chore(deps): rolling dependency update

[socket-pr-bot]

Rolling dependency update

One long-lived PR, rebuilt from main on every run so it stays
mergeable. Each run appends its dependency delta below, newest first.

2026-09-20 — run · no dependency changes

No dependency ranges changed in this run.

commits

• chore(deps): apply weekly update fixes

2026-09-19 — run · no dependency changes

No dependency ranges changed in this run.

commits

• chore(deps): apply weekly update fixes

2026-09-18 — run · no dependency changes

No dependency ranges changed in this run.

commits

• chore(deps): apply weekly update fixes

---

Note

Low Risk
Toolchain and lockfile pin updates only; no extension runtime or security-sensitive application logic changes.

Overview
Bumps the pinned Node version from 26.8.1 to 26.8.2 in .node-version.

package.json devEngines.packageManager is no longer a single pnpm entry; it is now an array that enforces both npm (^11.19.0 || >=12.0.2) and pnpm (^11.25.0 || >=12.3.4), each with onFail: "error". The existing engines.npm / engines.pnpm ranges are unchanged.

pnpm-lock.yaml updates the bundled pnpm toolchain from 12.4.2 to 12.4.1 (including all @pnpm/exe.* platform packages).

^{Reviewed by Cursor Bugbot for commit 9caa7dc. Configure here.}