chore(deps): pnpm security bump 11.8.0 → 11.11.0

[apify-deps]

Summary

Dependency sweep — security bump + in-range freshening (all within existing ranges):

• pnpm (self-managed via devEngines.packageManager / packageManagerDependencies) 11.8.0 → 11.11.0 (high — alert #276, alert #277, alert #278)
• broad in-range lockfile refresh (pnpm update -r) — patch/minor bumps across the workspace and website/ (e.g. @docusaurus/* 3.10.0→3.10.2, react/react-dom 19.2.5→19.2.8, vitest 4.1.10→4.1.11, tsdown, oxlint-adjacent tooling, and various transitive patch bumps). No declared range was changed beyond the normal caret bump that comes with an in-range patch release.

package.json's top-level packageManager field was already pnpm@11.11.0, but devEngines.packageManager.version was still 11.8.0 — pnpm uses the latter to resolve its own packageManagerDependencies pin in the lockfile, so the vulnerable 11.8.0 stayed locked despite the top-level field being current. Aligned both to 11.11.0, which regenerates the pin. pnpm-workspace.yaml already carries a minimumReleaseAgeExclude entry for pnpm@11.11.0 (added by Renovate), so the supply-chain policy check passes.

🧹 Pruned overrides (no longer needed)

• tar (pinned to 7.5.16) — no longer present anywhere in the dependency tree (pnpm why tar -r is empty); the pin was a no-op. Removing it produced no version changes elsewhere.

🤖 Generated with Claude Code