chore: bump pnpm to 11.0.8

[atilafassina]

Summary

Upgrade pnpm from 10.21.0 to 11.0.8

• Move dependency overrides and build permissions to pnpm-workspace.yaml.
• Declare tooling, docs, and CLI dependencies previously exposed through transitive hoisting, including root ora and vite.
• Invoke the shared CLI directly for template sync and preserve the generic FormProvider declaration.
• Keep npm packages external in the shared declaration build, preventing CI failures from unintentionally inlined @types packages.
• Use explicit pnpm run clean in recursive and filtered cleanup scripts to avoid pnpm 11's built-in clean command.
• Let Vite follow pnpm symlinks in the playground so transitive UI dependencies resolve.

Surfaced (and fixed) bugs from the change

react-docgen-typescript

• Moved from docs/devDependencies to root devDependencies. The import
  lives in tools/generate-component-mdx.ts:5. Node resolves
  dependencies relative to that file, even though the docs package
  launches it. Previously, hoisting made the dependency accessible; the
  pnpm 11 setup exposed the incorrect placement.

• Added a Knip exception. Our Knip configuration excludes tools/** and
  the docs workspace, so it cannot see the usage and would report the
  root dependency as unused. The exception prevents that false
  positive.

• Updated the lockfile. The library stays at 2.4.0, but now uses root
  TypeScript 5.9.3 as its peer dependency instead of the docs
  workspace’s 5.6.3.

hardening `external` packages definition

With pnpm 11’s installation layout, previous handling ([/^@databricks\//]) let Express,
WebSocket, and JSON Schema type definitions get copied into the shared
package’s generated declarations. tsdown flagged this unintended
bundling, which failed CI.

type changes on FormProvider

Our pnpm 10 setup used .npmrc settings to hoist dependencies—make them
accessible through a shared top-level node_modules. pnpm 11 no longer
reads those hoisting settings from .npmrc.

With the new layout, TypeScript inferred Form’s type through a nested
copy of React’s types. It couldn’t express that inferred type in a
portable published declaration, so it raised TS2742.

The old installation layout had hidden that fragility. Adding typeof
FormProvider gives TypeScript a stable public reference, making
declaration generation independent of that layout.

Validation

Verified from a clean archive with Node 24.13.1 and pnpm 11.0.8:

• CI=1 pnpm install --offline --frozen-lockfile with lifecycle scripts enabled
• CI=1 pnpm build and CI=1 pnpm docs:build
• CI=1 pnpm test: 5,174 passed, 1 skipped
• Playground integration suite from a cold Vite cache: all 29 tests passed
• CI=1 pnpm check:fix, CI=1 pnpm -r typecheck, and CI=1 pnpm knip
• License compliance, template dependency pins, and template registry checks
• CI=1 pnpm -r tarball and published-manifest/file inspection for AppKit, AppKit UI, and Lakebase
• Recursive and filtered cleanup smoke checks in an isolated fixture
• Fresh installation of the three local tarballs with pnpm install --ignore-scripts: both packaged CLIs start, CLI semver resolves, and the AppKit, AppKit UI JS, and Lakebase entrypoints import successfully

Build, docs, and formatting produced no tracked-file drift. Reran investigations of CI/configuration compatibility, dependency and package boundaries, and script/test coverage; the confirmed issues above are fixed.

[github-actions]

📦 Bundle size report

Compared against bundle-size-baseline.json (main).

@databricks/appkit

npm tarball (packed): 1.2 MB (+1 B) — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	1.2 MB	425 KB
Type declarations	443 KB	161 KB
Source maps	2.3 MB	797 KB
Other	11 KB	3.7 KB
Total	4.0 MB	1.4 MB

Per-entry composition (own code — deps external (as shipped))

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
.	96 KB	2.5 KB	98 KB	external	314 KB
./beta	93 KB	456 B	93 KB	external	280 KB
./testing	38 KB	30 KB	69 KB	external	200 KB
./tsdown	520 B	0 B	520 B	external	813 B
./type-generator	23 KB	0 B	23 KB	external	65 KB

Chunks:

Entry	Chunk	Load	Size (gz)
.	index.js	initial	92 KB
.	utils.js	initial	4.0 KB
.	remote-tunnel-manager.js	lazy	2.5 KB
./beta	beta.js	initial	77 KB
./beta	stream-manager.js	initial	5.8 KB
./beta	wide-event-emitter.js	initial	3.2 KB
./beta	databricks.js	initial	3.2 KB
./beta	configuration.js	initial	2.3 KB
./beta	service-context.js	initial	1.3 KB
./beta	client.js	initial	434 B
./beta	client-options.js	initial	220 B
./beta	supervisor-api.js	lazy	192 B
./beta	databricks.js	lazy	142 B
./beta	index.js	lazy	122 B
./testing	manifest.js	initial	26 KB
./testing	index.js	initial	9.9 KB
./testing	wide-event-emitter.js	initial	2.9 KB
./testing	index.js	lazy	26 KB
./testing	remote-tunnel-manager.js	lazy	2.5 KB
./testing	utils.js	lazy	1.2 KB
./tsdown	index.js	initial	520 B
./type-generator	index.js	initial	23 KB

@databricks/appkit-ui

npm tarball (packed): 350 KB (-54 B) — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	395 KB	132 KB
Type declarations	229 KB (-148 B)	84 KB (-33 B)
Source maps	766 KB (-82 B)	253 KB (-10 B)
CSS	16 KB	3.2 KB
Total	1.4 MB (-230 B)	472 KB (-43 B)

Per-entry composition (consumer bundle — deps bundled, peerDeps external)

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
./js	5.3 KB	49 KB	55 KB	208 KB	14 KB
./js/beta	20 B	0 B	20 B	0 B	0 B
./react	432 KB	49 KB	481 KB	1.3 MB	177 KB
./react/beta	1.0 KB	0 B	1.0 KB	0 B	1.9 KB

Chunks:

Entry	Chunk	Load	Size (gz)
./js	index.js	initial	5.2 KB
./js	chunk	initial	120 B
./js	apache-arrow	lazy	49 KB
./js/beta	beta.js	initial	20 B
./react	index.js	initial	430 KB
./react	tslib	initial	2.1 KB
./react	apache-arrow	lazy	49 KB
./react/beta	beta.js	initial	1.0 KB

[github-actions]

🤖 AppKit PR bot

🔬 Run evals

Start an eval for this PR from the evals-monitor app: Go to Evals Monitor →

📦 Try this PR's app template

Scaffolds a new app from this PR's SDK build. Run it in any folder (requires the GitHub CLI — gh auth login — and the Databricks CLI):

gh run download 35854332302 -R databricks/appkit -n appkit-template-0.76.1-pr.7b1320d-bump-pnpm-591 -D appkit-pr-591 \
  && unzip -o "appkit-pr-591/appkit-template-0.76.1-pr.7b1320d-bump-pnpm-591.zip" -d "appkit-pr-591" \
  && databricks apps init --template "appkit-pr-591"

The template pins @databricks/appkit and @databricks/appkit-ui to tarballs built from this branch, so the scaffolded app runs against this PR's code.

[Copilot]

Copilot review overview

🔵 Needs a closer look

A pnpm major-version bump plus a large lockfile/config surface area can have broad build/install impact that warrants final human verification.

Review effort: Lite
Findings: None

What changed in this PR

Upgrades the repository toolchain to pnpm 11.0.8, restructuring workspace-level configuration and dependency declarations to match pnpm 11’s install layout and build-script security model.

Changes:

• Moved dependency overrides and build-script allow/deny policy into pnpm-workspace.yaml.
• Made previously hoisted/transitively available tooling deps explicit (e.g., vite, ora, react-docgen-typescript, esbuild, lunr, sonner, semver).
• Adjusted build/config details for pnpm 11 compatibility (shared tsdown externals, template sync invocation, recursive clean semantics, Vite symlink resolution, FormProvider typing).

File	Description
pnpm-workspace.yaml	Adds workspace-level overrides and allowBuilds configuration aligned with pnpm 11.
pnpm-lock.yaml	Updates lockfile to reflect pnpm 11 resolution/peer changes and new explicit deps.
packages/​shared/​tsdown.config.ts	Hardens external handling to keep npm deps external during JS + d.ts generation.
packages/​shared/​package.json	Adds explicit semver (+ types) dependency needed at runtime.
packages/​lakebase/​package.json	Bumps packageManager to pnpm 11.0.8.
packages/​appkit/​package.json	Bumps packageManager to pnpm 11.0.8.
packages/​appkit-ui/​src/​react/​ui/​form.tsx	Stabilizes Form typing via typeof FormProvider to avoid non-portable inferred types.
packages/​appkit-ui/​package.json	Bumps packageManager to pnpm 11.0.8.
package.json	Bumps root packageManager, adjusts scripts (sync:template, recursive clean), and declares previously hoisted tooling deps.
knip.json	Ignores react-docgen-typescript to prevent false-positive unused dep reports.
docs/​package.json	Moves/declares docs runtime deps (lunr, sonner) and removes react-docgen-typescript from docs workspace.
apps/​dev-playground/​client/​vite.config.ts	Removes preserveSymlinks to let Vite follow pnpm symlinks for dependency resolution.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[MarioCadenas]

we can probably remove the .npmrc file too no?

[atilafassina]

we can probably remove the .npmrc file too no?

good catch.
.npmrc is only useful to pnpm 11 when for auth