* chore: require pnpm release age policy
- Add pnpm minimum release age 2880 and deny dependency build scripts.
- Require Node 24 and pnpm 11 across engines, CI, and version files.
- Refresh docs and lockfile for the runtime upgrade.
* ci: install pnpm after node setup
- Put Node 24 on PATH before pnpm/action-setup installs pnpm 11.
- Keep setup-node cache restore after pnpm is installed.
* ci: run javascript actions on node 24
- Opt CI and release workflows into GitHub JavaScript action execution on Node 24.
- Unblock pnpm/action-setup from installing pnpm 11.
* ci: avoid engine strict pnpm setup
- Remove the root engine-strict npm config.
- Drop the temporary Node 24 JavaScript action runtime override.
* test: use valid ca pem fixture
- Replace the fake CA text used in NODE_EXTRA_CA_CERTS tests with a valid PEM.
- Avoid Windows Node 24 aborting before the capture script runs.
* Rewrite Origin/Referer headers in proxy for portless-managed hostnames
- Frameworks like Next.js 16.2+ block cross-origin requests to dev endpoints (e.g. /_next/webpack-hmr) when the Origin header doesn't match their allowlist. Next.js auto-allows *.localhost, but * only matches a single subdomain level, so multi-level names like admin.cmd.localhost are blocked.
- The proxy now rewrites Origin and Referer headers to http://localhost:{port} when the hostname belongs to the portless TLD. The original host is preserved in X-Forwarded-Host.
- This is framework-agnostic and works for both HTTP requests and WebSocket upgrades (HMR), so any framework with dev-origin checks benefits automatically.
* increase timeout
Chris Tate