[qawatake]

Final decision: proceed
Risk: low — axes: toolchain change only (package manager version pin)
Release/deploy: not needed (no-release) — reason: pnpm only installs dependencies; the resolved dependency graph (pnpm-lock.yaml) is unchanged, so build artifacts are identical.
Reviewer focus: the pin files agree with each other (mise.toml vs packageManager), and pnpm-lock.yaml is untouched.

A. Summary

• Target: pnpm 10.33.2 -> 10.34.7 in mise.toml, package.json
• Motivation: pnpm 10.34.x carries several security fixes (lockfile integrity hard-fail, .npmrc env-var exfiltration fix GHSA-3qhv-2rgh-x77r, path-traversal fixes in the linker); align the exact pin with the latest 10.x release and let the old 10.33.x install be removed from the developer machine.

B. What changes

• Primary sources: https://github.com/pnpm/pnpm/releases/tag/v10.34.0 (and v10.34.1 … v10.34.7), GHSA-3qhv-2rgh-x77r
• Version range checked: 10.33.2 -> 10.34.7
• Breaking/behavior changes relevant to this repo:
  • 10.34.0: tarball-integrity mismatches against the lockfile are now a hard failure for non-frozen installs (--frozen-lockfile behavior unchanged). Not triggered here: the frozen install passed.
  • 10.34.2/10.34.3: ${ENV_VAR} placeholders in a repository-controlled .npmrc / pnpm-workspace.yaml are no longer expanded. Not applicable: this repo's .npmrc / pnpm-workspace.yaml contain no ${...} placeholders.
  • 10.33.4: a gitHosted field is recorded for git-hosted tarballs in the lockfile. Not applicable: no git-hosted dependencies; the lockfile did not change.

C. Impact

change	affected	evidence
exact pnpm pin 10.33.2 -> 10.34.7	local dev via mise / packageManager self-switch; CI (ci.yml via mise-action, installs pnpm from mise.toml) runs on this PR	pnpm install --frozen-lockfile with 10.34.7 succeeds, lockfile unchanged

D. Changes made

• Bumped the exact pnpm version in mise.toml, package.json. Nothing else (no node pin, no dependency, no lockfile change).

E. Verification

• Commands run locally with pnpm 10.34.7 (fresh worktree off origin/main):
  • pnpm --version -> exit 0
  • pnpm install --frozen-lockfile -> exit 0
  • pnpm lint -> exit 0
  • pnpm typecheck -> exit 0
  • pnpm build -> exit 0
  • node scripts/check-toolchain.mjs -> exit 0
• CI status: see checks on this PR (CI (ci.yml via mise-action, installs pnpm from mise.toml) runs on this PR).
• Artifact changed? no — pnpm-lock.yaml is unchanged after a frozen install with pnpm 10.34.7, so the dependency graph the build consumes is identical. main.js is not committed in this repo (built on release); local pnpm build produced sha256 a1c0cbd974d6a49711ce3597a3075d389556c6bb111d0f8634eb7aace008437d and left no diff in tracked files.
• Lockfile changed? no (git status after pnpm install --frozen-lockfile shows only the pin files)

F. Rollback

• Revert this PR; no persistent side effects.

G. Provenance

• Official release channel (mise registry / npm pnpm@10.34.7); lockfile updated: no.

H. License

• No change (package manager version bump only).

I. Open items

• e2e (Playwright) was not run locally; left to CI where applicable.