build(deps): track and enforce pnpm lockfile

[yyhhyyyyyy]

Summary

• Track a freshly resolved pnpm-lock.yaml generated with Node.js 24.14.1 and pnpm 10.33.4.
• Update dependency minimums for confirmed security issues, including Axios, Undici, Vite, Vitest, Sharp, and @lingual/i18n-check.
• Override Monaco Editor's transitive DOMPurify dependency to 3.4.12 until upstream adopts a safe version.
• Require pnpm install --frozen-lockfile in PR checks, platform builds, releases, and Windows ARM64 E2E.
• Add workflow contract coverage to prevent installation policy regressions.
• Keep pnpm caching disabled for now.
• Update the existing PR quality-gates architecture documentation.

Motivation

pnpm-lock.yaml was previously ignored, so identical commits could resolve different direct and transitive dependency versions over time.

Tracking the lockfile and enforcing frozen installs makes dependency resolution reproducible for the same platform and fixed Node.js/pnpm versions. CI now fails immediately when a manifest change is not accompanied by the corresponding lockfile update.

This guarantees reproducible dependency inputs, but does not claim byte-for-byte identical installers across operating systems, signing environments, timestamps, or dynamic Provider/ACP data refreshes.

Compatibility and security notes

• Existing semver ranges are preserved; the lockfile records the exact dependency graph used by builds.
• Sharp 0.35 type compatibility was addressed in the OCR image preprocessing path.
• pnpm audit --audit-level high passes.
• The full audit retains one documented moderate advisory in @hono/node-server@1.19.14, introduced through @modelcontextprotocol/sdk. The patched Hono version requires an incompatible major upgrade, and DeepChat does not directly use the affected static-file middleware, so no forced override was added.
• Provider/ACP refresh scripts and generated resource snapshots are unchanged.

Summary by CodeRabbit

• Dependency Updates

  • Updated runtime and dev packages (Axios, Sharp, Undici, Vite, Vitest).
  • Added a dependency override for Monaco Editor’s DOMPurify.

• Reliability Improvements

  • CI dependency installs now use pnpm install --frozen-lockfile to ensure lockfile consistency across builds, tests, releases, and platform workflows.
  • Added quality-gate documentation and validation for lockfile drift.
  • Adjusted .gitignore to stop ignoring pnpm-lock.yaml.

• Bug Fixes

  • Improved TypeScript typing in image preprocessing without changing runtime behavior.

• Tests

  • Added/updated workflow tests to verify frozen installs and disabled dependency caching.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f26fec58-ba08-4517-877e-a886aec06654

📥 Commits

Reviewing files that changed from the base of the PR and between efd03ff and f7db4cc.

📒 Files selected for processing (1)

• test/main/scripts/pnpmInstallWorkflow.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• test/main/scripts/pnpmInstallWorkflow.test.ts

---

📝 Walkthrough

Walkthrough

Dependency versions and Sharp typing are updated. GitHub Actions workflows now use pnpm install --frozen-lockfile, pnpm-lock.yaml is tracked, CI requirements are documented, and workflow tests validate installation commands and caching settings.

Changes

Dependency and CI reproducibility

Layer / File(s)	Summary
Dependency versions and Sharp typing package.json, src/main/ocr/imagePreprocessor.ts	Runtime and development dependencies are upgraded, a DOMPurify override is added, and Sharp typing is updated.
Frozen install enforcement .github/workflows/*.yml, .gitignore, docs/architecture/pr-check-quality-gates/spec.md	Build, PR-check, release, and Windows ARM64 workflows use frozen-lockfile installs; pnpm-lock.yaml is no longer ignored and the CI contract is documented.
Workflow installation contract tests test/main/scripts/pnpmInstallWorkflow.test.ts, test/main/scripts/prcheckWorkflow.test.ts	Tests verify frozen install counts, disabled package-manager caching, isolated OCR installs, and updated PR-check commands.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• ThinkInAIXYZ/deepchat#511: Earlier pnpm CI migration changes overlap with the install steps tightened here.
• ThinkInAIXYZ/deepchat#1653: Introduced the Windows ARM64 workflow whose installs are updated here.
• ThinkInAIXYZ/deepchat#2008: Rebuilds and validates the PR-check workflow covered by these command expectation updates.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: locking pnpm installs to the committed lockfile and updating dependency tracking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch build/track-pnpm-lockfile

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/main/scripts/pnpmInstallWorkflow.test.ts`:
- Around line 18-23: Rename the workflowInstallCounts constant to
WORKFLOW_INSTALL_COUNTS and update its reference at the usage site in the test.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 50838901-86af-48f9-9bfc-a069a3453cfc

📥 Commits

Reviewing files that changed from the base of the PR and between a69dd21 and efd03ff.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (10)

• .github/workflows/build.yml
• .github/workflows/prcheck.yml
• .github/workflows/release.yml
• .github/workflows/windows-arm64-e2e.yml
• .gitignore
• docs/architecture/pr-check-quality-gates/spec.md
• package.json
• src/main/ocr/imagePreprocessor.ts
• test/main/scripts/pnpmInstallWorkflow.test.ts
• test/main/scripts/prcheckWorkflow.test.ts

💤 Files with no reviewable changes (1)

• .gitignore