chore(ui): upgrade pnpm to 11 and harden supply-chain defaults

.config/wt.toml

@@ -11,7 +11,14 @@ envs = "wt step copy-ignored"
 [[pre-start]]
 deps = "uv sync"
 
-# Block 3: reminder - last visible output before `wt switch` returns.
+# Block 3: prepare pnpm via corepack.
+[[pre-start]]
+corepack-enable = "corepack enable"
+
+[[pre-start]]
+corepack-install = "cd ui && corepack install"
+
+# Block 4: reminder - last visible output before `wt switch` returns.
 # Hooks can't mutate the parent shell, so venv activation is manual.
 [[pre-start]]
 reminder = "echo '>> Reminder: activate the venv in this shell with: source .venv/bin/activate'"

.github/workflows/ui-e2e-tests-v2.yml

@@ -172,7 +172,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: '24.13.0'
+          node-version-file: 'ui/.nvmrc'
 
       - name: Setup pnpm
         uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0

.github/workflows/ui-tests.yml

@@ -16,7 +16,6 @@ concurrency:
 
 env:
   UI_WORKING_DIR: ./ui
-  NODE_VERSION: "24.13.0"
 
 permissions: {}
 
@@ -93,11 +92,11 @@ jobs:
             ui/vitest.config.ts
             ui/vitest.setup.ts
 
-      - name: Setup Node.js ${{ env.NODE_VERSION }}
+      - name: Setup Node.js
         if: steps.check-changes.outputs.any_changed == 'true'
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: ${{ env.NODE_VERSION }}
+          node-version-file: 'ui/.nvmrc'
 
       - name: Setup pnpm
         if: steps.check-changes.outputs.any_changed == 'true'

ui/AGENTS.md

@@ -225,9 +225,9 @@ pnpm run test:e2e:ui
 
 ## QA CHECKLIST BEFORE COMMIT
 
-- [ ] `npm run typecheck` passes
-- [ ] `npm run lint:fix` passes
-- [ ] `npm run format:write` passes
+- [ ] `pnpm run typecheck` passes
+- [ ] `pnpm run lint:fix` passes
+- [ ] `pnpm run format:write` passes
 - [ ] Relevant E2E tests pass
 - [ ] All UI states handled (loading, error, empty)
 - [ ] No secrets in code (use `.env.local`)

ui/CHANGELOG.md

@@ -7,11 +7,17 @@ All notable changes to the **Prowler UI** are documented in this file.
 ### 🔄 Changed
 
 - Dark mode: pure-black canvas, pure-white primary text, and brighter border / input tokens for clearer separation between cards, tables, and inputs [(#11073)](https://github.com/prowler-cloud/prowler/pull/11073)
+- CI workflows (`ui-tests.yml`, `ui-e2e-tests-v2.yml`) now read the Node version from `ui/.nvmrc` and the pnpm version from `package.json#packageManager` instead of hardcoded values [(#11225)](https://github.com/prowler-cloud/prowler/pull/11225)
 
 ### 🐞 Fixed
 
 - Compliance page now loads the most recent scan when opened from the sidebar instead of showing the "no compliance data available" alert [(#11374)](https://github.com/prowler-cloud/prowler/pull/11374)
 
+### 🔐 Security
+
+- `pnpm` upgraded to 11 with supply-chain defaults consolidated in `pnpm-workspace.yaml` and `trustPolicyExclude` entries pinned to exact versions [(#11225)](https://github.com/prowler-cloud/prowler/pull/11225)
+- `uuid` pinned to `11.1.1` via `pnpm-workspace.yaml#overrides` to clear `GHSA-w5hq-g745-h8pq` (missing bounds check in `v3`/`v5`/`v6` name-based generators with `buf`) in the transitive tree [(#11225)](https://github.com/prowler-cloud/prowler/pull/11225)
+
 ---
 
 ## [1.28.1] (Prowler v5.28.1)

ui/Dockerfile

@@ -1,3 +1,4 @@
+# Keep in sync with ui/.nvmrc.
 FROM node:24.13.0-alpine@sha256:cd6fb7efa6490f039f3471a189214d5f548c11df1ff9e5b181aa49e22c14383e AS base
 
 LABEL maintainer="https://github.com/prowler-cloud"
@@ -13,7 +14,7 @@ RUN apk add --no-cache libc6-compat
 WORKDIR /app
 
 # Install dependencies based on the preferred package manager
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY scripts ./scripts
 RUN corepack install && pnpm install --frozen-lockfile
 

ui/package.json

@@ -161,27 +161,10 @@
     "vitest": "4.0.18",
     "vitest-browser-react": "2.0.4"
   },
-  "packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319",
-  "pnpm": {
-    "overrides": {
-      "@hono/node-server": "1.19.14",
-      "@internationalized/date": "3.10.0",
-      "@isaacs/brace-expansion": "5.0.1",
-      "@react-aria/interactions>react": "19.2.6",
-      "@react-aria/ssr>react": "19.2.6",
-      "@react-aria/ssr>react-dom": "19.2.6",
-      "@react-aria/visually-hidden>react": "19.2.6",
-      "fast-xml-parser": "5.8.0",
-      "hono": "4.12.18",
-      "lodash": "4.18.1",
-      "lodash-es": "4.18.1",
-      "minimatch@>=9 <10": "9.0.7",
-      "minimatch@>=10": "10.2.3",
-      "minimatch@<4": "3.1.4",
-      "qs": "6.14.2",
-      "rollup@>=4": "4.59.0",
-      "serialize-javascript": "7.0.5"
-    }
+  "packageManager": "pnpm@11.1.3+sha512.c85357fe17ca12dd23dd7071822666dfd7e3cb76fe214e3370b5ea2fb34f2a231185509b63e717f3cd0acb38dd3f8d82bcd5e8172400ae678b70ea4fbed0896d",
+  "engines": {
+    "node": ">=22.13",
+    "pnpm": ">=11.1.3"
   },
   "msw": {
     "workerDirectory": [