pinning dependencies; renovate will bump

Author: clavery

packages/b2c-cli/package.json

@@ -12,20 +12,20 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@inquirer/prompts": "^8.2.0",
-    "@oclif/core": "^4",
-    "@oclif/plugin-autocomplete": "^3",
-    "@oclif/plugin-help": "^6",
-    "@oclif/plugin-not-found": "^3",
-    "@oclif/plugin-plugins": "^5",
-    "@oclif/plugin-version": "^2",
-    "@oclif/plugin-warn-if-update-available": "^3",
+    "@inquirer/prompts": "8.2.0",
+    "@oclif/core": "4.8.0",
+    "@oclif/plugin-autocomplete": "3.2.39",
+    "@oclif/plugin-help": "6.2.35",
+    "@oclif/plugin-not-found": "3.2.72",
+    "@oclif/plugin-plugins": "5.4.53",
+    "@oclif/plugin-version": "2.2.36",
+    "@oclif/plugin-warn-if-update-available": "3.1.52",
     "@salesforce/b2c-tooling-sdk": "workspace:*",
-    "cliui": "^9.0.1",
-    "glob": "^13.0.0",
-    "marked": "^15.0.0",
-    "marked-terminal": "^7.3.0",
-    "open": "^11.0.0"
+    "cliui": "9.0.1",
+    "glob": "13.0.0",
+    "marked": "15.0.12",
+    "marked-terminal": "7.3.0",
+    "open": "11.0.0"
   },
   "devDependencies": {
     "@eslint/compat": "^1",

packages/b2c-dx-mcp/package.json

@@ -91,10 +91,10 @@
     "postpack": "shx rm -f oclif.manifest.json"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.18.0",
-    "@oclif/core": "^4",
+    "@modelcontextprotocol/sdk": "1.26.0",
+    "@oclif/core": "4.8.0",
     "@salesforce/b2c-tooling-sdk": "workspace:*",
-    "zod": "^3.25.76"
+    "zod": "3.25.76"
   },
   "devDependencies": {
     "@eslint/compat": "^1",

packages/b2c-tooling-sdk/package.json

@@ -348,21 +348,21 @@
     "node": ">=22.16.0"
   },
   "dependencies": {
-    "@salesforce/telemetry": "^6.1.0",
-    "archiver": "^7.0.1",
-    "chokidar": "^5.0.0",
-    "cliui": "^9.0.1",
-    "ejs": "^3.1.10",
-    "fuse.js": "^7.0.0",
-    "glob": "^13.0.0",
+    "@salesforce/telemetry": "6.4.6",
+    "archiver": "7.0.1",
+    "chokidar": "5.0.0",
+    "cliui": "9.0.1",
+    "ejs": "3.1.10",
+    "fuse.js": "7.1.0",
+    "glob": "13.0.0",
     "i18next": "25.7.4",
-    "jszip": "^3.10.1",
-    "minimatch": "^10.1.1",
-    "open": "^11.0.0",
-    "openapi-fetch": "^0.15.0",
-    "pino": "^10.1.0",
-    "pino-pretty": "^13.1.2",
-    "undici": "^7.0.0",
-    "xml2js": "^0.6.2"
+    "jszip": "3.10.1",
+    "minimatch": "10.1.1",
+    "open": "11.0.0",
+    "openapi-fetch": "0.15.0",
+    "pino": "10.1.0",
+    "pino-pretty": "13.1.2",
+    "undici": "7.19.2",
+    "xml2js": "0.6.2"
   }
 }

pnpm-lock.yaml

@@ -7,14 +7,15 @@ minimumReleaseAgeExclude: []
 
 nodeLinker: hoisted
 
+# Pin exact versions by default when adding dependencies (no ^ or ~ prefix)
+savePrefix: ''
+
 onlyBuiltDependencies:
   - unrs-resolver
   - yarn
 
 overrides:
   '@isaacs/brace-expansion@<=5.0.0': '>=5.0.1'
-  '@modelcontextprotocol/sdk@<1.25.2': '>=1.25.2'
-  '@modelcontextprotocol/sdk@>=1.10.0 <=1.25.3': '>=1.26.0'
   diff@>=4.0.0 <4.0.4: '>=4.0.4'
   diff@>=5.0.0 <5.2.2: '>=5.2.2'
   esbuild@<=0.24.2: '>=0.25.0'

pnpm-workspace.yaml

@@ -35,6 +35,18 @@
       "description": "Group testing tools",
       "matchPackagePatterns": ["mocha", "chai", "sinon", "c8", "msw"],
       "groupName": "testing"
+    },
+    {
+      "description": "Pin production dependencies in standalone apps (CLI, MCP)",
+      "matchFileNames": ["packages/b2c-cli/package.json", "packages/b2c-dx-mcp/package.json"],
+      "matchDepTypes": ["dependencies"],
+      "rangeStrategy": "pin"
+    },
+    {
+      "description": "Pin production dependencies in SDK (library)",
+      "matchFileNames": ["packages/b2c-tooling-sdk/package.json"],
+      "matchDepTypes": ["dependencies"],
+      "rangeStrategy": "pin"
     }
   ],
   "ignoreDeps": [],