Guard benchmark tooling dependency installs

.github/workflows/ai-gateway-benchmarks.yml

@@ -151,9 +151,12 @@ jobs:
           # Full history so the rebase-on-push retry below has a merge base.
           fetch-depth: 0
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the

.github/workflows/ai-gateway-model-index.yml

@@ -73,10 +73,13 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@v4                                       # v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 24
+          node-version: '24'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the
       # workload token file it checks for when NSC_TOKEN is available;
@@ -100,7 +103,7 @@ jobs:
           fi
       - uses: namespacelabs/nscloud-setup@df198f982fcecfb8264bea3f1274b56a61b6dfdc # v0.0.12
       - name: Install dependencies
-        run: pnpm install --frozen-lockfile
+        run: pnpm install --frozen-lockfile --ignore-scripts
       - name: Build workspace packages
         run: pnpm -r --filter './packages/**' run build
       - name: Run AI gateway model index

.github/workflows/browser-benchmarks.yml

@@ -79,9 +79,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the
@@ -154,9 +157,12 @@ jobs:
           # fail when the remote has advanced past the shallow boundary.
           fetch-depth: 0
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the

.github/workflows/browser-concurrent-benchmarks.yml

@@ -144,9 +144,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the
@@ -232,9 +235,12 @@ jobs:
         with:
           fetch-depth: 0
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the

.github/workflows/browser-throughput-benchmarks.yml

@@ -131,9 +131,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the
@@ -208,9 +211,12 @@ jobs:
           # fail when the remote has advanced past the shallow boundary.
           fetch-depth: 0
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the

.github/workflows/ci.yml

@@ -21,14 +21,17 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@v4
 
+        with:
+          version: 11.28.5
+          run_install: false
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: '24'
           cache: 'pnpm'
 
       - name: Install dependencies
-        run: pnpm install --ignore-scripts
+        run: pnpm install --frozen-lockfile --ignore-scripts
 
       - name: Build packages
         # The root typecheck consumes the built dist output, so build all

.github/workflows/pricing-svg.yml

@@ -13,11 +13,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
-      - run: pnpm install --frozen-lockfile
+      - run: pnpm install --frozen-lockfile --ignore-scripts
       - run: pnpm run generate-pricing-svg
       - name: Commit and push
         run: |

.github/workflows/release.yml

@@ -27,6 +27,9 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@v4
 
+        with:
+          version: 11.28.5
+          run_install: false
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
@@ -38,7 +41,7 @@ jobs:
         # Pin to 11.x: npm 12.0.0 ships a broken bundle missing the `sigstore`
         # module in libnpmpublish, which breaks `publish --provenance` with
         # "Cannot find module 'sigstore'".
-        run: npm install -g npm@11
+        run: npm install --global --ignore-scripts npm@11.15.0
 
       - name: Install dependencies
         run: pnpm install --ignore-scripts

.github/workflows/sandbox-capabilities.yml

@@ -94,12 +94,15 @@ jobs:
         if: env.SHOULD_RUN == 'true'
         with:
           persist-credentials: false
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@v4                                       # v4
         if: env.SHOULD_RUN == 'true'
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         if: env.SHOULD_RUN == 'true'
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the
@@ -209,10 +212,13 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@v4                                       # v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the

.github/workflows/sandbox-dax-benchmarks.yml

@@ -113,9 +113,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the
@@ -212,9 +215,12 @@ jobs:
         with:
           fetch-depth: 0
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the

.github/workflows/sandbox-tti-benchmarks.yml

@@ -122,10 +122,13 @@ jobs:
         if: env.SHOULD_RUN == 'true'
       - uses: pnpm/action-setup@v4
         if: env.SHOULD_RUN == 'true'
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         if: env.SHOULD_RUN == 'true'
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the
@@ -208,9 +211,12 @@ jobs:
           # fail when the remote has advanced past the shallow boundary.
           fetch-depth: 0
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the

.github/workflows/snapshot-fork-benchmarks.yml

@@ -98,9 +98,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the
@@ -172,9 +175,12 @@ jobs:
           # fail when the remote has advanced past the shallow boundary.
           fetch-depth: 0
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the

.github/workflows/storage-benchmarks.yml

@@ -97,9 +97,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the
@@ -176,9 +179,12 @@ jobs:
           # fail when the remote has advanced past the shallow boundary.
           fetch-depth: 0
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the

.github/workflows/storage-concurrency-benchmarks.yml

@@ -54,9 +54,12 @@ jobs:
         with:
           persist-credentials: false
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       # ComputeSDK runners get no GitHub OIDC token, so nscloud-setup's
       # `nsc auth exchange-github-token` cannot work there. Pre-seed the
@@ -127,9 +130,12 @@ jobs:
         with:
           persist-credentials: false
       - uses: pnpm/action-setup@v4
+        with:
+          version: 11.28.5
+          run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: 24
+          node-version: '24'
           cache: 'pnpm'
       - name: Install dependencies
         run: pnpm install --frozen-lockfile --ignore-scripts

README.md

@@ -175,3 +175,12 @@ For full details on each suite, see:
 **Powered by ComputeSDK** — We use [ComputeSDK](https://github.com/computesdk/computesdk), a multi-provider SDK, to test all sandbox providers with the same code. One API, multiple providers, fair comparison.
 
 MIT License
+
+## Maintainer dependency policy
+
+Use pnpm 11.28.5 with Node.js 22+. CI source installs use frozen locks and
+disabled lifecycle hooks. Registry release timestamps are required and the
+release delay is enforced even for cached/frozen entries. Existing stronger
+delays are preserved. Run reviewed native setup explicitly and install local
+git hooks with `pnpm run setup:git-hooks` when that script is present. Public
+npm consumer commands and upstream compatibility fixtures remain supported.

package.json

@@ -109,7 +109,7 @@
     "bench:ai-gateway-openai:neon": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-openai.bench.ts --provider neon",
     "bench:ai-gateway-openai:ngrok": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-openai.bench.ts --provider ngrok",
     "bench:ai-gateway-openai:llmapi": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-openai.bench.ts --provider llmapi",
-    "generate-ai-gateway-openai-svg": "tsx benchmarks/ai-gateway/generate-svg.ts --dir ai-gateway-latency/openai --title \"AI Gateway Benchmarks — OpenAI\" --out ai-gateway-openai.svg",
+    "generate-ai-gateway-openai-svg": "tsx benchmarks/ai-gateway/generate-svg.ts --dir ai-gateway-latency/openai --title \"AI Gateway Benchmarks \u2014 OpenAI\" --out ai-gateway-openai.svg",
     "bench:ai-gateway-gemini": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-gemini.bench.ts",
     "bench:ai-gateway-gemini:openrouter": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-gemini.bench.ts --provider openrouter",
     "bench:ai-gateway-gemini:vercel": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-gemini.bench.ts --provider vercel-ai-gateway",
@@ -120,7 +120,7 @@
     "bench:ai-gateway-gemini:neon": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-gemini.bench.ts --provider neon",
     "bench:ai-gateway-gemini:ngrok": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-gemini.bench.ts --provider ngrok",
     "bench:ai-gateway-gemini:llmapi": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-gemini.bench.ts --provider llmapi",
-    "generate-ai-gateway-gemini-svg": "tsx benchmarks/ai-gateway/generate-svg.ts --dir ai-gateway-latency/gemini --title \"AI Gateway Benchmarks — Gemini\" --out ai-gateway-gemini.svg",
+    "generate-ai-gateway-gemini-svg": "tsx benchmarks/ai-gateway/generate-svg.ts --dir ai-gateway-latency/gemini --title \"AI Gateway Benchmarks \u2014 Gemini\" --out ai-gateway-gemini.svg",
     "bench:ai-gateway-kimi": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-kimi.bench.ts",
     "bench:ai-gateway-kimi:github-copilot": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-kimi.bench.ts --provider github-copilot",
     "bench:ai-gateway-kimi:openrouter": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-kimi.bench.ts --provider openrouter",
@@ -134,7 +134,7 @@
     "bench:ai-gateway-kimi:neon": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-kimi.bench.ts --provider neon",
     "bench:ai-gateway-kimi:ngrok": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-kimi.bench.ts --provider ngrok",
     "bench:ai-gateway-kimi:llmapi": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-kimi.bench.ts --provider llmapi",
-    "generate-ai-gateway-kimi-svg": "tsx benchmarks/ai-gateway/generate-svg.ts --dir ai-gateway-latency/kimi --title \"AI Gateway Benchmarks — Kimi\" --out ai-gateway-kimi.svg",
+    "generate-ai-gateway-kimi-svg": "tsx benchmarks/ai-gateway/generate-svg.ts --dir ai-gateway-latency/kimi --title \"AI Gateway Benchmarks \u2014 Kimi\" --out ai-gateway-kimi.svg",
     "bench:ai-gateway-model-index": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-model-index.bench.ts",
     "bench:ai-gateway-model-index:openrouter": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-model-index.bench.ts --provider openrouter",
     "bench:ai-gateway-model-index:vercel": "tsx packages/benchsdk-runner/dist/bin.js run benchmarks/ai-gateway/ai-gateway-model-index.bench.ts --provider vercel-ai-gateway",
@@ -230,5 +230,5 @@
     "tsx": "^4.23.15",
     "typescript": "^5.9.3"
   },
-  "packageManager": "pnpm@10.33.0"
+  "packageManager": "pnpm@11.28.5"
 }