Picks up pnpm/update#4: the pin bump now happens first, so the dependency update and the refreshed lockfile are produced by the pnpm version the update PR moves the repository onto. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>