security: enable pnpm's no-downgrade trustPolicy

[Timeless0911]

Summary

Enable pnpm's new no-downgrade trustPolicy. This helps prevent installing potentially compromised versions of a package.

Related Links

• https://pnpm.io/settings#trustpolicy

Checklist

• Tests updated (or not required).
• Documentation updated (or not required).

[netlify]

✅ Deploy Preview for rslib ready!

Name	Link
🔨 Latest commit	be4c19b
🔍 Latest deploy log	https://app.netlify.com/projects/rslib/deploys/69157adf48c9b00008a8e596
😎 Deploy Preview	https://deploy-preview-1333--rslib.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

Pull Request Overview

This PR enhances security by enabling pnpm's no-downgrade trustPolicy, which prevents installing potentially compromised downgraded versions of packages. The pnpm package manager is upgraded from version 10.21.0 to 10.22.0 to support this feature.

• Added trustPolicy: no-downgrade setting to pnpm workspace configuration
• Updated pnpm version requirement from 10.21.0 to 10.22.0

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
pnpm-workspace.yaml	Adds trustPolicy: no-downgrade configuration to enable security protection against package downgrades
package.json	Updates pnpm version from 10.21.0 to 10.22.0 in both packageManager field and engines requirement to support the new trustPolicy feature

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chenjiahan]

👍

[chenjiahan]

We can exclude chokidar: https://github.com/web-infra-dev/rslib/actions/runs/19322701784/job/55267109693?pr=1333#step:8:7

[Timeless0911]

We can exclude chokidar: web-infra-dev/rslib/actions/runs/19322701784/job/55267109693?pr=1333#step:8:7

There are many packages similar to chokidar, it might result in a very long list to config. The problem here is why running pnpm dedupe results in an error while pnpm install does not. pnpm/pnpm#8889 (comment)

[chenjiahan]

Get, we can wait for pnpm to fix the pnpm dedupe issue.