Summary

Migrates the repo to pnpm and applies the low-risk subset of supply-chain hardening from the playbook informed by the TanStack/router compromise (May 2026) and Adnan Khan's GitHub Actions cache poisoning research. End users of @supabase/ssr are unaffected: same tarball, same npm publish --provenance flow, same trusted-publisher binding.

Package manager

• Pin packageManager to pnpm@11.1.0 with a sha512 hash in package.json. A tampered pnpm binary served by a compromised mirror fails the hash check instead of running.
• Convert package-lock.json to pnpm-lock.yaml (3589 lines removed, 3213 added). Lockfile contains only registry resolutions (no github:, git+, file: refs).

Supply-chain hardening (pnpm-workspace.yaml)

New file with three guards aimed at the TanStack class of attacks:

• minimumReleaseAge: 10080 blocks installs of any version published in the last 7 days. The TanStack malicious versions were pulled within hours, so this single setting would have blocked the install path.
• minimumReleaseAgeExclude: ['@supabase/*'] lets the update-supabase-js.yml workflow bypass the quarantine for first-party releases.
• blockExoticSubdeps: true refuses non-registry refs in transitive deps. This kills the optionalDependencies: { foo: "github:owner/repo#sha" } vector TanStack used.
• allowBuilds: { esbuild: true } is the explicit install-script allowlist (default deny). Only esbuild is permitted to run lifecycle scripts, since vitest depends on it.

Workflow hardening

Applied across all four workflows (ci.yml, release.yml, update-supabase-js.yml, conventional-commits.yml):

• persist-credentials: false on every actions/checkout. Default behavior writes a write-capable token to .git/config on disk, where any later step (including a compromised dependency) can read it.
• Convert npm commands to pnpm: pnpm install --frozen-lockfile, pnpm build, pnpm test, pnpm exec prettier, pnpm exec eslint.
• Add pnpm/action-setup@739bfe42ca9233c5e6aca07c1a25a9d34aca49b0 (v6.0.7), pinned by commit SHA. v6 reads the packageManager field automatically so no version: arg is needed.
• Bump update-supabase-js.yml checkout SHA from v4.3.0 to v6.0.1 so dependabot only tracks one version.
• Drop the corepack enable npm && corepack prepare npm@11 line from release.yml (no longer needed).
• Add a # v4.4.0 comment next to the googleapis/release-please-action SHA pin for readability.

Cache poisoning fix

Removed cache: pnpm from release.yml and update-supabase-js.yml. Per Adnan Khan's research, caching in release workflows is exploitable: a compromised dep that runs on a main-context job can dump the Actions runtime token from runner memory and poison cache entries that a later release run will restore, replacing package.json with one carrying a preinstall payload. With id-token: write in scope, that payload can mint a publish token.

ci.yml retains cache: pnpm because cache poisoning there only breaks CI, not releases.

Other changes

• .github/dependabot.yml (new): weekly github-actions ecosystem updates so SHA-pinned actions stay current.
• .github/CODEOWNERS (new): blanket ownership across the repo so workflow and release-config edits require explicit review.
• README.md: install snippet now shows npm, pnpm, yarn, and bun side by side instead of pushing consumers toward one manager.
• src/createBrowserClient.ts and src/createServerClient.ts: prettier reformatted these (whitespace only, no semantic change) after the prettier version resolved by pnpm bumped from the previous lockfile pin to 3.8.3. No runtime difference.