Apply explicit pnpm security baseline to themes

[9larsons]

What changed

• set minimumReleaseAge: 4320 at the monorepo root
• explicitly enable strictDepBuilds and blockExoticSubdeps at the root
• propagate the same three settings to all 16 package-local pnpm-workspace.yaml files that are subtree-pushed into standalone theme repositories
• preserve the existing package-wide dtrace-provider: false denial everywhere

Why

The root and standalone theme installs previously relied on pnpm defaults for package age, unreviewed lifecycle scripts, and exotic transitive dependency sources. The package-local workspace files are part of the subtree payload, so changing only the monorepo root would leave direct installs and Renovate PRs in standalone theme mirrors without the same policy.

There are no true build permissions in this repository, so this change grants no new lifecycle-script capability and has no version-scoped approvals to add.

Impact

Both monorepo and standalone theme installs now:

• delay packages published within the last 72 hours
• fail on any unreviewed dependency build script
• reject exotic sources introduced through transitive dependencies

The next subtree sync will carry the package-local policy to each standalone mirror.

Validation

• pnpm@11.19.0 install --frozen-lockfile — verified all 558 lockfile entries against supply-chain policies
• pnpm build — built all 16 themes
• pnpm test — all 16 themes passed Ghost 6.x compatibility checks
• pnpm zip --theme taste
• npm test in packages/theme-translations — 8 tests passed
• npm pack --dry-run --ignore-scripts for @tryghost/shared-theme-assets and @tryghost/theme-translations
• isolated packages/taste outside the monorepo with no lockfile or node_modules, then verified:
  • the package-local policy resolves to 4320, true, and true
  • pnpm install --no-frozen-lockfile
  • pnpm zip
  • pnpm exec gscan --fatal --verbose .
• confirmed all 16 package-local policy files remain identical

Refs PLA-321

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c7300542-6b5e-4676-b584-d7d1a8cec1b2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}