Feat/strict pnpm rules

[WybeBosch]

Strengere pnpm-instellingen om de supply chain wat beter af te dichten en de tooling consistent te houden.

Wat er verandert:

• minimumReleaseAge op 7 dagen (10080 min): nieuwe versies van dependencies worden pas geïnstalleerd als ze minstens een week oud zijn. Eigen packages (@yardinternet/*) zijn uitgezonderd.
• Integrity-hash toegevoegd aan packageManager zodat Corepack de pnpm-versie verifieert.
• prettier vastgezet op wp-prettier@3.0.3, anders verdwijnt de parenSpacing bij het formatten.
• lerna publish-commit message teruggezet naar chore: lerna publish.

[Copilot]

Pull request overview

This PR tightens pnpm-related supply-chain and workflow consistency across the Yard Toolkit monorepo by delaying adoption of newly published dependency versions, pinning/validating toolchain versions, and aligning local/CI developer checks.

Changes:

• Add pnpm rules to delay new dependency versions for 7 days (excluding @yardinternet/*) and pin pnpm via packageManager with an integrity hash.
• Pin Prettier to wp-prettier@3.0.3, add a format check script, and introduce a verify script used by Husky pre-push.
• Adjust release tooling and dependency update tooling (Lerna publish commit message and Dependabot cooldown), and add workspace VS Code settings.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pnpm-workspace.yaml	Adds minimumReleaseAge and an exclude pattern for internal packages.
package.json	Pins pnpm with integrity, pins Prettier, and adds format:check:js + verify scripts.
lerna.json	Updates Lerna publish commit message.
.vscode/settings.json	Adds repo VS Code defaults for formatting and linting on save.
.husky/pre-push	Runs pnpm verify instead of only tests.
.husky/pre-commit	Removes the previous lint-staged pre-commit hook.
.github/dependabot.yml	Adds a 7-day cooldown with an exclude for internal packages.

Comments suppressed due to low confidence (1)

package.json:36

• lint-staged is still listed as a devDependency, but the only Husky hook that invoked it (.husky/pre-commit) has been removed and there are no other references to lint-staged in the repo. Keeping an unused dependency increases the supply-chain surface and maintenance overhead; either remove it or reintroduce a hook/script that uses it.

		"prettier": "npm:wp-prettier@3.0.3",
		"@yardinternet/toolkit": "workspace:*",
		"husky": "^9.1.7",
		"lerna": "^9.0.4",
		"lint-staged": "^16.2.7",

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

Comments suppressed due to low confidence (1)

package.json:37

• lint-staged is still installed/configured (see .lintstagedrc.json and this devDependency), but the .husky/pre-commit hook was removed in this PR. That makes lint-staged effectively unused and keeps an extra dependency in the supply chain. Consider either reintroducing a pre-commit hook that runs lint-staged, or removing lint-staged (and the config) entirely.

		"prettier": "npm:wp-prettier@3.0.3",
		"@yardinternet/toolkit": "workspace:*",
		"husky": "^9.1.7",
		"lerna": "^9.0.4",
		"lint-staged": "^16.2.7",
		"syncpack": "^14.0.0",