fix: support pnpm 11 and 12 dependency installation

[wcqqq1214]

Fixes #10539.

Modifications / 改动点

• Move dashboard overrides from package.json to pnpm-workspace.yaml so newer pnpm versions read them.

• Allow the docs dependency esbuild to run its build script. Keep dependency versions, lockfiles, and CI's pnpm 10.28.2 unchanged.

• This is NOT a breaking change. / 这不是一个破坏性变更。

Screenshots or Test Results / 运行截图或测试结果

Reproduced on macOS from upstream 48ba71ad7, including a fresh clone with pnpm 12.10.1:

• Dashboard pnpm install succeeds but warns that pnpm.overrides is ignored and rewrites the lockfile (132 insertions / 117 deletions on pnpm 12).
• Dashboard frozen installation against the original lockfile fails with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH on pnpm 11/12.
• Docs installation fails with ERR_PNPM_IGNORED_BUILDS: esbuild@0.21.5; pnpm 11 also blocks docs:build during its dependency check.

After the fix, verified with pnpm 10.28.2, 11.21.0, and 12.10.1:

• In both directories: pnpm install --frozen-lockfile and pnpm install pass without changing either lockfile.
• cd dashboard && pnpm run build and cd docs && pnpm run docs:build pass.
• Dashboard i18n:check, ruff format ., and ruff check . pass.

---

Checklist / 检查清单

• 😊 If there are new features added in the PR, I have discussed it with the authors through issues/emails, etc.
  / 如果 PR 中有新加入的功能，已经通过 Issue / 邮件等方式和作者讨论过。

• 👀 My changes have been well-tested, and "Verification Steps" and "Screenshots" have been provided above.
  / 我的更改经过了良好的测试，并已在上方提供了“验证步骤”和“运行截图”。

• 📚 I checked the affected WebUI instructions and screenshots in docs/zh and docs/en against the changed navigation, page structure, and labels, and updated them in this PR (or explained why no documentation update is needed). For renamed, moved, or merged entry points, I included an old entry → new entry mapping in the documentation and changelog.
  / 我已对照变化后的 WebUI 入口、页面结构和术语，核对并在本 PR 中更新 docs/zh 和 docs/en 的相关操作说明与截图（或说明无需更新文档的原因）。入口改名、移动或合并时，已在文档和 changelog 中补充 旧入口 → 新入口 对照。

• 🤓 I have ensured that no new dependencies are introduced, OR if new dependencies are introduced, they have been added to the appropriate locations in requirements.txt and pyproject.toml.
  / 我确保没有引入新依赖库，或者引入了新依赖库的同时将其添加到 requirements.txt 和 pyproject.toml 文件相应位置。

• 😮 My changes do not introduce malicious code.
  / 我的更改没有引入恶意代码。

Summary by Sourcery

Support dependency installation and builds across pnpm 10, 11, and 12 without lockfile changes.

Bug Fixes:

• Restore pnpm 11 and 12 compatibility for dashboard and docs dependency installation.

Enhancements:

• Move dashboard dependency overrides to workspace configuration and permit esbuild build scripts in both projects.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. The new docs workspace config permits esbuild's install-time build script to run, giving that dependency code execution in the environment installing the docs dependencies. Reverting removes the permission for future installs, but it cannot undo any access or data exposure if a compromised script has already run.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook