Evan Hu
e11d69c754
This repository had no CI and no dependabot, while the settings page under webview2/settings/ime-settings is a Vite and TypeScript project that the Windows release workflow builds. Until now pnpm build only ever ran while cutting a release, so a break here surfaced at the worst possible moment. pnpm-workspace.yaml declared only onlyBuiltDependencies. pnpm 10 honours that key, which is why releases worked, but pnpm 11 reads allowBuilds instead: it refuses to run esbuild's postinstall, exits 1, and rewrites the file with a "set this to true or false" placeholder. So pnpm install --frozen-lockfile fails outright for anyone on a current pnpm. Declaring allowBuilds alongside the existing key satisfies both, verified against 10.34.5 and 11.25.0. packageManager pins the pnpm version so a local checkout and CI agree through corepack. dependabot now covers npm as well as actions. The template used across the other repositories only declares github-actions and gitsubmodule, so the settings page dependencies were unwatched: they sit one to two majors behind, with typescript at 5.9 against 7.0 and vite at 7.2 against 8.2. Those bumps are left to dependabot rather than done here. The README described only the symlink debug trick, through one developer's absolute paths, and never mentioned that the settings page has to be built at all.