Scope: all 49 workspace projects ? Verifying lockfile against supply-chain policies (2242 entries)... [WARN] Request took 10876ms: https://registry.npmjs.org/drizzle-orm ✗ Lockfile failed supply-chain policy check (2242 entries in 20.1s) [ERR_PNPM_TRUST_DOWNGRADE] 4 lockfile entries failed verification: semver@5.7.2 High-risk trust downgrade for "semver@5.7.2" (possible package takeover) semver@6.3.1 High-risk trust downgrade for "semver@6.3.1" (possible package takeover) undici-types@6.21.0 High-risk trust downgrade for "undici-types@6.21.0" (possible package takeover) vite@6.4.1 High-risk trust downgrade for "vite@6.4.1" (possible package takeover) The lockfile contains entries that the active policies reject. This can mean the lockfile is stale, or that someone committed a lockfile that bypassed the policy locally — inspect recent changes to pnpm-lock.yaml before trusting it. If the changes look expected, run "pnpm clean --lockfile" and then "pnpm install" to rebuild from a fresh resolution. Alternatively, relax the policy that flagged them.