
+          runtime: node@lts
 
       - name: Compute plugin key
         id: key

.github/workflows/pnpm-if-needed.yml

@@ -23,6 +23,10 @@ jobs:
       - uses: actions/checkout@v7
       - uses: ./.github/actions/setup
 
+      - run: pnpm dedupe --config.ignore-scripts=true
+      # pnpm 12.6.0's dedupe isn't idempotent for some optional peers: each run toggles the same peer
+      # suffixes back and forth. A second run undoes that toggle, so the PR only has real dedupes and
+      # merging it doesn't trigger another dedupe PR.
       - run: pnpm dedupe --config.ignore-scripts=true
       - uses: actions/create-github-app-token@v3
         id: app-token

AGENTS.md

@@ -27,7 +27,7 @@ Use the **latest LTS** release of Node.js.
 
 ### pnpm Version
 
-The exact pnpm version is managed via the `packageManager` field in root `package.json`. You only need pnpm **v11 or later** installed globally—corepack or pnpm itself will auto-install the exact version specified.
+The exact pnpm version is managed via the `packageManager` field in root `package.json` (currently pnpm **v12**). You only need pnpm **v12 or later** installed globally—corepack or pnpm itself will auto-install the exact version specified.
 
 ```bash
 # Enable corepack to automatically use the correct pnpm version
@@ -37,7 +37,15 @@ corepack enable
 pnpm install
 ```
 
-pnpm v11 defaults `minimumReleaseAge` to 1 day. `minimumReleaseAgeExclude` in `pnpm-workspace.yaml` lists first-party packages and closely tracked tooling that may need immediate installs, plus version-specific pins (e.g. `react-rx@4.2.5`) for one-off upgrades still inside that window.
+Install the pinned version globally before regenerating `pnpm-lock.yaml`. When an older global pnpm self-switches to the pinned version, the outer shim injects `pnpm_config_pm_on_fail=ignore`, and the inner pnpm then leaves the lockfile's `packageManagerDependencies` block unwritten. Running the pinned version directly (what `pnpm/setup` does in CI) records it correctly.
+
+Because pnpm 12 records that block, `pnpm-lock.yaml` is **two YAML documents**: a leading env document with `packageManagerDependencies`, then the dependency graph. Any tool that reads the lockfile must parse multi-document YAML; a single-document parser silently sees only the env document and concludes the project has no dependencies. This is why the `vercel` CLI must stay at `58.9.5` or newer, with the versions `pnpm install` reports as trust downgrades listed in `trustPolicyExclude`—see [`e2e/README.md`](e2e/README.md) (`Vercel studio preview`).
+
+`autoDedupe: true` in `pnpm-workspace.yaml` collapses compatible duplicate versions on every non-frozen install, so the lockfile arrives deduped instead of waiting for the `Dedupe lockfile` workflow to open a follow-up PR. Frozen installs never rewrite the lockfile. It requires pnpm >= 12.6.0.
+
+pnpm 12.6.0 doesn't settle on one set of optional peers for `plugins/@sanity/debug-preview-url-secret-plugin`. A fresh install, and any install or `pnpm dedupe` that re-resolves the lockfile, toggles `@vitejs/devtools` and `oxc-transform-react` in the peer suffixes of its `sanity` and `@sanity/tsdown-config` entries. No version changes and frozen installs are unaffected, so don't commit a `pnpm-lock.yaml` diff that only toggles those suffixes. The `Dedupe lockfile` workflow runs `pnpm dedupe` twice for the same reason.
+
+pnpm defaults `minimumReleaseAge` to 1 day (since v11). `minimumReleaseAgeExclude` in `pnpm-workspace.yaml` lists first-party packages and closely tracked tooling that may need immediate installs, plus version-specific pins (e.g. `react-rx@4.2.5`) for one-off upgrades still inside that window. `minimumReleaseAgeExcludePrune` and `trustPolicyExcludePrune` drop exclude entries that no longer match anything in the tree, but only on an install that actually rewrites the lockfile—a no-op install leaves stale entries in place.
 
 Do **not** bypass the maturity check with `pnpm add … --config.minimumReleaseAge=0` (or any other `--config.minimumReleaseAge` override). That is not allowed. If `pnpm install` fails because a needed version is too new, add that exact `name@version` to `minimumReleaseAgeExclude` instead.
 
@@ -576,7 +584,7 @@ Run `pnpm build` first—some packages need to be built for type information to
 
 ### "Command not found: pnpm"
 
-Ensure you have pnpm v11+ installed, then run:
+Ensure you have pnpm v12+ installed, then run:
 
 ```bash
 corepack enable

CONTRIBUTING.md

@@ -20,7 +20,7 @@ Thank you for your interest in contributing to the Sanity Plugins monorepo! This
 ### Prerequisites
 
 - Node.js (latest LTS)
-- [pnpm](https://pnpm.io/) v11 or later — the exact version is managed via `packageManager` in root `package.json`
+- [pnpm](https://pnpm.io/) v12 or later — the exact version is managed via `packageManager` in root `package.json`
 
 ### Initial Setup
 

README.md

@@ -29,7 +29,7 @@ The packages folder contains two types of packages:
 ### Prerequisites
 
 - Node.js (latest LTS)
-- [pnpm](https://pnpm.io/) v11 or later (managed via corepack)
+- [pnpm](https://pnpm.io/) v12 or later (managed via corepack)
 
 ### Installation
 

e2e/README.md

@@ -97,6 +97,10 @@ CI deploys the studio under test to Vercel per run (same as [`sanity-io/sanity`]
 
 The studio preview reuses the same Vercel project and secrets as report hosting (`VERCEL_E2E_REPORT_*`). Report deploys are `--prebuilt` static output, so they are unaffected by the project’s build settings.
 
+`vercel build` runs with the repo's pinned `vercel` CLI, which must be **`vercel@58.9.5` or newer**. Older releases bundle an `@vercel/build-utils` that parses `pnpm-lock.yaml` as a single YAML document; pnpm 12 writes it as two (a leading env document holding `packageManagerDependencies`), so package-manager detection fails, silently falls back to npm, and `npm install` dies on `Unsupported URL Type "workspace:"`. If that error reappears, check the CLI version first.
+
+From `58.7.0` on, `vercel` and some of its `@vercel/*` dependencies are published without the npm provenance attestations earlier releases had, so `trustPolicy: no-downgrade` rejects those versions unless they are listed in `trustPolicyExclude` in `pnpm-workspace.yaml`. Each CLI bump therefore needs the exact versions that `pnpm install` reports as `ERR_PNPM_TRUST_DOWNGRADE` added there, one at a time (`trustPolicyExcludePrune` drops the old ones). Don't add `@vercel/*` versions that pnpm doesn't report.
+
 ### One-time setup
 
 1. **Set the Root Directory** of the Vercel project to `dev/e2e-studio` (Project Settings → General) and enable “Include source files outside of the Root Directory”. Build command and output dir come from `dev/e2e-studio/vercel.json`.

package.json

@@ -51,12 +51,12 @@
   "devDependencies": {
     "@vitest/coverage-v8": "catalog:",
     "knip": "^6.33.0",
-    "vercel": "^57.0.0"
+    "vercel": "^60.1.3"
   },
   "lint-staged": {
     "*.{ts,tsx,js,jsx,json,jsonc,md}": [
       "oxfmt --no-error-on-unmatched-pattern"
     ]
   },
-  "packageManager": "pnpm@11.21.0"
+  "packageManager": "pnpm@12.6.0"
 }