chore: update lockfile, Node.js, pnpm, and pacquet versions (#12441)

* chore: update lockfile, Node.js, pnpm, and pacquet versions

* fix: node range

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.github/workflows/benchmark.yml

@@ -63,7 +63,7 @@ jobs:
     - name: Install pnpm and Node
       uses: pnpm/setup@b1cac37306e39c21283b9dd6cb0ac288fb35ba6b
       with:
-        runtime: node@26.3.0
+        runtime: node@26.3.1
 
     - name: Install Rust Toolchain
       uses: ./.github/actions/rustup

.github/workflows/ci.yml

@@ -57,14 +57,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node: ['22.13.0', '24.0.0', '26.3.0']
+        node: ['22.13.0', '24.0.0', '26.3.1']
         platform: [ubuntu-latest, windows-latest]
         include:
           - node: '22.13.0'
             node_major: '22'
           - node: '24.0.0'
             node_major: '24'
-          - node: '26.3.0'
+          - node: '26.3.1'
             node_major: '26'
           - platform: ubuntu-latest
             platform_label: ubuntu
@@ -77,7 +77,7 @@ jobs:
           # Exception: main and release branches (release/x, release/x.x) run the full matrix.
           - node: ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) && 'none' || '24.0.0' }}
             platform: windows-latest
-          - node: ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) && 'none' || '26.3.0' }}
+          - node: ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) && 'none' || '26.3.1' }}
             platform: windows-latest
     uses: ./.github/workflows/test.yml
     with:

.github/workflows/release.yml

@@ -36,7 +36,7 @@ jobs:
       - name: Install pnpm and Node
         uses: pnpm/setup@b1cac37306e39c21283b9dd6cb0ac288fb35ba6b
         with:
-          runtime: node@26.3.0
+          runtime: node@26.3.1
       # The publish phase is split into three sequential steps to control which packages
       # use trusted publishing (OIDC) vs. a static token. `pnpm publish` currently bails
       # out of OIDC as soon as a static `_authToken` is configured, so the only way to

package.json

@@ -18,7 +18,7 @@
     "test-branch": "pn pretest && pn lint && git remote set-branches --add origin main && git fetch origin main && pn test-pkgs-branch",
     "ci:test-branch": "pn prepare-fixtures && pn test-pkgs-branch",
     "test-pkgs-branch": "pn remove-temp-dir && pn --workspace-concurrency=1 --filter=...[origin/main] --no-sort --if-present .test",
-    "compile-only": "tsgo --build workspace/workspace-manifest-reader workspace/projects-reader && pnx node@runtime:26.3.0 __utils__/scripts/src/typecheck-only.ts && pn -F=pnpm compile",
+    "compile-only": "tsgo --build workspace/workspace-manifest-reader workspace/projects-reader && pnx node@runtime:26.3.1 __utils__/scripts/src/typecheck-only.ts && pn -F=pnpm compile",
     "compile": "pn compile-only && pn update-manifests",
     "build:pacquet": "cargo build --release --bin pacquet",
     "make-lcov": "shx mkdir -p coverage && lcov-result-merger './packages/*/coverage/lcov.info' 'coverage/lcov.info'",
@@ -62,16 +62,16 @@
     "shx": "catalog:",
     "typescript": "catalog:"
   },
-  "packageManager": "pnpm@11.7.0",
+  "packageManager": "pnpm@11.8.0",
   "devEngines": {
     "packageManager": {
       "name": "pnpm",
-      "version": "11.7.0",
+      "version": "11.8.0",
       "onFail": "download"
     },
     "runtime": {
       "name": "node",
-      "version": "26.3.0",
+      "version": "26.3.1",
       "onFail": "download"
     }
   }

pnpm-workspace.yaml

@@ -352,7 +352,7 @@ catalogMode: strict
 cleanupUnusedCatalogs: true
 
 configDependencies:
-  '@pnpm/pacquet': 0.11.7
+  '@pnpm/pacquet': 0.11.10
 
 enableGlobalVirtualStore: true