This repository had no CI and no dependabot, while the settings page under
webview2/settings/ime-settings is a Vite and TypeScript project that the Windows release workflow
builds. Until now pnpm build only ever ran while cutting a release, so a break here surfaced at
the worst possible moment.
pnpm-workspace.yaml declared only onlyBuiltDependencies. pnpm 10 honours that key, which is why
releases worked, but pnpm 11 reads allowBuilds instead: it refuses to run esbuild's postinstall,
exits 1, and rewrites the file with a "set this to true or false" placeholder. So pnpm install
--frozen-lockfile fails outright for anyone on a current pnpm. Declaring allowBuilds alongside the
existing key satisfies both, verified against 10.34.5 and 11.25.0.
packageManager pins the pnpm version so a local checkout and CI agree through corepack.
dependabot now covers npm as well as actions. The template used across the other repositories only
declares github-actions and gitsubmodule, so the settings page dependencies were unwatched: they
sit one to two majors behind, with typescript at 5.9 against 7.0 and vite at 7.2 against 8.2.
Those bumps are left to dependabot rather than done here.
The README described only the symlink debug trick, through one developer's absolute paths, and
never mentioned that the settings page has to be built at all.
Evan Hu
e11d69c754