The Obsidian community plugin scan flagged the pnpm lockfile as out of
date. The committed lockfile was lockfileVersion 6.1 (pnpm 8), which a
modern pnpm rejects (ERR_PNPM_LOCKFILE_BREAKING_CHANGE) - the plugin was
removed from the community list on 2026-05-12.
Regenerate the lockfile to 9.0 and modernize the toolchain so it stays
valid:
- pnpm 11 (packageManager) + lockfile regenerated to 9.0
- update all dependencies to latest (esbuild 0.28, typescript 6,
husky 9, semantic-release 25, commitlint 21, @types/node 22)
- pin obsidian (^1.13.0) instead of floating "latest"
- tsconfig: bundler resolution + src/* paths (replaces deprecated
baseUrl), explicit types: [node]
- pnpm-workspace.yaml allowBuilds for esbuild (pnpm 11 build-script gate)
- husky 9 hook format
- CI: Node 22, pnpm 11, all actions pinned by commit SHA, Trivy
supply-chain gate (fails on HIGH/CRITICAL vulns or leaked secrets),
frozen-lockfile install, least-privilege permissions
- remove dead eslint config
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- added semantic-version package to automate CHANGELOG.md creation and version bumping
- added husky commit message hook to prevent commit messages not parsable by semantic-version package
