[bcw117]

Features and Changes

Installs were failing on current pnpm, and three different pnpm versions were in use (9.1.0 in the nixpacks deploy, 10.14.0 in CI, 12.x locally).
pnpm 11+ no longer reads the pnpm field in package.json or onlyBuiltDependencies, so pnpm install on pnpm 12 errored with ERR_PNPM_IGNORED_BUILDS for Prisma and Supabase.
This PR puts every environment on one pnpm version, migrates the config, and cleans up the dependency list.
No application behavior is meant to change.

pnpm version and config

• package.json now declares "packageManager": "pnpm@12.11.2" and the old pnpm field is removed.
• pnpm-workspace.yaml uses the new allowBuilds map: prisma, @prisma/engines and supabase are allowed to run install scripts.
  @prisma/client was dropped from the list because it has no install script in 7.x.
  unrs-resolver (pulled in by the ESLint import resolver) is set to false, since it ships prebuilt binaries and its script is only a fallback.

CI and deploy

• Both workflows use pnpm/action-setup@v6.1.0 with no version input, so the pnpm version comes from packageManager.
• actions/checkout and actions/setup-node are bumped from v4 to v7 (v4 runs on GitHub's deprecated Node 20 action runtime).
• nixpacks.toml no longer pins pnpm@9.1.0; corepack picks the version up from packageManager, and the install uses --frozen-lockfile.

Removed unused dependencies

None of these are imported or referenced anywhere in the repo:

• @fortawesome/* (4 packages), @radix-ui/react-slot, @radix-ui/themes
• @uiw/react-codemirror, @uiw/codemirror-theme-tokyo-night, @uiw/react-textarea-code-editor, @codemirror/lang-javascript
• pocketbase, postgres, react-hook-form, react-icons, react-json-editor-ajrm, react-resizable-panels, react-router-dom
• fs and path, which were npm placeholder packages for Node built-ins (src/app/lib/notion/projects.ts still gets the real Node modules).

Updated dependencies

• Everything else is updated to the newest release within its current major (for example Prisma 7.2 to 7.10, @supabase/supabase-js 2.47 to 2.117, TypeScript 5.7 to 5.9).
  Prisma 7.2 also printed an unsupported-Node warning on Node 26, which 7.10 resolves.
• next and eslint-config-next go to 14.2.35, the final 14.x patch, which fixes the middleware authorization bypass and several DoS advisories.
• @supabase/ssr goes from 0.5.2 to 0.12.7.
  0.5.2 no longer type-checked against the updated supabase-js (the setAll cookie callbacks became implicit any).
  The getAll/setAll API is unchanged across these releases.
• src/lib/utils/supabase/middleware.ts applies the cache headers that @supabase/ssr now passes to setAll, so CDNs do not cache responses that set auth cookies.

pnpm audit goes from 202 advisories (6 critical) to 35 (3 critical).

Screenshots / Screen Recordings

N/A - dependency and tooling change, no intended UI changes.

Testing your changes

• Fresh pnpm install --frozen-lockfile on pnpm 12.11.2 / Node 26 succeeds, with Prisma and Supabase install scripts running.
• pnpm build succeeds.
• pnpm lint: no errors, same 4 pre-existing react-hooks/exhaustive-deps warnings as main.
• tsc --noEmit: 96 errors on both main and this branch, and the sets match.
  These are pre-existing and hidden by ignoreBuildErrors: true; the only new errors (the Supabase cookie callbacks) were fixed by the @supabase/ssr bump.
• Production builds of main and this branch were run side by side, and 21 routes were requested on each (landing page, /auth, /contact-us, the /portal/* pages, API routes, static assets, 404s).
  Status codes, redirect targets and response bodies matched, apart from build IDs and chunk filenames.
  Neither server logged errors.
• A read-only Prisma 7.10 query (forms.count(), teams.count()) through the PrismaPg adapter returned results against the database.
• Not tested: signed-in portal flows (login, applications, admin pages), sending email through Mailgun, and the client-side interactive sections in a browser.
  The CI run on this PR is also the first check of the new action-setup / packageManager setup, and the nixpacks deploy path has not been run.

Steps on how to test your changes

1. Run pnpm install (pnpm 12 switches to 12.11.2 automatically from packageManager; older pnpm can use corepack enable).
2. Run pnpm dev, sign in, and click through the portal: onboarding, a form application, and the admin forms and members pages.
3. Check the landing page carousel and 3D team reveal, and submit the contact form.

Other Notes

• Next.js 14 is end-of-life.
  The 3 remaining critical advisories (including RCE in the image optimizer) are only fixed in Next 15.5.24+, so the Next 16 / React 19 upgrade will follow in a separate PR.
• Other remaining advisories: swiper 11 (prototype pollution, fixed in 12), and dev-only tooling (Prisma CLI, ESLint plugin).
• Several packages are still a major version behind and were left alone on purpose: ESLint 8, Tailwind 3, zod 3, recharts 2, @react-email/components 0.0.x.
• Prisma 7 requires Node 20.19+ at deploy time, which was already true before this PR.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
lp-website	Ignored		Oct 12, 2026 4:50am UTC

[netlify]

✅ Deploy Preview for ubclaunchpad ready!

Name	Link
🔨 Latest commit	dfbebac
🔍 Latest deploy log	https://app.netlify.com/projects/ubclaunchpad/deploys/6acc6706cd8e3600086abb1f
😎 Deploy Preview	https://deploy-preview-433--ubclaunchpad.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.