fix: bump non-breaking dependencies to latest

[aversini]

Automated non-major dependency bump (deps-train).

package.json

• pnpm 11.24.0 → 11.25.0

packages/static-server/package.json

• open 11.0.1 → 11.0.2

Transitive refresh (pnpm update) — 1 package(s) moved

Show transitive changes

• fast-copy 4.0.4 → 4.1.0

---

What changed

pnpm 11.24.0 → 11.25.0

pnpm 11.25

Minor Changes

• Added an opt-in proof of concept that lets installs reuse a dependency's build output across machines, by publishing and restoring signed, organization-scoped artifacts through pnpr instead of running the lifecycle scripts locally.

  Configure it with the new remoteSideEffectsCache setting. A workspace names the eligible organization and packages; everything describing the act of signing — publish, keyId, builderId, trustedKeys, privateKey and the provenance fields — is refused in pnpm-workspace.yaml and read from the global config file or the environment instead.

• Added macOS and Windows x64 and arm64 support to remote shared build artifacts pnpm/pnpm#13771.

• Added the audit.ignorePrune setting. When set to true, pnpm audit --fix removes ignored GHSA entries that no longer appear in the audit report.

• Generalized the experimental shared-artifact protocol so candidates and signed payloads identify a discriminated subject. Dependency side effects use package and source-integrity subjects, while workspace tasks use project and task subjects.

  This changes shared-artifact request bodies and signed payloads. A pnpr server and its clients have to be on matching versions.

• pnpm init now pins the latest pnpm version, instead of the version of pnpm that ran the command. A project scaffolded by an outdated pnpm therefore no longer inherits that staleness through its own

…notes truncated.

compare 11.24.0…11.25.0 · npm

open 11.0.1 → 11.0.2

v11.0.2

• Update dependencies 6f006ad

---

sindresorhus/open@v11.0.1...v11.0.2

compare 11.0.1…11.0.2 · npm