chore: update dependencies and pnpm tooling

[robin-liquidium]

Summary

• update Next.js to 16.3.3 for two critical security fixes and refresh compatible stable dependencies
• migrate pnpm 10 to 11 with explicit build approvals, strict 24-hour release quarantine, and the required LaserEyes exotic-source compatibility setting
• preserve the production-proven PostHog CLI 0.10.0 rollback and restrict CI token permissions to contents read

Validation

• pnpm 11 frozen install and peer check
• secretlint and TypeScript
• ESLint: 0 errors, 11 existing warnings
• Vitest: 346 passed, 3 skipped
• coverage: 65.52% statements, 66.48% lines
• Next.js production build and 85-artifact browser credential scan
• pnpm audit: one existing unpatched low elliptic advisory
• local browser smoke: stake, unstake, portfolio, privacy, terms, and API protocol all returned 200 with zero console errors
• Codex, Kimi, and CodeRabbit review loop converged clean; Grok provider unavailable

Cloudflare dry-run is not applicable because this repository has no Cloudflare configuration. Vercel preview is Ready; production deployment awaits the required protected-branch approval and merge.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
liquidium-staking	Ready	Preview	Aug 26, 2026 1:47pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 09520140-a956-4f19-89d3-b9c9c0cea714

📥 Commits

Reviewing files that changed from the base of the PR and between 513033a and cd5c9b7.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (3)

• .github/workflows/ci.yml
• package.json
• pnpm-workspace.yaml

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

Walkthrough

The pull request updates the project to pnpm 11.24.0 in the package manifest and CI workflow. It upgrades application and development dependencies, including Next.js, React tooling, PostHog packages, Vite, Vitest, and Vercel. It adds pnpm dependency policies for release age, build scripts, and package overrides. It also excludes selected Next.js 16.3.3 packages from release-age enforcement and grants CI read-only repository content permissions.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main changes: dependency updates and pnpm tooling changes.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/weekly-plumbing-2026-08-26

Warning

These MCP integrations need to be re-authenticated in the Integrations settings: Linear

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cd5c9b7d77

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Configure the 24-hour quarantine duration

When a developer or dependency-update job resolves versions instead of replaying the frozen lockfile, minimumReleaseAgeStrict: true does not establish any quarantine by itself. The pnpm setting reference defines minimumReleaseAge—whose default is 0—as the number of minutes releases must age, so newly published packages remain immediately eligible and the exclusion list has no practical effect. Add minimumReleaseAge: 1440 to enforce the claimed 24-hour quarantine.

Useful? React with 👍 / 👎.