deps: upgrade to pnpm 11 [beta]

[redsh4de]

• New versions are quarantined for 24h before being resolved
• Dependencies can no longer pull sub-dependencies from random git or tarball URLs, only the npm registry
• Migrates onlyBuiltDependencies -> allowBuilds in the new pnpm-workspace.yaml

[github-actions]

What	Link
🕵️‍♂️ Review	Files changed
🌐 Deploy	Preview #2661

[redsh4de]

more info: https://pnpm.io/blog/releases/11.0

[plowsof]

2026-May-13 11:31:19.245564
#12 [stage-0  8/12] RUN --mount=type=cache,id=b84ocwsgsgo8cggo8sk44wg0-/root/local/share/pnpm/store/v3,target=/root/.local/share/pnpm/store/v3 pnpm i --frozen-lockfile
2026-May-13 11:31:19.245564
#12 0.830 node:internal/modules/esm/utils:273
2026-May-13 11:31:19.245564
#12 0.830   throw new ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING();
2026-May-13 11:31:19.245564
#12 0.830         ^
2026-May-13 11:31:19.245564
#12 0.830
2026-May-13 11:31:19.245564
#12 0.830 TypeError [ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING]: A dynamic import callback was not specified.
2026-May-13 11:31:19.245564
#12 0.830     at importModuleDynamicallyCallback (node:internal/modules/esm/utils:273:9)
2026-May-13 11:31:19.245564
#12 0.830     at Object.<anonymous> (/root/.cache/node/corepack/pnpm/11.1.1/bin/pnpm.cjs:3:1)
2026-May-13 11:31:19.245564
#12 0.830     at Module2._compile (/nix/store/cwxxy2is6hb4dcqsx8rhnvwic3hfzpcd-nodejs-22.19.0/lib/node_modules/corepack/dist/lib/corepack.cjs:39487:34)
2026-May-13 11:31:19.245564
#12 0.830     at Object..js (node:internal/modules/cjs/loader:1839:10)
2026-May-13 11:31:19.245564
#12 0.830     at Module.load (node:internal/modules/cjs/loader:1441:32)
2026-May-13 11:31:19.245564
#12 0.830     at Function._load (node:internal/modules/cjs/loader:1263:12)
2026-May-13 11:31:19.245564
#12 0.830     at TracingChannel.traceSync (node:diagnostics_channel:322:14)
2026-May-13 11:31:19.245564
#12 0.830     at wrapModuleLoad (node:internal/modules/cjs/loader:237:24)
2026-May-13 11:31:19.245564
#12 0.830     at executeUserEntryPoint (node:internal/modules/run_main:171:5)
2026-May-13 11:31:19.245564
#12 0.830     at process.processTicksAndRejections (node:internal/process/task_queues:89:21) {
2026-May-13 11:31:19.245564
#12 0.830   code: 'ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING'
2026-May-13 11:31:19.245564
#12 0.830 }
2026-May-13 11:31:19.245564
#12 0.830
2026-May-13 11:31:19.245564
#12 0.830 Node.js v22.19.0
2026-May-13 11:31:19.245564
#12 ERROR: process "/bin/bash -ol pipefail -c pnpm i --frozen-lockfile" did not complete successfully: exit code: 1
2026-May-13 11:31:19.245564
------
2026-May-13 11:31:19.245564
> [stage-0  8/12] RUN --mount=type=cache,id=b84ocwsgsgo8cggo8sk44wg0-/root/local/share/pnpm/store/v3,target=/root/.local/share/pnpm/store/v3 pnpm i --frozen-lockfile:
2026-May-13 11:31:19.245564
0.830     at Module.load (node:internal/modules/cjs/loader:1441:32)
2026-May-13 11:31:19.245564
0.830     at Function._load (node:internal/modules/cjs/loader:1263:12)
2026-May-13 11:31:19.245564
0.830     at TracingChannel.traceSync (node:diagnostics_channel:322:14)
2026-May-13 11:31:19.245564
0.830     at wrapModuleLoad (node:internal/modules/cjs/loader:237:24)
2026-May-13 11:31:19.245564
0.830     at executeUserEntryPoint (node:internal/modules/run_main:171:5)
2026-May-13 11:31:19.245564
0.830     at process.processTicksAndRejections (node:internal/process/task_queues:89:21) {
2026-May-13 11:31:19.245564
0.830   code: 'ERR_VM_DYNAMIC_IMPORT_CALLBACK_MISSING'
2026-May-13 11:31:19.245564
0.830 }
2026-May-13 11:31:19.245564
0.830
2026-May-13 11:31:19.245564
0.830 Node.js v22.19.0
2026-May-13 11:31:19.245564
------
2026-May-13 11:31:19.245564
2026-May-13 11:31:19.245564
1 warning found (use docker --debug to expand):
2026-May-13 11:31:19.245564
- UndefinedVar: Usage of undefined variable '$NIXPACKS_PATH' (line 18)
2026-May-13 11:31:19.245564
Dockerfile:21
2026-May-13 11:31:19.245564
--------------------
2026-May-13 11:31:19.245564
19 |     COPY . /app/.
2026-May-13 11:31:19.245564
20 |     RUN --mount=type=cache,id=b84ocwsgsgo8cggo8sk44wg0-/root/local/share/pnpm/store/v3,target=/root/.local/share/pnpm/store/v3 npm install -g corepack@0.24.1 && corepack enable
2026-May-13 11:31:19.245564
21 | >>> RUN --mount=type=cache,id=b84ocwsgsgo8cggo8sk44wg0-/root/local/share/pnpm/store/v3,target=/root/.local/share/pnpm/store/v3 pnpm i --frozen-lockfile
2026-May-13 11:31:19.245564
22 |
2026-May-13 11:31:19.245564
23 |     # build phase
2026-May-13 11:31:19.245564
--------------------

[redsh4de]

Nixpacks is pinning a 2 year old corepack for some reason: https://github.com/railwayapp/nixpacks/blob/main/src/providers/node/mod.rs#L178

pnpm 11 breaks with it, reproduced locally by installing a older corepack and attempting to install

[plowsof]

coolify must move to dockerfile (or should anyway?)

[redsh4de]

I think it should in any case yeah, i can submit a dockerfile patch here so it supports the envs coolify consumes (for the serve-ssr route)

[redsh4de]

Ah, actually - a better option looks to be to migrate to Railpack in Coolify. Nixpacks is in maintenance mode, and Coolify acknowledges people having issues with nixpacks so railpack is recommended instead: coollabsio/coolify#9117

[plowsof]

coolify is currently on a version from Nov 2025 https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.442 , i've enabled updates + clicked check manually - it says there is an update available but doesn't seem to install it will look into this. edit* the upgrade button of course

now using https://github.com/coollabsio/coolify/releases/tag/v4.0.0 which i dont think has railpack yet

[redsh4de]

yh, its on track for v4.1 apparently

i guess lets keep this PR on the backburner until that versions out

[redsh4de]

@plowsof v4.1.0 is out with Railpack support: https://github.com/coollabsio/coolify/releases/tag/v4.1.0

[plowsof]

tracking in coollabsio/coolify#10435

[plowsof]

source_commit has to be manually enabled now, that was all, the preview is running the latest version of this now

[redsh4de]

updated the package manager to latest, saw it do the supply chain audit before install - should be good to go

https://pnpm.io/blog/releases/11.4

...closes a cluster of supply-chain holes around lockfile integrity, credential scoping, git resolutions, patch files, and dependency aliases, makes tarball-integrity mismatches a hard install failure by default...

[plowsof]

can you rebase with current beta branch and squash please

[redsh4de]

done!