chore(deps): pnpm security bump 11.8.0 → 11.11.0

[apify-deps]

Summary

Dependency sweep — security bump + in-range freshening (all within existing ranges):

• pnpm (self-managed via devEngines.packageManager / packageManagerDependencies) 11.8.0 → 11.11.0 (high — alert #276, alert #277, alert #278)
• broad in-range lockfile refresh (pnpm update -r) — patch/minor bumps across the workspace and website/ (e.g. @docusaurus/* 3.10.0→3.10.2, react/react-dom 19.2.5→19.2.8, vitest 4.1.10→4.1.11, tsdown, oxlint-adjacent tooling, and various transitive patch bumps). No declared range was changed beyond the normal caret bump that comes with an in-range patch release.

package.json's top-level packageManager field was already pnpm@11.11.0, but devEngines.packageManager.version was still 11.8.0 — pnpm uses the latter to resolve its own packageManagerDependencies pin in the lockfile, so the vulnerable 11.8.0 stayed locked despite the top-level field being current. Aligned both to 11.11.0, which regenerates the pin. pnpm-workspace.yaml already carries a minimumReleaseAgeExclude entry for pnpm@11.11.0 (added by Renovate), so the supply-chain policy check passes.

🧹 Pruned overrides (no longer needed)

• tar (pinned to 7.5.16) — no longer present anywhere in the dependency tree (pnpm why tar -r is empty); the pin was a no-op. Removing it produced no version changes elsewhere.

🤖 Generated with Claude Code

[l2ysho]

Closing as superseded by #1412.

This branch is based on pre-Node-22 master (engines.node: >=20) and is 11 commits behind. Merging it would revert the majors that just landed: @apify/consts 3.0.0 → ^2.58.1 (#1391), @inquirer/core 12 → ^11.2.1 (#1343), and @apify/actor-memory-expression 1.0.0 → ^0.2.16 (#1390).

The security-relevant part — devEngines.packageManager 11.8.0 → 11.11.0 plus the lockfile refresh — is in #1412, based on current master. That clears the three high-severity pnpm advisories. The remaining patch/minor bumps here are already covered by the Renovate queue.