[Request] Update pnpm to supported version

[Eschguy]

Please confirm

• I have searched existing issues
• This issue is not a duplicate of an existing one
• This is not a request for a plugin

Feature Request Description

Decky currently builds with pnpm-9.15.9. pnpm v9.x support ended on 30 April 2026 (support schedule). Decky should update to a supported version when possible.

Further Description

No response

[zdennisz]

Hey @Eschguy! Good catch — pnpm v9 has been EOL since April 30th.

I've opened a PR at #934 that replaces npm i -g pnpm with the official pnpm/action-setup@v4 action pinned to v10 across all four CI workflows. The existing lockfile is already compatible with v10 so no regeneration needed.

Thanks for flagging it!

[theCapypara]

Just as an addition, this also currently prevents using Decky Loader with NixOS:

       … while evaluating definitions from `/nix/store/kmc64k47bl0kij42avnflkm3w5gy5dm9-source/modules/decky-loader.nix':

       (stack trace truncated; use '--show-trace' to show the full, detailed trace)

       error: Refusing to evaluate package 'pnpm-9.15.9' in /nix/store/wlk9a5827bc2pdqisypjkgcv5j72xia8-source/pkgs/development/tools/pnpm/generic.nix:164 because it is marked as insecure

       Known issues:
        - CVE-2026-48995
        - CVE-2026-50014
        - CVE-2026-50015
        - CVE-2026-50016
        - CVE-2026-50017
        - CVE-2026-50573
        - CVE-2026-55699

[Eschguy]

Just as an addition, this also currently prevents using Decky Loader with NixOS:

That's how I became aware, currently overriding with this in my steam deck's config

  nixpkgs.config.permittedInsecurePackages = [
    "pnpm-9.15.9"
  ];