chore: upgrade nodeJS and pnpm

[brunomenezes]

Why now

Two deadlines, one of them immediate:

• GitHub removes the node20 action runtime on 2026-09-23. Four of our actions
  still run on it, so CI breaks on that date whether or not we do anything else.
• Node 22 leaves Active LTS. Moving to Node 24 ("Krypton") keeps us on a
  supported runtime.

Since the pnpm upgrade was already required to unblock the toolchain, we also
adopted the same install-time supply-chain policy used in
rollups-explorer#475.

No application code changed. No user-facing behaviour changes, and
next.config.js / src/ are untouched — the Vercel build path is unaffected.

What changed

Toolchain — Node.js 22 → 24.21.0 (LTS), pnpm 10.25.0 → 11.27.1.

Supply-chain policy (pnpm-workspace.yaml) — pnpm 11 removed
onlyBuiltDependencies, so build approvals move to allowBuilds, plus:

Setting	Effect
allowBuilds	Dependency install scripts are denied unless explicitly approved
strictDepBuilds	Install fails rather than silently skipping an unreviewed build script
blockExoticSubdeps	Transitive deps must come from the registry, not git or tarball URLs
minimumReleaseAge: 10080	A published version must be 7 days old before it can be resolved
trustPolicy: no-downgrade	Install fails if a package's trust level drops

CI — checkout v4→v7, setup-node v4→v7, pnpm/action-setup v4→v6.1.0
(v4 cannot install pnpm 11), chromaui/action v13.2.0→v18.9.4, and
coverallsapp/github-action pinned off the moving @master tag to v2.3.8.
The build.yml workflow is renamed Docker → CI, which is what it has always
actually been.

Cleanup — removed the dead root Dockerfile (pinned node:14, referenced a
yarn.lock deleted years ago, built nothing); pruned two build approvals for
packages that no longer run build scripts.

Notable finding

blockExoticSubdeps immediately caught a real issue: ethereumjs-abi was being
pulled from an unpinned git URL with no ref, meaning it resolved to whatever
that branch's HEAD happened to be at install time. It reached us eight levels
deep via @cartesi/staking-pool → @ensdomains/ens-contracts → … → eth-sig-util.

Fixed by pinning the equivalent registry release through overrides rather than
weakening the setting. The lockfile now contains zero git or tarball sources.

Reviewer notes

• Commits are ordered so the machine-generated lockfile sits alone.
• minimumReleaseAge does not affect CI (--frozen-lockfile never re-resolves);
  it applies to pnpm add / pnpm update locally.
• Contributors now need corepack enable — documented in the README.

Follow-up

Migrating to pnpm/setup@v3 (replaces pnpm/action-setup + actions/setup-node
with a single step) is deliberately deferred to its own PR, so a CI failure here
has one candidate cause rather than two.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
staking	Ready	Preview	Sep 22, 2026 5:40pm UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​node@​22.18.8 ⏵ 24.13.4	+1

View full report

[coveralls]

Coverage Report for CI Build 35762197515

Coverage remained the same at 66.43%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	3800
Covered Lines:	2648
Line Coverage:	69.68%
Relevant Branches:	1982
Covered Branches:	1193
Branch Coverage:	60.19%
Branches in Coverage %:	Yes
Coverage Strength:	29.84 hits per line

---

💛 - Coveralls