From 76344935fa6164b7db71f0d69c54c63475d8f01e Mon Sep 17 00:00:00 2001
From: lforst <8118419+lforst@users.noreply.github.com>
Date: Tue, 28 Jul 2026 13:54:59 +0000
Subject: [PATCH 1/4] ci: Use streamlined release actions

---
 .github/workflows/publish-stable-release.yaml | 217 +++++++++++++++---
 .tool-versions                                |   2 +-
 e2e/Dockerfile.canary                         |   2 +-
 e2e/Dockerfile.e2e-bump                       |   2 +-
 e2e/helpers/scenario-installer.ts             |  18 +-
 .../docker-sandbox.mjs                        |   2 +-
 .../ai-sdk-instrumentation/package.json       |   8 -
 .../pnpm-workspace.yaml                       |   5 +
 e2e/scenarios/ai-sdk-otel-export/package.json |   8 -
 .../ai-sdk-otel-export/pnpm-workspace.yaml    |   5 +
 .../package.json                              |   5 -
 .../pnpm-workspace.yaml                       |   2 +
 .../cohere-instrumentation/package.json       |   6 -
 .../cohere-instrumentation/pnpm-lock.yaml     |  10 +-
 .../pnpm-workspace.yaml                       |   3 +
 .../cursor-sdk-instrumentation/package.json   |   9 -
 .../cursor-sdk-instrumentation/pnpm-lock.yaml |   4 +-
 .../pnpm-workspace.yaml                       |   5 +
 .../flue-instrumentation/package.json         |   7 -
 .../flue-instrumentation/pnpm-workspace.yaml  |   4 +
 .../versions/v1/package.json                  |   7 -
 .../versions/v1/pnpm-workspace.yaml           |   4 +
 .../genkit-instrumentation/package.json       |  12 -
 .../pnpm-workspace.yaml                       |   9 +
 .../package.json                              |   5 -
 .../pnpm-lock.yaml                            |   4 +-
 .../pnpm-workspace.yaml                       |   2 +
 .../google-adk-instrumentation/package.json   |  17 --
 .../pnpm-workspace.yaml                       |  14 ++
 .../google-genai-instrumentation/package.json |   6 -
 .../pnpm-lock.yaml                            |  10 +-
 .../pnpm-workspace.yaml                       |   3 +
 .../package.json                              |   6 -
 .../pnpm-lock.yaml                            |  18 +-
 .../pnpm-workspace.yaml                       |   3 +
 .../mastra-instrumentation/package.json       |  10 -
 .../pnpm-workspace.yaml                       |   7 +
 .../mistral-instrumentation/package.json      |   5 -
 .../pnpm-workspace.yaml                       |   2 +
 .../versions/next-14/package.json             |   5 -
 .../versions/next-14/pnpm-workspace.yaml      |   2 +
 .../versions/next-16/package.json             |   5 -
 .../versions/next-16/pnpm-workspace.yaml      |   4 +
 .../nextjs-instrumentation/package.json       |   6 -
 .../pnpm-workspace.yaml                       |   3 +
 .../package.json                              |   9 -
 .../pnpm-workspace.yaml                       |   6 +
 .../package.json                              |   6 -
 .../pnpm-workspace.yaml                       |   3 +
 .../wrap-langchain-js-traces/package.json     |   6 -
 .../wrap-langchain-js-traces/pnpm-lock.yaml   |  12 +-
 .../pnpm-workspace.yaml                       |   3 +
 integrations/otel-js/otel-v1/package.json     |  21 --
 .../otel-js/otel-v1/pnpm-workspace.yaml       |  18 ++
 integrations/otel-js/otel-v2/package.json     |  21 --
 .../otel-js/otel-v2/pnpm-workspace.yaml       |  18 ++
 package.json                                  |  37 +--
 pnpm-workspace.yaml                           |  31 ++-
 scripts/release/_shared.mjs                   |  93 +++++++-
 scripts/release/comment-release-issues.mjs    |  35 ++-
 scripts/release/create-github-releases.mjs    |  96 --------
 scripts/release/pack-publishable-packages.mjs | 126 +++++++---
 scripts/release/publish-release-manifest.mjs  |  64 +-----
 scripts/release/release-manifest.mjs          | 124 ++++++++--
 64 files changed, 706 insertions(+), 516 deletions(-)
 create mode 100644 e2e/scenarios/ai-sdk-instrumentation/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/ai-sdk-otel-export/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/claude-agent-sdk-instrumentation/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/cohere-instrumentation/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/cursor-sdk-instrumentation/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/flue-instrumentation/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/flue-instrumentation/versions/v1/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/genkit-instrumentation/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/github-copilot-instrumentation/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/google-adk-instrumentation/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/google-genai-instrumentation/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/langgraph-auto-instrumentation/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/mastra-instrumentation/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/mistral-instrumentation/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/nextjs-instrumentation/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/openai-agents-instrumentation/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/strands-agent-sdk-instrumentation/pnpm-workspace.yaml
 create mode 100644 e2e/scenarios/wrap-langchain-js-traces/pnpm-workspace.yaml
 create mode 100644 integrations/otel-js/otel-v1/pnpm-workspace.yaml
 create mode 100644 integrations/otel-js/otel-v2/pnpm-workspace.yaml
 delete mode 100644 scripts/release/create-github-releases.mjs

diff --git a/.github/workflows/publish-stable-release.yaml b/.github/workflows/publish-stable-release.yaml
index 3745e2f1b..22d742086 100644
--- a/.github/workflows/publish-stable-release.yaml
+++ b/.github/workflows/publish-stable-release.yaml
@@ -16,6 +16,8 @@ env:
   HUSKY: "0"
   NPM_CONFIG_PROVENANCE: "true"
 
+# sdk-actions PR #64 merge commit. Keep release action references immutable.
+
 jobs:
   validate-release-sha:
     runs-on: ubuntu-latest
@@ -69,18 +71,24 @@ jobs:
             echo "Diff to latest release: $diff_url"
           } | tee -a "$GITHUB_STEP_SUMMARY"
 
-  publish-stable:
+  build-package-artifacts:
     needs:
       - validate-release-sha
       - print-changelog-links
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
-      contents: write
-      issues: write
+      contents: read
       id-token: write
-      pull-requests: read
-    environment: npm-publish
+      attestations: write
+    outputs:
+      has_work: ${{ steps.detect.outputs.has_work }}
+      manifest_json: ${{ steps.detect.outputs.manifest_json }}
+      release_sha: ${{ needs.validate-release-sha.outputs.release_sha }}
+      branch: ${{ steps.release-context.outputs.branch }}
+      on_release_branch: ${{ steps.release-context.outputs.on_release_branch }}
+      # Displayed in the approval summary so reviewers can identify the selected SHA.
+      commit_message: ${{ steps.release-context.outputs.commit_message }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -97,6 +105,27 @@ jobs:
             echo "Checked out $checked_out_sha, expected $RELEASE_SHA." >&2
             exit 1
           fi
+      - name: Read release context
+        id: release-context
+        run: |
+          set -euo pipefail
+
+          containing_branches="$(
+            git branch -r --contains HEAD --format='%(refname:short)' |
+              sed '/^origin\/HEAD$/d; s|^origin/||'
+          )"
+          branch="${containing_branches%%$'\n'*}"
+          branch="${branch:-unknown}"
+          on_release_branch=false
+          case "$branch" in
+            main | prepare-release/*) on_release_branch=true ;;
+          esac
+
+          {
+            echo "branch=$branch"
+            echo "on_release_branch=$on_release_branch"
+            echo "commit_message=$(git log -1 --format='%s' HEAD)"
+          } >> "$GITHUB_OUTPUT"
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -111,25 +140,121 @@ jobs:
         id: detect
         run: node scripts/release/release-manifest.mjs --mode stable --output .release-manifest.json
       - name: Build packages
-        if: steps.detect.outputs.needs_publish == 'true'
+        if: steps.detect.outputs.needs_artifacts == 'true'
         run: pnpm run build
-      - name: Publish stable packages to npm
-        if: steps.detect.outputs.needs_publish == 'true'
-        env:
-          NODE_AUTH_TOKEN: ""
-          NPM_TOKEN: ""
-        run: node scripts/release/publish-release-manifest.mjs --manifest .release-manifest.json
+      - name: Pack packages and generate SBOMs
+        if: steps.detect.outputs.needs_artifacts == 'true'
+        run: node scripts/release/pack-publishable-packages.mjs --manifest .release-manifest.json --output-dir artifacts/release-packages --report artifacts/release-packages/pack-report.json
+      - name: Stage release manifest
+        if: steps.detect.outputs.needs_artifacts == 'true'
+        run: cp .release-manifest.json artifacts/release-packages/release-manifest.json
+      - name: Attest tarball build provenance
+        if: steps.detect.outputs.needs_artifacts == 'true'
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-path: artifacts/release-packages/*.tgz
+      - name: Upload release package artifacts
+        if: steps.detect.outputs.needs_artifacts == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: stable-release-packages
+          path: artifacts/release-packages/
+          retention-days: 1
+          if-no-files-found: error
+
+  attest-package-sboms:
+    name: Attest SBOM (${{ matrix.package.name }})
+    needs:
+      - build-package-artifacts
+    if: needs.build-package-artifacts.outputs.has_work == 'true'
+    strategy:
+      matrix:
+        package: ${{ fromJSON(needs.build-package-artifacts.outputs.manifest_json).packages }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    steps:
+      - name: Download release package artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: stable-release-packages
+          path: release-artifacts
+      - name: Attest package SBOM
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
+        with:
+          subject-path: release-artifacts/${{ matrix.package.tarball_asset }}
+          sbom-path: release-artifacts/${{ matrix.package.sbom_asset }}
+
+  request-approval:
+    needs:
+      - build-package-artifacts
+      - attest-package-sboms
+    if: needs.build-package-artifacts.outputs.has_work == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions: {}
+    steps:
+      - name: Request stable release approval
+        uses: braintrustdata/sdk-actions/actions/release/request-approval@337c5475631d724441403f5a4d8ad0b32ce12e29
+        with:
+          packages: ${{ needs.build-package-artifacts.outputs.manifest_json }}
+          title: Braintrust JavaScript SDK stable release
+          sha: ${{ needs.build-package-artifacts.outputs.release_sha }}
+          branch: ${{ needs.build-package-artifacts.outputs.branch }}
+          on_release_branch: ${{ needs.build-package-artifacts.outputs.on_release_branch }}
+          commit_message: ${{ needs.build-package-artifacts.outputs.commit_message }}
+          slack_token: ${{ secrets.SLACK_BOT_TOKEN }}
+          slack_channel: C0ABHT0SWA2
+
+  publish-stable:
+    needs:
+      - build-package-artifacts
+      - request-approval
+    if: |
+      always() &&
+      needs.build-package-artifacts.outputs.has_work == 'true' &&
+      needs.request-approval.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      issues: write
+      id-token: write
+      pull-requests: read
+      attestations: read
+    environment: npm-publish
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          ref: ${{ needs.build-package-artifacts.outputs.release_sha }}
+      - name: Download release package artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: stable-release-packages
+          path: release-artifacts
+      - name: Publish stable package tarballs
+        uses: braintrustdata/sdk-actions/actions/release/lang/js/publish-npm-tarballs@337c5475631d724441403f5a4d8ad0b32ce12e29
+        with:
+          manifest: release-artifacts/release-manifest.json
+          tarballs: release-artifacts/*.tgz
+          repo: ${{ github.repository }}
+          slack_token: ${{ secrets.SLACK_BOT_TOKEN }}
+          slack_channel: C0ABHT0SWA2
       - name: Push Changesets release tags
-        if: steps.detect.outputs.has_work == 'true'
         run: |
           set -euo pipefail
 
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
-          target_commit="$(jq -r '.commit // empty' .release-manifest.json)"
+          manifest="release-artifacts/release-manifest.json"
+          target_commit="$(jq -r '.commit // empty' "$manifest")"
           mapfile -t tags < <(
-            jq -r '.packages[]? | .tag // "\(.name)@\(.version)"' .release-manifest.json
+            jq -r '.packages[]? | .tag // "\(.name)@\(.version)"' "$manifest"
           )
 
           if [ "${#tags[@]}" -eq 0 ]; then
@@ -174,44 +299,60 @@ jobs:
 
           git push origin "${to_push[@]}"
       - name: Create GitHub Releases
-        if: steps.detect.outputs.has_work == 'true'
+        uses: braintrustdata/sdk-actions/actions/release/create-package-github-releases@337c5475631d724441403f5a4d8ad0b32ce12e29
+        with:
+          manifest: release-artifacts/release-manifest.json
+          repo: ${{ github.repository }}
+      - name: Ensure GitHub release SBOM assets
         env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: node scripts/release/create-github-releases.mjs --manifest .release-manifest.json
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          manifest="release-artifacts/release-manifest.json"
+          manifest_dir="$(dirname "$manifest")"
+          while IFS= read -r encoded; do
+            package_json="$(printf '%s' "$encoded" | base64 -d)"
+            tag="$(jq -r '.tag // "\(.name)@\(.version)"' <<< "$package_json")"
+            sbom_asset="$(jq -r '.sbom_asset // empty' <<< "$package_json")"
+            if [ -z "$sbom_asset" ] || [ "$(basename "$sbom_asset")" != "$sbom_asset" ]; then
+              echo "Invalid SBOM asset for $tag: $sbom_asset" >&2
+              exit 1
+            fi
+
+            sbom_path="$manifest_dir/$sbom_asset"
+            if [ ! -f "$sbom_path" ]; then
+              echo "SBOM asset does not exist for $tag: $sbom_path" >&2
+              exit 1
+            fi
+
+            gh release upload "$tag" "$sbom_path" \
+              --repo "$GITHUB_REPOSITORY" \
+              --clobber
+          done < <(jq -r '.packages[] | @base64' "$manifest")
       - name: Comment on issues closed by released PRs
-        if: steps.detect.outputs.has_work == 'true'
         env:
           GITHUB_TOKEN: ${{ github.token }}
-        run: node scripts/release/comment-release-issues.mjs
-      - name: Post stable release to Slack
-        if: steps.detect.outputs.has_work == 'true'
-        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
-        with:
-          method: chat.postMessage
-          token: ${{ secrets.SLACK_BOT_TOKEN }}
-          payload: |
-            channel: C0ABHT0SWA2
-            text: "✅ Packages published"
-            blocks:
-              - type: "header"
-                text:
-                  type: "plain_text"
-                  text: "✅ Packages published"
-              - type: "section"
-                text:
-                  type: "mrkdwn"
-                  text: "*Release SHA:* `${{ needs.validate-release-sha.outputs.release_sha }}`\n\n*Packages:*\n${{ steps.detect.outputs.markdown }}\n\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Run>"
+        run: |
+          cp release-artifacts/release-manifest.json .release-manifest.json
+          node scripts/release/comment-release-issues.mjs
 
   notify-failure:
     needs:
       - validate-release-sha
       - print-changelog-links
+      - build-package-artifacts
+      - attest-package-sboms
+      - request-approval
       - publish-stable
     if: |
       always() &&
       (
         needs.validate-release-sha.result == 'failure' ||
         needs.print-changelog-links.result == 'failure' ||
+        needs.build-package-artifacts.result == 'failure' ||
+        needs.attest-package-sboms.result == 'failure' ||
+        needs.request-approval.result == 'failure' ||
         needs.publish-stable.result == 'failure'
       )
     runs-on: ubuntu-latest
diff --git a/.tool-versions b/.tool-versions
index 1d471a553..ebcb7cd34 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,4 +1,4 @@
 nodejs 24.15.0
 npm 11.12.1
-pnpm 10.33.0
+pnpm 11.9.0
 deno 2.7.6
diff --git a/e2e/Dockerfile.canary b/e2e/Dockerfile.canary
index d48e422ab..df3dc00eb 100644
--- a/e2e/Dockerfile.canary
+++ b/e2e/Dockerfile.canary
@@ -7,7 +7,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-RUN npm install -g pnpm@10.33.0
+RUN npm install -g pnpm@11.9.0
 
 WORKDIR /workspace
 COPY . .
diff --git a/e2e/Dockerfile.e2e-bump b/e2e/Dockerfile.e2e-bump
index 949b67c72..c9397c365 100644
--- a/e2e/Dockerfile.e2e-bump
+++ b/e2e/Dockerfile.e2e-bump
@@ -7,7 +7,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-RUN npm install -g pnpm@10.33.0
+RUN npm install -g pnpm@11.9.0
 
 WORKDIR /workspace
 COPY . .
diff --git a/e2e/helpers/scenario-installer.ts b/e2e/helpers/scenario-installer.ts
index bcb254546..065ca41c7 100644
--- a/e2e/helpers/scenario-installer.ts
+++ b/e2e/helpers/scenario-installer.ts
@@ -47,6 +47,7 @@ const E2E_ROOT = path.resolve(HELPERS_DIR, "..");
 type ScenarioInstallInputs = {
   lockfileRaw: string;
   manifestRaw: string;
+  workspaceConfigRaw: string | null;
 };
 
 type CachedScenarioDependenciesResult =
@@ -199,6 +200,14 @@ async function readScenarioInstallInputs(
   return {
     lockfileRaw: await fs.readFile(lockfilePath, "utf8"),
     manifestRaw,
+    workspaceConfigRaw: await fs
+      .readFile(path.join(scenarioDir, "pnpm-workspace.yaml"), "utf8")
+      .catch((err: NodeJS.ErrnoException) => {
+        if (err.code === "ENOENT") {
+          return null;
+        }
+        throw err;
+      }),
   };
 }
 
@@ -218,6 +227,8 @@ function scenarioDependencyCacheKey(
   hash.update(inputs.manifestRaw);
   hash.update("\0");
   hash.update(inputs.lockfileRaw);
+  hash.update("\0");
+  hash.update(inputs.workspaceConfigRaw ?? "");
 
   return `${scenarioNameForPath(scenarioDir)}-${hash.digest("hex").slice(0, 16)}`;
 }
@@ -264,6 +275,12 @@ async function installCachedScenarioDependencies({
       path.join(stagingDir, "pnpm-lock.yaml"),
       inputs.lockfileRaw,
     );
+    // Give the staging directory its own workspace root so pnpm 11 reads any
+    // fixture-level settings without inheriting the repository workspace.
+    await fs.writeFile(
+      path.join(stagingDir, "pnpm-workspace.yaml"),
+      inputs.workspaceConfigRaw ?? "packages: []\n",
+    );
     await installScenarioDependencies({
       preferOffline,
       scenarioDir: stagingDir,
@@ -344,7 +361,6 @@ export async function installScenarioDependencies({
     "install",
     "--dir",
     scenarioDir,
-    "--ignore-workspace",
     "--frozen-lockfile",
     "--ignore-scripts=false",
     "--strict-peer-dependencies=false",
diff --git a/e2e/scenarios/ai-sdk-harness-instrumentation/docker-sandbox.mjs b/e2e/scenarios/ai-sdk-harness-instrumentation/docker-sandbox.mjs
index 5112456c9..a34d2ac33 100644
--- a/e2e/scenarios/ai-sdk-harness-instrumentation/docker-sandbox.mjs
+++ b/e2e/scenarios/ai-sdk-harness-instrumentation/docker-sandbox.mjs
@@ -95,7 +95,7 @@ export async function createDockerSandbox() {
       containerName,
       "/bin/sh",
       "-lc",
-      "corepack enable pnpm && corepack install --global pnpm@10.33.0 && mkdir -p /workspace /root/.codex",
+      "corepack enable pnpm && corepack install --global pnpm@11.9.0 && mkdir -p /workspace /root/.codex",
     ]);
   }
 
diff --git a/e2e/scenarios/ai-sdk-instrumentation/package.json b/e2e/scenarios/ai-sdk-instrumentation/package.json
index 3bfd800a5..4039e9792 100644
--- a/e2e/scenarios/ai-sdk-instrumentation/package.json
+++ b/e2e/scenarios/ai-sdk-instrumentation/package.json
@@ -96,13 +96,5 @@
     "ai-sdk-openai-v7": "npm:@ai-sdk/openai@4.0.0-beta.44",
     "ai-sdk-openai-v7-latest": "npm:@ai-sdk/openai@4.0.0-beta.44",
     "ai-sdk-workflow-v1": "npm:@ai-sdk/workflow@1.0.8"
-  },
-  "pnpm": {
-    "overrides": {
-      "devalue@>=4.0.0 <5.6.4": "^5.6.4",
-      "devalue@>=5.6.3 <5.8.1": "^5.8.1",
-      "fast-uri@<3.1.4": "^3.1.4",
-      "svelte": "^5.55.7"
-    }
   }
 }
diff --git a/e2e/scenarios/ai-sdk-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/ai-sdk-instrumentation/pnpm-workspace.yaml
new file mode 100644
index 000000000..db1d12d6c
--- /dev/null
+++ b/e2e/scenarios/ai-sdk-instrumentation/pnpm-workspace.yaml
@@ -0,0 +1,5 @@
+overrides:
+  devalue@>=4.0.0 <5.6.4: ^5.6.4
+  devalue@>=5.6.3 <5.8.1: ^5.8.1
+  fast-uri@<3.1.4: ^3.1.4
+  svelte: ^5.55.7
diff --git a/e2e/scenarios/ai-sdk-otel-export/package.json b/e2e/scenarios/ai-sdk-otel-export/package.json
index 48d80f704..caaeb64d5 100644
--- a/e2e/scenarios/ai-sdk-otel-export/package.json
+++ b/e2e/scenarios/ai-sdk-otel-export/package.json
@@ -34,13 +34,5 @@
     "ai-sdk-v6-latest": "npm:ai@6.0.219",
     "ai-sdk-openai-v6": "npm:@ai-sdk/openai@3.0.7",
     "ai-sdk-openai-v6-latest": "npm:@ai-sdk/openai@3.0.80"
-  },
-  "pnpm": {
-    "overrides": {
-      "protobufjs@<7.5.8": "^7.5.8",
-      "@opentelemetry/sdk-node@<0.217.0": "^0.217.0",
-      "@opentelemetry/exporter-prometheus@<0.217.0": "^0.217.0",
-      "@opentelemetry/propagator-jaeger@<2.9.0": "^2.9.0"
-    }
   }
 }
diff --git a/e2e/scenarios/ai-sdk-otel-export/pnpm-workspace.yaml b/e2e/scenarios/ai-sdk-otel-export/pnpm-workspace.yaml
new file mode 100644
index 000000000..d180e7164
--- /dev/null
+++ b/e2e/scenarios/ai-sdk-otel-export/pnpm-workspace.yaml
@@ -0,0 +1,5 @@
+overrides:
+  protobufjs@<7.5.8: ^7.5.8
+  "@opentelemetry/sdk-node@<0.217.0": ^0.217.0
+  "@opentelemetry/exporter-prometheus@<0.217.0": ^0.217.0
+  "@opentelemetry/propagator-jaeger@<2.9.0": ^2.9.0
diff --git a/e2e/scenarios/claude-agent-sdk-instrumentation/package.json b/e2e/scenarios/claude-agent-sdk-instrumentation/package.json
index 7ea3f6db9..53c49cc82 100644
--- a/e2e/scenarios/claude-agent-sdk-instrumentation/package.json
+++ b/e2e/scenarios/claude-agent-sdk-instrumentation/package.json
@@ -15,10 +15,5 @@
     "zod": "4.3.6",
     "claude-agent-sdk-v0": "npm:@anthropic-ai/claude-agent-sdk@0.2.76",
     "claude-agent-sdk-v0-latest": "npm:@anthropic-ai/claude-agent-sdk@0.2.141"
-  },
-  "pnpm": {
-    "overrides": {
-      "fast-uri@<3.1.4": "^3.1.4"
-    }
   }
 }
diff --git a/e2e/scenarios/claude-agent-sdk-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/claude-agent-sdk-instrumentation/pnpm-workspace.yaml
new file mode 100644
index 000000000..7da97640c
--- /dev/null
+++ b/e2e/scenarios/claude-agent-sdk-instrumentation/pnpm-workspace.yaml
@@ -0,0 +1,2 @@
+overrides:
+  fast-uri@<3.1.4: ^3.1.4
diff --git a/e2e/scenarios/cohere-instrumentation/package.json b/e2e/scenarios/cohere-instrumentation/package.json
index 07bae9f05..168a75da1 100644
--- a/e2e/scenarios/cohere-instrumentation/package.json
+++ b/e2e/scenarios/cohere-instrumentation/package.json
@@ -20,11 +20,5 @@
     "cohere-sdk-v7-latest": "npm:cohere-ai@7.21.0",
     "cohere-sdk-v8": "npm:cohere-ai@8.0.0",
     "cohere-sdk-v8-latest": "npm:cohere-ai@8.0.0"
-  },
-  "pnpm": {
-    "overrides": {
-      "fast-xml-builder@<1.1.7": "^1.1.7",
-      "qs@>=6.7.0 <6.15.2": "^6.15.2"
-    }
   }
 }
diff --git a/e2e/scenarios/cohere-instrumentation/pnpm-lock.yaml b/e2e/scenarios/cohere-instrumentation/pnpm-lock.yaml
index d48d70b2a..cb1f257d9 100644
--- a/e2e/scenarios/cohere-instrumentation/pnpm-lock.yaml
+++ b/e2e/scenarios/cohere-instrumentation/pnpm-lock.yaml
@@ -12,16 +12,16 @@ importers:
 
   .:
     dependencies:
-      cohere-sdk-v7-latest:
-        specifier: npm:cohere-ai@7.21.0
-        version: cohere-ai@7.21.0
       cohere-sdk-v7:
         specifier: npm:cohere-ai@7.14.0
         version: cohere-ai@7.14.0
-      cohere-sdk-v8-latest:
+      cohere-sdk-v7-latest:
+        specifier: npm:cohere-ai@7.21.0
+        version: cohere-ai@7.21.0
+      cohere-sdk-v8:
         specifier: npm:cohere-ai@8.0.0
         version: cohere-ai@8.0.0(@aws-crypto/sha256-js@5.2.0)(@aws-sdk/credential-providers@3.1028.0)(@smithy/protocol-http@5.3.13)(@smithy/signature-v4@5.3.13)
-      cohere-sdk-v8:
+      cohere-sdk-v8-latest:
         specifier: npm:cohere-ai@8.0.0
         version: cohere-ai@8.0.0(@aws-crypto/sha256-js@5.2.0)(@aws-sdk/credential-providers@3.1028.0)(@smithy/protocol-http@5.3.13)(@smithy/signature-v4@5.3.13)
 
diff --git a/e2e/scenarios/cohere-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/cohere-instrumentation/pnpm-workspace.yaml
new file mode 100644
index 000000000..b68be0393
--- /dev/null
+++ b/e2e/scenarios/cohere-instrumentation/pnpm-workspace.yaml
@@ -0,0 +1,3 @@
+overrides:
+  fast-xml-builder@<1.1.7: ^1.1.7
+  qs@>=6.7.0 <6.15.2: ^6.15.2
diff --git a/e2e/scenarios/cursor-sdk-instrumentation/package.json b/e2e/scenarios/cursor-sdk-instrumentation/package.json
index 9c19fef4e..ac095fae9 100644
--- a/e2e/scenarios/cursor-sdk-instrumentation/package.json
+++ b/e2e/scenarios/cursor-sdk-instrumentation/package.json
@@ -14,14 +14,5 @@
   "dependencies": {
     "cursor-sdk-v1": "npm:@cursor/sdk@1.0.12",
     "cursor-sdk-v1-latest": "npm:@cursor/sdk@1.0.12"
-  },
-  "pnpm": {
-    "overrides": {
-      "@tootallnate/once@>=3.0.0 <3.0.1": "^3.0.1",
-      "@tootallnate/once@<2.0.1": "^2.0.1"
-    },
-    "onlyBuiltDependencies": [
-      "sqlite3"
-    ]
   }
 }
diff --git a/e2e/scenarios/cursor-sdk-instrumentation/pnpm-lock.yaml b/e2e/scenarios/cursor-sdk-instrumentation/pnpm-lock.yaml
index 09aa7629c..5d58907db 100644
--- a/e2e/scenarios/cursor-sdk-instrumentation/pnpm-lock.yaml
+++ b/e2e/scenarios/cursor-sdk-instrumentation/pnpm-lock.yaml
@@ -12,10 +12,10 @@ importers:
 
   .:
     dependencies:
-      cursor-sdk-v1-latest:
+      cursor-sdk-v1:
         specifier: npm:@cursor/sdk@1.0.12
         version: '@cursor/sdk@1.0.12'
-      cursor-sdk-v1:
+      cursor-sdk-v1-latest:
         specifier: npm:@cursor/sdk@1.0.12
         version: '@cursor/sdk@1.0.12'
 
diff --git a/e2e/scenarios/cursor-sdk-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/cursor-sdk-instrumentation/pnpm-workspace.yaml
new file mode 100644
index 000000000..0dc7df533
--- /dev/null
+++ b/e2e/scenarios/cursor-sdk-instrumentation/pnpm-workspace.yaml
@@ -0,0 +1,5 @@
+allowBuilds:
+  sqlite3: true
+overrides:
+  "@tootallnate/once@>=3.0.0 <3.0.1": ^3.0.1
+  "@tootallnate/once@<2.0.1": ^2.0.1
diff --git a/e2e/scenarios/flue-instrumentation/package.json b/e2e/scenarios/flue-instrumentation/package.json
index c1fae7e68..d488f15c9 100644
--- a/e2e/scenarios/flue-instrumentation/package.json
+++ b/e2e/scenarios/flue-instrumentation/package.json
@@ -5,12 +5,5 @@
   "dependencies": {
     "@flue/cli": "0.8.0",
     "@flue/runtime": "0.8.0"
-  },
-  "pnpm": {
-    "overrides": {
-      "@hono/node-server@>=2.0.0 <2.0.10": "^2.0.10",
-      "fast-uri@<3.1.4": "^3.1.4",
-      "hono@>=4.0.0 <4.12.27": "^4.12.27"
-    }
   }
 }
diff --git a/e2e/scenarios/flue-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/flue-instrumentation/pnpm-workspace.yaml
new file mode 100644
index 000000000..1b5dfa6fc
--- /dev/null
+++ b/e2e/scenarios/flue-instrumentation/pnpm-workspace.yaml
@@ -0,0 +1,4 @@
+overrides:
+  "@hono/node-server@>=2.0.0 <2.0.10": ^2.0.10
+  fast-uri@<3.1.4: ^3.1.4
+  hono@>=4.0.0 <4.12.27: ^4.12.27
diff --git a/e2e/scenarios/flue-instrumentation/versions/v1/package.json b/e2e/scenarios/flue-instrumentation/versions/v1/package.json
index 566055e87..1f92eb0ab 100644
--- a/e2e/scenarios/flue-instrumentation/versions/v1/package.json
+++ b/e2e/scenarios/flue-instrumentation/versions/v1/package.json
@@ -7,12 +7,5 @@
     "@flue/runtime": "1.0.0-beta.3",
     "hono": "^4.8.3",
     "valibot": "^1.1.0"
-  },
-  "pnpm": {
-    "overrides": {
-      "@hono/node-server@>=2.0.0 <2.0.10": "^2.0.10",
-      "fast-uri@<3.1.4": "^3.1.4",
-      "fast-xml-parser@>=5.9.3 <5.10.1": "^5.10.1"
-    }
   }
 }
diff --git a/e2e/scenarios/flue-instrumentation/versions/v1/pnpm-workspace.yaml b/e2e/scenarios/flue-instrumentation/versions/v1/pnpm-workspace.yaml
new file mode 100644
index 000000000..e525f4e0b
--- /dev/null
+++ b/e2e/scenarios/flue-instrumentation/versions/v1/pnpm-workspace.yaml
@@ -0,0 +1,4 @@
+overrides:
+  "@hono/node-server@>=2.0.0 <2.0.10": ^2.0.10
+  fast-uri@<3.1.4: ^3.1.4
+  fast-xml-parser@>=5.9.3 <5.10.1: ^5.10.1
diff --git a/e2e/scenarios/genkit-instrumentation/package.json b/e2e/scenarios/genkit-instrumentation/package.json
index 888d868a9..f7edfd400 100644
--- a/e2e/scenarios/genkit-instrumentation/package.json
+++ b/e2e/scenarios/genkit-instrumentation/package.json
@@ -20,17 +20,5 @@
     "genkit-v1-latest": "npm:genkit@1.33.0",
     "genkit-google-genai-v1": "npm:@genkit-ai/google-genai@1.33.0",
     "genkit-google-genai-v1-latest": "npm:@genkit-ai/google-genai@1.33.0"
-  },
-  "pnpm": {
-    "overrides": {
-      "protobufjs@<7.5.8": "^7.5.8",
-      "uuid": "^11.1.1",
-      "qs@>=6.7.0 <6.15.2": "^6.15.2",
-      "ws@>=8.0.0 <8.20.1": "^8.20.1",
-      "fast-uri@<3.1.4": "^3.1.4",
-      "@opentelemetry/sdk-node@<0.217.0": "^0.217.0",
-      "@opentelemetry/auto-instrumentations-node@<0.75.0": "^0.75.0",
-      "@opentelemetry/propagator-jaeger@<2.9.0": "^2.9.0"
-    }
   }
 }
diff --git a/e2e/scenarios/genkit-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/genkit-instrumentation/pnpm-workspace.yaml
new file mode 100644
index 000000000..0b3ffb898
--- /dev/null
+++ b/e2e/scenarios/genkit-instrumentation/pnpm-workspace.yaml
@@ -0,0 +1,9 @@
+overrides:
+  protobufjs@<7.5.8: ^7.5.8
+  uuid: ^11.1.1
+  qs@>=6.7.0 <6.15.2: ^6.15.2
+  ws@>=8.0.0 <8.20.1: ^8.20.1
+  fast-uri@<3.1.4: ^3.1.4
+  "@opentelemetry/sdk-node@<0.217.0": ^0.217.0
+  "@opentelemetry/auto-instrumentations-node@<0.75.0": ^0.75.0
+  "@opentelemetry/propagator-jaeger@<2.9.0": ^2.9.0
diff --git a/e2e/scenarios/github-copilot-instrumentation/package.json b/e2e/scenarios/github-copilot-instrumentation/package.json
index 61f8031ca..97776d377 100644
--- a/e2e/scenarios/github-copilot-instrumentation/package.json
+++ b/e2e/scenarios/github-copilot-instrumentation/package.json
@@ -15,10 +15,5 @@
     "vscode-jsonrpc": "8.2.1",
     "github-copilot-sdk-v0": "npm:@github/copilot-sdk@0.3.0",
     "github-copilot-sdk-v0-latest": "npm:@github/copilot-sdk@0.3.0"
-  },
-  "pnpm": {
-    "overrides": {
-      "@github/copilot@<1.0.43": "^1.0.43"
-    }
   }
 }
diff --git a/e2e/scenarios/github-copilot-instrumentation/pnpm-lock.yaml b/e2e/scenarios/github-copilot-instrumentation/pnpm-lock.yaml
index de00e07bc..3494d3720 100644
--- a/e2e/scenarios/github-copilot-instrumentation/pnpm-lock.yaml
+++ b/e2e/scenarios/github-copilot-instrumentation/pnpm-lock.yaml
@@ -11,10 +11,10 @@ importers:
 
   .:
     dependencies:
-      github-copilot-sdk-v0-latest:
+      github-copilot-sdk-v0:
         specifier: npm:@github/copilot-sdk@0.3.0
         version: '@github/copilot-sdk@0.3.0'
-      github-copilot-sdk-v0:
+      github-copilot-sdk-v0-latest:
         specifier: npm:@github/copilot-sdk@0.3.0
         version: '@github/copilot-sdk@0.3.0'
       vscode-jsonrpc:
diff --git a/e2e/scenarios/github-copilot-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/github-copilot-instrumentation/pnpm-workspace.yaml
new file mode 100644
index 000000000..daf52a431
--- /dev/null
+++ b/e2e/scenarios/github-copilot-instrumentation/pnpm-workspace.yaml
@@ -0,0 +1,2 @@
+overrides:
+  "@github/copilot@<1.0.43": ^1.0.43
diff --git a/e2e/scenarios/google-adk-instrumentation/package.json b/e2e/scenarios/google-adk-instrumentation/package.json
index 3576ebbf1..fd9ec93e0 100644
--- a/e2e/scenarios/google-adk-instrumentation/package.json
+++ b/e2e/scenarios/google-adk-instrumentation/package.json
@@ -20,22 +20,5 @@
     "google-adk-sdk-v0-latest": "npm:@google/adk@0.6.1",
     "google-adk-sdk-v1": "npm:@google/adk@1.0.0",
     "google-adk-sdk-v1-latest": "npm:@google/adk@1.3.0"
-  },
-  "pnpm": {
-    "overrides": {
-      "protobufjs@<7.5.8": "^7.5.8",
-      "uuid": "^11.1.1",
-      "qs@>=6.7.0 <6.15.2": "^6.15.2",
-      "hono@>=4.0.0 <4.12.27": "^4.12.27",
-      "ws@>=8.0.0 <8.20.1": "^8.20.1",
-      "fast-uri@<3.1.4": "^3.1.4",
-      "fast-xml-builder@<1.1.7": "^1.1.7",
-      "ip-address@>=10.0.0 <10.1.1": "^10.1.1",
-      "brace-expansion@>=4.0.0 <5.0.6": "^5.0.6",
-      "@tootallnate/once@>=3.0.0 <3.0.1": "^3.0.1",
-      "@tootallnate/once@<2.0.1": "^2.0.1",
-      "@mikro-orm/knex@>=6.0.0 <6.6.14": "^6.6.14",
-      "@mikro-orm/knex@>=7.0.0 <7.0.14": "^7.0.14"
-    }
   }
 }
diff --git a/e2e/scenarios/google-adk-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/google-adk-instrumentation/pnpm-workspace.yaml
new file mode 100644
index 000000000..8fce5c1b2
--- /dev/null
+++ b/e2e/scenarios/google-adk-instrumentation/pnpm-workspace.yaml
@@ -0,0 +1,14 @@
+overrides:
+  protobufjs@<7.5.8: ^7.5.8
+  uuid: ^11.1.1
+  qs@>=6.7.0 <6.15.2: ^6.15.2
+  hono@>=4.0.0 <4.12.27: ^4.12.27
+  ws@>=8.0.0 <8.20.1: ^8.20.1
+  fast-uri@<3.1.4: ^3.1.4
+  fast-xml-builder@<1.1.7: ^1.1.7
+  ip-address@>=10.0.0 <10.1.1: ^10.1.1
+  brace-expansion@>=4.0.0 <5.0.6: ^5.0.6
+  "@tootallnate/once@>=3.0.0 <3.0.1": ^3.0.1
+  "@tootallnate/once@<2.0.1": ^2.0.1
+  "@mikro-orm/knex@>=6.0.0 <6.6.14": ^6.6.14
+  "@mikro-orm/knex@>=7.0.0 <7.0.14": ^7.0.14
diff --git a/e2e/scenarios/google-genai-instrumentation/package.json b/e2e/scenarios/google-genai-instrumentation/package.json
index 03c403417..657987702 100644
--- a/e2e/scenarios/google-genai-instrumentation/package.json
+++ b/e2e/scenarios/google-genai-instrumentation/package.json
@@ -20,11 +20,5 @@
     "google-genai-sdk-v1-latest": "npm:@google/genai@1.52.0",
     "google-genai-sdk-v2": "npm:@google/genai@2.8.0",
     "google-genai-sdk-v2-latest": "npm:@google/genai@2.8.0"
-  },
-  "pnpm": {
-    "overrides": {
-      "protobufjs@<7.5.8": "^7.5.8",
-      "ws@>=8.0.0 <8.20.1": "^8.20.1"
-    }
   }
 }
diff --git a/e2e/scenarios/google-genai-instrumentation/pnpm-lock.yaml b/e2e/scenarios/google-genai-instrumentation/pnpm-lock.yaml
index b173a126d..7d374dcc3 100644
--- a/e2e/scenarios/google-genai-instrumentation/pnpm-lock.yaml
+++ b/e2e/scenarios/google-genai-instrumentation/pnpm-lock.yaml
@@ -12,16 +12,16 @@ importers:
 
   .:
     dependencies:
-      google-genai-sdk-v1-latest:
-        specifier: npm:@google/genai@1.52.0
-        version: '@google/genai@1.52.0'
       google-genai-sdk-v1:
         specifier: npm:@google/genai@1.30.0
         version: '@google/genai@1.30.0'
-      google-genai-sdk-v2-latest:
+      google-genai-sdk-v1-latest:
+        specifier: npm:@google/genai@1.52.0
+        version: '@google/genai@1.52.0'
+      google-genai-sdk-v2:
         specifier: npm:@google/genai@2.8.0
         version: '@google/genai@2.8.0'
-      google-genai-sdk-v2:
+      google-genai-sdk-v2-latest:
         specifier: npm:@google/genai@2.8.0
         version: '@google/genai@2.8.0'
 
diff --git a/e2e/scenarios/google-genai-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/google-genai-instrumentation/pnpm-workspace.yaml
new file mode 100644
index 000000000..e86622e4d
--- /dev/null
+++ b/e2e/scenarios/google-genai-instrumentation/pnpm-workspace.yaml
@@ -0,0 +1,3 @@
+overrides:
+  protobufjs@<7.5.8: ^7.5.8
+  ws@>=8.0.0 <8.20.1: ^8.20.1
diff --git a/e2e/scenarios/langgraph-auto-instrumentation/package.json b/e2e/scenarios/langgraph-auto-instrumentation/package.json
index 343249b2c..d679d9bb2 100644
--- a/e2e/scenarios/langgraph-auto-instrumentation/package.json
+++ b/e2e/scenarios/langgraph-auto-instrumentation/package.json
@@ -26,11 +26,5 @@
     "langchain-langgraph-v1-latest": "npm:@langchain/langgraph@1.4.7",
     "langchain-openai-v1": "npm:@langchain/openai@1.3.0",
     "langchain-openai-v1-latest": "npm:@langchain/openai@1.5.3"
-  },
-  "pnpm": {
-    "overrides": {
-      "langsmith@<0.3.30": "^0.3.30",
-      "uuid": "^11.1.1"
-    }
   }
 }
diff --git a/e2e/scenarios/langgraph-auto-instrumentation/pnpm-lock.yaml b/e2e/scenarios/langgraph-auto-instrumentation/pnpm-lock.yaml
index 542a5ca6c..b265b700a 100644
--- a/e2e/scenarios/langgraph-auto-instrumentation/pnpm-lock.yaml
+++ b/e2e/scenarios/langgraph-auto-instrumentation/pnpm-lock.yaml
@@ -12,24 +12,24 @@ importers:
 
   .:
     dependencies:
-      langchain-core-v1-latest:
-        specifier: npm:@langchain/core@1.2.1
-        version: '@langchain/core@1.2.1(openai@6.45.0(zod@4.3.6))'
       langchain-core-v1:
         specifier: npm:@langchain/core@1.1.35
         version: '@langchain/core@1.1.35(openai@6.45.0(zod@4.3.6))'
-      langchain-langgraph-v1-latest:
-        specifier: npm:@langchain/langgraph@1.4.7
-        version: '@langchain/langgraph@1.4.7(@langchain/core@1.2.1(openai@6.45.0(zod@4.3.6)))(zod@4.3.6)'
+      langchain-core-v1-latest:
+        specifier: npm:@langchain/core@1.2.1
+        version: '@langchain/core@1.2.1(openai@6.45.0(zod@4.3.6))'
       langchain-langgraph-v1:
         specifier: npm:@langchain/langgraph@1.0.7
         version: '@langchain/langgraph@1.0.7(@langchain/core@1.2.1(openai@6.45.0(zod@4.3.6)))(zod@4.3.6)'
-      langchain-openai-v1-latest:
-        specifier: npm:@langchain/openai@1.5.3
-        version: '@langchain/openai@1.5.3(@langchain/core@1.2.1(openai@6.45.0(zod@4.3.6)))'
+      langchain-langgraph-v1-latest:
+        specifier: npm:@langchain/langgraph@1.4.7
+        version: '@langchain/langgraph@1.4.7(@langchain/core@1.2.1(openai@6.45.0(zod@4.3.6)))(zod@4.3.6)'
       langchain-openai-v1:
         specifier: npm:@langchain/openai@1.3.0
         version: '@langchain/openai@1.3.0(@langchain/core@1.2.1(openai@6.45.0(zod@4.3.6)))'
+      langchain-openai-v1-latest:
+        specifier: npm:@langchain/openai@1.5.3
+        version: '@langchain/openai@1.5.3(@langchain/core@1.2.1(openai@6.45.0(zod@4.3.6)))'
 
 packages:
 
diff --git a/e2e/scenarios/langgraph-auto-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/langgraph-auto-instrumentation/pnpm-workspace.yaml
new file mode 100644
index 000000000..9f89d3b5c
--- /dev/null
+++ b/e2e/scenarios/langgraph-auto-instrumentation/pnpm-workspace.yaml
@@ -0,0 +1,3 @@
+overrides:
+  langsmith@<0.3.30: ^0.3.30
+  uuid: ^11.1.1
diff --git a/e2e/scenarios/mastra-instrumentation/package.json b/e2e/scenarios/mastra-instrumentation/package.json
index eba54f4af..3dd1fb177 100644
--- a/e2e/scenarios/mastra-instrumentation/package.json
+++ b/e2e/scenarios/mastra-instrumentation/package.json
@@ -17,15 +17,5 @@
     "mastra-core-v1": "npm:@mastra/core@1.26.0",
     "mastra-core-v1-latest": "npm:@mastra/core@1.26.1-alpha.0",
     "@mastra/observability": "npm:@mastra/observability@1.15.2"
-  },
-  "pnpm": {
-    "overrides": {
-      "hono@>=4.0.0 <4.12.27": "^4.12.27",
-      "fast-uri@<3.1.4": "^3.1.4",
-      "ip-address@>=10.0.0 <10.1.1": "^10.1.1",
-      "ws@>=8.0.0 <8.20.1": "^8.20.1",
-      "uuid@<11.1.1": "^11.1.1",
-      "qs@>=6.7.0 <6.15.2": "^6.15.2"
-    }
   }
 }
diff --git a/e2e/scenarios/mastra-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/mastra-instrumentation/pnpm-workspace.yaml
new file mode 100644
index 000000000..ea32e6350
--- /dev/null
+++ b/e2e/scenarios/mastra-instrumentation/pnpm-workspace.yaml
@@ -0,0 +1,7 @@
+overrides:
+  hono@>=4.0.0 <4.12.27: ^4.12.27
+  fast-uri@<3.1.4: ^3.1.4
+  ip-address@>=10.0.0 <10.1.1: ^10.1.1
+  ws@>=8.0.0 <8.20.1: ^8.20.1
+  uuid@<11.1.1: ^11.1.1
+  qs@>=6.7.0 <6.15.2: ^6.15.2
diff --git a/e2e/scenarios/mistral-instrumentation/package.json b/e2e/scenarios/mistral-instrumentation/package.json
index a8b471c4c..ed42c4f99 100644
--- a/e2e/scenarios/mistral-instrumentation/package.json
+++ b/e2e/scenarios/mistral-instrumentation/package.json
@@ -20,10 +20,5 @@
     "mistral-sdk-v1-latest": "npm:@mistralai/mistralai@1.15.1",
     "mistral-sdk-v2": "npm:@mistralai/mistralai@2.1.2",
     "mistral-sdk-v2-latest": "npm:@mistralai/mistralai@2.5.0"
-  },
-  "pnpm": {
-    "overrides": {
-      "ws@>=8.0.0 <8.20.1": "^8.20.1"
-    }
   }
 }
diff --git a/e2e/scenarios/mistral-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/mistral-instrumentation/pnpm-workspace.yaml
new file mode 100644
index 000000000..42d97ee84
--- /dev/null
+++ b/e2e/scenarios/mistral-instrumentation/pnpm-workspace.yaml
@@ -0,0 +1,2 @@
+overrides:
+  ws@>=8.0.0 <8.20.1: ^8.20.1
diff --git a/e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/package.json b/e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/package.json
index ffdfddd28..472f1d754 100644
--- a/e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/package.json
+++ b/e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/package.json
@@ -10,10 +10,5 @@
   "devDependencies": {
     "@types/react": "18.3.27",
     "@types/react-dom": "18.3.7"
-  },
-  "pnpm": {
-    "overrides": {
-      "postcss@<8.5.10": "^8.5.10"
-    }
   }
 }
diff --git a/e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/pnpm-workspace.yaml b/e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/pnpm-workspace.yaml
new file mode 100644
index 000000000..d184b4fdc
--- /dev/null
+++ b/e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/pnpm-workspace.yaml
@@ -0,0 +1,2 @@
+overrides:
+  postcss@<8.5.10: ^8.5.10
diff --git a/e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/package.json b/e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/package.json
index 1b0d5ea03..89aa8e2ab 100644
--- a/e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/package.json
+++ b/e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/package.json
@@ -9,10 +9,5 @@
   },
   "devDependencies": {
     "@types/react": "19.2.14"
-  },
-  "pnpm": {
-    "overrides": {
-      "postcss@<8.5.10": "^8.5.10"
-    }
   }
 }
diff --git a/e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/pnpm-workspace.yaml b/e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/pnpm-workspace.yaml
new file mode 100644
index 000000000..7438791f9
--- /dev/null
+++ b/e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/pnpm-workspace.yaml
@@ -0,0 +1,4 @@
+allowBuilds:
+  sharp: true
+overrides:
+  postcss@<8.5.10: ^8.5.10
diff --git a/e2e/scenarios/nextjs-instrumentation/package.json b/e2e/scenarios/nextjs-instrumentation/package.json
index 2febcb69f..2017e3a1f 100644
--- a/e2e/scenarios/nextjs-instrumentation/package.json
+++ b/e2e/scenarios/nextjs-instrumentation/package.json
@@ -16,11 +16,5 @@
     "@types/react": "^18",
     "@types/react-dom": "^18",
     "typescript": "5.4.4"
-  },
-  "pnpm": {
-    "overrides": {
-      "protobufjs@<7.5.8": "^7.5.8",
-      "@protobufjs/utf8@<1.1.1": "^1.1.1"
-    }
   }
 }
diff --git a/e2e/scenarios/nextjs-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/nextjs-instrumentation/pnpm-workspace.yaml
new file mode 100644
index 000000000..d4c01e41a
--- /dev/null
+++ b/e2e/scenarios/nextjs-instrumentation/pnpm-workspace.yaml
@@ -0,0 +1,3 @@
+overrides:
+  protobufjs@<7.5.8: ^7.5.8
+  "@protobufjs/utf8@<1.1.1": ^1.1.1
diff --git a/e2e/scenarios/openai-agents-instrumentation/package.json b/e2e/scenarios/openai-agents-instrumentation/package.json
index 658fe5d30..883a24a8a 100644
--- a/e2e/scenarios/openai-agents-instrumentation/package.json
+++ b/e2e/scenarios/openai-agents-instrumentation/package.json
@@ -17,14 +17,5 @@
         }
       }
     }
-  },
-  "pnpm": {
-    "overrides": {
-      "qs@>=6.7.0 <6.15.2": "^6.15.2",
-      "hono@>=4.0.0 <4.12.27": "^4.12.27",
-      "ws@>=8.0.0 <8.20.1": "^8.20.1",
-      "fast-uri@<3.1.4": "^3.1.4",
-      "ip-address@>=10.0.0 <10.1.1": "^10.1.1"
-    }
   }
 }
diff --git a/e2e/scenarios/openai-agents-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/openai-agents-instrumentation/pnpm-workspace.yaml
new file mode 100644
index 000000000..d97992ca9
--- /dev/null
+++ b/e2e/scenarios/openai-agents-instrumentation/pnpm-workspace.yaml
@@ -0,0 +1,6 @@
+overrides:
+  qs@>=6.7.0 <6.15.2: ^6.15.2
+  hono@>=4.0.0 <4.12.27: ^4.12.27
+  ws@>=8.0.0 <8.20.1: ^8.20.1
+  fast-uri@<3.1.4: ^3.1.4
+  ip-address@>=10.0.0 <10.1.1: ^10.1.1
diff --git a/e2e/scenarios/strands-agent-sdk-instrumentation/package.json b/e2e/scenarios/strands-agent-sdk-instrumentation/package.json
index ba7e2802d..5e13a7769 100644
--- a/e2e/scenarios/strands-agent-sdk-instrumentation/package.json
+++ b/e2e/scenarios/strands-agent-sdk-instrumentation/package.json
@@ -6,12 +6,6 @@
     "strands-agent-sdk-v1": "npm:@strands-agents/sdk@1.6.0",
     "strands-agent-sdk-v1-latest": "npm:@strands-agents/sdk@1.7.0"
   },
-  "pnpm": {
-    "overrides": {
-      "fast-uri@<3.1.4": "^3.1.4",
-      "hono@>=4.0.0 <4.12.27": "^4.12.27"
-    }
-  },
   "braintrustScenario": {
     "bump": {
       "dependencies": {
diff --git a/e2e/scenarios/strands-agent-sdk-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/strands-agent-sdk-instrumentation/pnpm-workspace.yaml
new file mode 100644
index 000000000..33355258a
--- /dev/null
+++ b/e2e/scenarios/strands-agent-sdk-instrumentation/pnpm-workspace.yaml
@@ -0,0 +1,3 @@
+overrides:
+  fast-uri@<3.1.4: ^3.1.4
+  hono@>=4.0.0 <4.12.27: ^4.12.27
diff --git a/e2e/scenarios/wrap-langchain-js-traces/package.json b/e2e/scenarios/wrap-langchain-js-traces/package.json
index 7ef2d95ee..bb71f2069 100644
--- a/e2e/scenarios/wrap-langchain-js-traces/package.json
+++ b/e2e/scenarios/wrap-langchain-js-traces/package.json
@@ -21,11 +21,5 @@
     "langchain-core-v1-latest": "npm:@langchain/core@1.2.1",
     "langchain-openai-v1": "npm:@langchain/openai@1.3.0",
     "langchain-openai-v1-latest": "npm:@langchain/openai@1.5.3"
-  },
-  "pnpm": {
-    "overrides": {
-      "langsmith@<0.3.30": "^0.3.30",
-      "uuid": "^11.1.1"
-    }
   }
 }
diff --git a/e2e/scenarios/wrap-langchain-js-traces/pnpm-lock.yaml b/e2e/scenarios/wrap-langchain-js-traces/pnpm-lock.yaml
index 5dcbf1544..632a2c8cb 100644
--- a/e2e/scenarios/wrap-langchain-js-traces/pnpm-lock.yaml
+++ b/e2e/scenarios/wrap-langchain-js-traces/pnpm-lock.yaml
@@ -12,18 +12,18 @@ importers:
 
   .:
     dependencies:
-      langchain-core-v1-latest:
-        specifier: npm:@langchain/core@1.2.1
-        version: '@langchain/core@1.2.1(openai@6.45.0(zod@3.25.76))'
       langchain-core-v1:
         specifier: npm:@langchain/core@1.1.35
         version: '@langchain/core@1.1.35(openai@6.45.0(zod@3.25.76))'
-      langchain-openai-v1-latest:
-        specifier: npm:@langchain/openai@1.5.3
-        version: '@langchain/openai@1.5.3(@langchain/core@1.2.1(openai@6.45.0(zod@3.25.76)))'
+      langchain-core-v1-latest:
+        specifier: npm:@langchain/core@1.2.1
+        version: '@langchain/core@1.2.1(openai@6.45.0(zod@3.25.76))'
       langchain-openai-v1:
         specifier: npm:@langchain/openai@1.3.0
         version: '@langchain/openai@1.3.0(@langchain/core@1.2.1(openai@6.45.0(zod@3.25.76)))'
+      langchain-openai-v1-latest:
+        specifier: npm:@langchain/openai@1.5.3
+        version: '@langchain/openai@1.5.3(@langchain/core@1.2.1(openai@6.45.0(zod@3.25.76)))'
       zod:
         specifier: 3.25.76
         version: 3.25.76
diff --git a/e2e/scenarios/wrap-langchain-js-traces/pnpm-workspace.yaml b/e2e/scenarios/wrap-langchain-js-traces/pnpm-workspace.yaml
new file mode 100644
index 000000000..9f89d3b5c
--- /dev/null
+++ b/e2e/scenarios/wrap-langchain-js-traces/pnpm-workspace.yaml
@@ -0,0 +1,3 @@
+overrides:
+  langsmith@<0.3.30: ^0.3.30
+  uuid: ^11.1.1
diff --git a/integrations/otel-js/otel-v1/package.json b/integrations/otel-js/otel-v1/package.json
index ff0a41801..66fdb0267 100644
--- a/integrations/otel-js/otel-v1/package.json
+++ b/integrations/otel-js/otel-v1/package.json
@@ -41,26 +41,5 @@
     "tsup": "^8.5.0",
     "typescript": "5.5.4",
     "vitest": "4.1.5"
-  },
-  "pnpm": {
-    "overrides": {
-      "protobufjs": "^7.6.5",
-      "body-parser@>=2.0.0 <2.3.0": "^2.3.0",
-      "uuid": "^11.1.1",
-      "qs@>=6.7.0 <6.15.2": "^6.15.2",
-      "fast-uri@<3.1.4": "^3.1.4",
-      "path-to-regexp@<0.1.13": "^0.1.13",
-      "vite@>=8.0.0 <8.0.5": "^8.0.5",
-      "vite@>=7.0.0 <7.3.2": "^7.3.2",
-      "vite@>=6.0.0 <6.4.2": "^6.4.2",
-      "vite@>=5.0.0 <6.0.0": "^5.4.21",
-      "postcss@<8.5.10": "^8.5.10",
-      "picomatch@<2.3.2": "^2.3.2",
-      "picomatch@>=3.0.0 <3.0.2": "^3.0.2",
-      "picomatch@>=4.0.0 <4.0.4": "^4.0.4",
-      "brace-expansion@<1.1.16": "^1.1.16",
-      "brace-expansion@>=2.0.0 <2.1.2": "^2.1.2",
-      "brace-expansion@>=3.0.0 <5.0.7": "^5.0.7"
-    }
   }
 }
diff --git a/integrations/otel-js/otel-v1/pnpm-workspace.yaml b/integrations/otel-js/otel-v1/pnpm-workspace.yaml
new file mode 100644
index 000000000..8fe2e0ed1
--- /dev/null
+++ b/integrations/otel-js/otel-v1/pnpm-workspace.yaml
@@ -0,0 +1,18 @@
+overrides:
+  protobufjs: ^7.6.5
+  body-parser@>=2.0.0 <2.3.0: ^2.3.0
+  uuid: ^11.1.1
+  qs@>=6.7.0 <6.15.2: ^6.15.2
+  fast-uri@<3.1.4: ^3.1.4
+  path-to-regexp@<0.1.13: ^0.1.13
+  vite@>=8.0.0 <8.0.5: ^8.0.5
+  vite@>=7.0.0 <7.3.2: ^7.3.2
+  vite@>=6.0.0 <6.4.2: ^6.4.2
+  vite@>=5.0.0 <6.0.0: ^5.4.21
+  postcss@<8.5.10: ^8.5.10
+  picomatch@<2.3.2: ^2.3.2
+  picomatch@>=3.0.0 <3.0.2: ^3.0.2
+  picomatch@>=4.0.0 <4.0.4: ^4.0.4
+  brace-expansion@<1.1.16: ^1.1.16
+  brace-expansion@>=2.0.0 <2.1.2: ^2.1.2
+  brace-expansion@>=3.0.0 <5.0.7: ^5.0.7
diff --git a/integrations/otel-js/otel-v2/package.json b/integrations/otel-js/otel-v2/package.json
index 6ffa2bb8f..3ae9eddd6 100644
--- a/integrations/otel-js/otel-v2/package.json
+++ b/integrations/otel-js/otel-v2/package.json
@@ -39,26 +39,5 @@
     "tsup": "^8.5.0",
     "typescript": "5.5.4",
     "vitest": "4.1.5"
-  },
-  "pnpm": {
-    "overrides": {
-      "protobufjs": "^7.6.5",
-      "body-parser@>=2.0.0 <2.3.0": "^2.3.0",
-      "uuid": "^11.1.1",
-      "qs@>=6.7.0 <6.15.2": "^6.15.2",
-      "fast-uri@<3.1.4": "^3.1.4",
-      "path-to-regexp@<0.1.13": "^0.1.13",
-      "vite@>=8.0.0 <8.0.5": "^8.0.5",
-      "vite@>=7.0.0 <7.3.2": "^7.3.2",
-      "vite@>=6.0.0 <6.4.2": "^6.4.2",
-      "vite@>=5.0.0 <6.0.0": "^5.4.21",
-      "postcss@<8.5.10": "^8.5.10",
-      "picomatch@<2.3.2": "^2.3.2",
-      "picomatch@>=3.0.0 <3.0.2": "^3.0.2",
-      "picomatch@>=4.0.0 <4.0.4": "^4.0.4",
-      "brace-expansion@<1.1.16": "^1.1.16",
-      "brace-expansion@>=2.0.0 <2.1.2": "^2.1.2",
-      "brace-expansion@>=3.0.0 <5.0.7": "^5.0.7"
-    }
   }
 }
diff --git a/integrations/otel-js/otel-v2/pnpm-workspace.yaml b/integrations/otel-js/otel-v2/pnpm-workspace.yaml
new file mode 100644
index 000000000..8fe2e0ed1
--- /dev/null
+++ b/integrations/otel-js/otel-v2/pnpm-workspace.yaml
@@ -0,0 +1,18 @@
+overrides:
+  protobufjs: ^7.6.5
+  body-parser@>=2.0.0 <2.3.0: ^2.3.0
+  uuid: ^11.1.1
+  qs@>=6.7.0 <6.15.2: ^6.15.2
+  fast-uri@<3.1.4: ^3.1.4
+  path-to-regexp@<0.1.13: ^0.1.13
+  vite@>=8.0.0 <8.0.5: ^8.0.5
+  vite@>=7.0.0 <7.3.2: ^7.3.2
+  vite@>=6.0.0 <6.4.2: ^6.4.2
+  vite@>=5.0.0 <6.0.0: ^5.4.21
+  postcss@<8.5.10: ^8.5.10
+  picomatch@<2.3.2: ^2.3.2
+  picomatch@>=3.0.0 <3.0.2: ^3.0.2
+  picomatch@>=4.0.0 <4.0.4: ^4.0.4
+  brace-expansion@<1.1.16: ^1.1.16
+  brace-expansion@>=2.0.0 <2.1.2: ^2.1.2
+  brace-expansion@>=3.0.0 <5.0.7: ^5.0.7
diff --git a/package.json b/package.json
index a29ec1039..0f51a96b9 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,7 @@
     "yalc:publish": "turbo run yalc:publish"
   },
   "engines": {
-    "pnpm": ">=10.27.0",
+    "pnpm": ">=11.9.0",
     "npm": "please-use-pnpm",
     "yarn": "please-use-pnpm"
   },
@@ -56,38 +56,5 @@
   "lint-staged": {
     "**/*.{js,jsx,ts,tsx,mjs,cjs,css,md,mdx,html,yaml,yml,json}": "prettier --write"
   },
-  "packageManager": "pnpm@10.33.0",
-  "pnpm": {
-    "overrides": {
-      "handlebars": "^4.7.9",
-      "protobufjs": "^7.6.5",
-      "body-parser@>=2.0.0 <2.3.0": "^2.3.0",
-      "brace-expansion@<1.1.16": "^1.1.16",
-      "brace-expansion@>=2.0.0 <2.1.2": "^2.1.2",
-      "brace-expansion@>=3.0.0 <5.0.7": "^5.0.7",
-      "esbuild": "0.28.1",
-      "uuid": "11.1.1",
-      "router@2.2.0>path-to-regexp": "8.4.0",
-      "express@5.2.1>qs": "6.15.2",
-      "qs@>=6.7.0 <6.15.2": "^6.15.2",
-      "tar@>=7.0.0 <7.5.19": "^7.5.19",
-      "tar@>=6.0.0 <7.0.0": "^6.2.1",
-      "hono@>=4.0.0 <4.12.27": "^4.12.27",
-      "flatted@<3.4.2": "^3.4.2",
-      "markdown-it@>=13.0.0 <14.1.1": "^14.1.1",
-      "ip-address@<10.1.1": "^10.1.1",
-      "js-yaml@>=4.0.0 <4.3.0": "^4.3.0",
-      "js-yaml@>=3.0.0 <3.15.0": "^3.15.0",
-      "@mikro-orm/knex@>=6.0.0 <6.6.14": "^6.6.14",
-      "glob@>=10.2.0 <10.5.0": "^10.5.0",
-      "fast-uri@<3.1.4": "^3.1.4",
-      "linkify-it@<5.0.2": "^5.0.2"
-    },
-    "ignoredBuiltDependencies": [
-      "@swc/core",
-      "esbuild",
-      "msw",
-      "protobufjs"
-    ]
-  }
+  "packageManager": "pnpm@11.9.0"
 }
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index dd63d0ea2..7dc2678f3 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -11,6 +11,35 @@ minimumReleaseAge: 4320 # 3 days (in minutes)
 minimumReleaseAgeExclude:
   - "@braintrust/bt-*" # bt binary packages, published in lockstep with braintrust
 trustPolicy: no-downgrade
-# Ignore the check for packages published more than 30 days ago (pnpm 10.27+)
+# Ignore the check for packages published more than 30 days ago.
 # Useful for older packages that pre-date provenance support
 trustPolicyIgnoreAfter: 43200 # minutes (30 days)
+allowBuilds:
+  "@swc/core": false
+  esbuild: false
+  msw: false
+  protobufjs: false
+overrides:
+  handlebars: ^4.7.9
+  protobufjs: ^7.6.5
+  body-parser@>=2.0.0 <2.3.0: ^2.3.0
+  brace-expansion@<1.1.16: ^1.1.16
+  brace-expansion@>=2.0.0 <2.1.2: ^2.1.2
+  brace-expansion@>=3.0.0 <5.0.7: ^5.0.7
+  esbuild: 0.28.1
+  uuid: 11.1.1
+  router@2.2.0>path-to-regexp: 8.4.0
+  express@5.2.1>qs: 6.15.2
+  qs@>=6.7.0 <6.15.2: ^6.15.2
+  tar@>=7.0.0 <7.5.19: ^7.5.19
+  tar@>=6.0.0 <7.0.0: ^6.2.1
+  hono@>=4.0.0 <4.12.27: ^4.12.27
+  flatted@<3.4.2: ^3.4.2
+  markdown-it@>=13.0.0 <14.1.1: ^14.1.1
+  ip-address@<10.1.1: ^10.1.1
+  js-yaml@>=4.0.0 <4.3.0: ^4.3.0
+  js-yaml@>=3.0.0 <3.15.0: ^3.15.0
+  "@mikro-orm/knex@>=6.0.0 <6.6.14": ^6.6.14
+  glob@>=10.2.0 <10.5.0: ^10.5.0
+  fast-uri@<3.1.4: ^3.1.4
+  linkify-it@<5.0.2: ^5.0.2
diff --git a/scripts/release/_shared.mjs b/scripts/release/_shared.mjs
index f9f2186ea..95cceb485 100644
--- a/scripts/release/_shared.mjs
+++ b/scripts/release/_shared.mjs
@@ -65,7 +65,7 @@ export function getApprovedPackageByName(name) {
   return PUBLISHABLE_PACKAGE_MAP.get(name);
 }
 
-export function escapeRegExp(value) {
+function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
@@ -191,6 +191,97 @@ export function formatPackageList(packages) {
   return packages.map((pkg) => `- ${pkg.name}@${pkg.version}`).join("\n");
 }
 
+export function extractReleaseNotes(relativeDir, packageName, version) {
+  const fallback = `Published ${packageName}@${version}.`;
+  const changelogPath = repoPath(relativeDir, "CHANGELOG.md");
+  if (!existsSync(changelogPath)) {
+    return fallback;
+  }
+
+  const changelog = readFileSync(changelogPath, "utf8");
+  const heading = new RegExp(`^##\\s+${escapeRegExp(version)}\\s*$`, "m");
+  const match = heading.exec(changelog);
+  if (!match) {
+    return fallback;
+  }
+
+  const afterHeading = changelog.slice(match.index);
+  const nextHeading = afterHeading.slice(match[0].length).search(/^##\s+/m);
+  const section =
+    nextHeading === -1
+      ? afterHeading
+      : afterHeading.slice(0, match[0].length + nextHeading);
+
+  return `# ${packageName}\n\n${section.trim()}`;
+}
+
+export function packageArtifactBase(name, version) {
+  return `${name.replace(/^@/, "").replace(/[\\/@]/g, "-")}-${version}`;
+}
+
+export function orderPackagesForPublish(packages) {
+  const packageMap = new Map(
+    packages.map((pkg) => [
+      pkg.name,
+      { ...pkg, packageJson: readPackage(pkg.dir) },
+    ]),
+  );
+  const visiting = new Set();
+  const visited = new Set();
+  const ordered = [];
+
+  function visit(pkg) {
+    if (visited.has(pkg.name)) {
+      return;
+    }
+
+    if (visiting.has(pkg.name)) {
+      throw new Error(
+        `Detected a publish dependency cycle involving ${pkg.name}`,
+      );
+    }
+
+    visiting.add(pkg.name);
+
+    for (const dependencyName of getWorkspaceReleaseDependencies(
+      pkg.packageJson,
+    )) {
+      const dependency = packageMap.get(dependencyName);
+      if (dependency) {
+        visit(dependency);
+      }
+    }
+
+    visiting.delete(pkg.name);
+    visited.add(pkg.name);
+    ordered.push(pkg);
+  }
+
+  for (const pkg of packageMap.values()) {
+    visit(pkg);
+  }
+
+  return ordered.map(({ packageJson: _packageJson, ...pkg }) => pkg);
+}
+
+function getWorkspaceReleaseDependencies(packageJson) {
+  const dependencyNames = new Set();
+
+  for (const field of [
+    "dependencies",
+    "optionalDependencies",
+    "peerDependencies",
+    "devDependencies",
+  ]) {
+    for (const dependencyName of Object.keys(packageJson[field] ?? {})) {
+      dependencyNames.add(dependencyName);
+    }
+  }
+
+  dependencyNames.delete(packageJson.name);
+  return dependencyNames;
+}
+
 export function isPublishedToNpm(name, version) {
   const result = spawnSync(
     "npm",
diff --git a/scripts/release/comment-release-issues.mjs b/scripts/release/comment-release-issues.mjs
index 37a31944a..8b3b48ef1 100644
--- a/scripts/release/comment-release-issues.mjs
+++ b/scripts/release/comment-release-issues.mjs
@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 
 const { packages = [] } = JSON.parse(
@@ -123,6 +124,15 @@ let posted = 0;
 for (const [issueNumber, comment] of [...issueComments].sort(
   ([left], [right]) => left - right,
 )) {
+  const releaseTags = [...comment.releases.keys()].sort();
+  const marker = `<!-- braintrust-release-${createHash("sha256")
+    .update(releaseTags.join("\0"))
+    .digest("hex")} -->`;
+  if (await hasReleaseComment(issueNumber, marker)) {
+    console.log(`Issue #${issueNumber} already has this release comment.`);
+    continue;
+  }
+
   const releases = [...comment.releases.values()]
     .sort((left, right) => left.label.localeCompare(right.label))
     .map((release) => `- [${release.label}](${release.url})`)
@@ -141,7 +151,9 @@ for (const [issueNumber, comment] of [...issueComments].sort(
 
 ${releases}
 
-Included via ${pullRequests}.`,
+Included via ${pullRequests}.
+
+${marker}`,
       }),
     },
   );
@@ -151,6 +163,27 @@ Included via ${pullRequests}.`,
 
 console.log(`Posted ${posted} release issue comment(s).`);
 
+async function hasReleaseComment(issueNumber, marker) {
+  for (let page = 1; ; page += 1) {
+    const response = await fetchGithub(
+      `/repos/braintrustdata/braintrust-sdk-javascript/issues/${issueNumber}/comments?per_page=100&page=${page}`,
+      { method: "GET" },
+    );
+    const comments = await response.json();
+    if (!Array.isArray(comments)) {
+      throw new Error(
+        `Expected an array of comments for issue #${issueNumber}`,
+      );
+    }
+    if (comments.some((comment) => comment.body?.includes(marker))) {
+      return true;
+    }
+    if (comments.length < 100) {
+      return false;
+    }
+  }
+}
+
 async function fetchGithub(endpoint, options) {
   const response = await fetch(`https://api.github.com${endpoint}`, {
     method: options.method,
diff --git a/scripts/release/create-github-releases.mjs b/scripts/release/create-github-releases.mjs
deleted file mode 100644
index 3975ebcf3..000000000
--- a/scripts/release/create-github-releases.mjs
+++ /dev/null
@@ -1,96 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-
-import { escapeRegExp, parseArgs } from "./_shared.mjs";
-
-const args = parseArgs();
-const manifestPath = args.manifest ?? ".release-manifest.json";
-const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-const token = process.env.GITHUB_TOKEN;
-const repository = process.env.GITHUB_REPOSITORY;
-
-if (!token || !repository) {
-  throw new Error("GITHUB_TOKEN and GITHUB_REPOSITORY must be set");
-}
-
-if ((manifest.packages ?? []).length === 0) {
-  console.log("No GitHub releases to create.");
-  process.exit(0);
-}
-
-for (const pkg of manifest.packages) {
-  const tag = pkg.tag ?? `${pkg.name}@${pkg.version}`;
-  const existing = await fetchGithub(
-    `/repos/${repository}/releases/tags/${encodeURIComponent(tag)}`,
-    token,
-    { method: "GET", allow404: true },
-  );
-
-  if (existing.status === 200) {
-    console.log(`GitHub release already exists for ${tag}`);
-    continue;
-  }
-
-  await fetchGithub(`/repos/${repository}/releases`, token, {
-    method: "POST",
-    body: JSON.stringify({
-      tag_name: tag,
-      name: tag,
-      body: extractReleaseNotes(pkg.dir, pkg.name, pkg.version),
-      draft: false,
-      prerelease: false,
-      generate_release_notes: false,
-    }),
-  });
-
-  console.log(`Created GitHub release for ${tag}`);
-}
-
-function extractReleaseNotes(relativeDir, packageName, version) {
-  const changelogPath = `${relativeDir}/CHANGELOG.md`;
-  if (!existsSync(changelogPath)) {
-    return `Published ${packageName}@${version}.`;
-  }
-
-  const changelog = readFileSync(changelogPath, "utf8");
-  const heading = new RegExp(`^##\\s+${escapeRegExp(version)}\\s*$`, "m");
-  const match = heading.exec(changelog);
-  if (!match) {
-    return `Published ${packageName}@${version}.`;
-  }
-
-  const start = match.index;
-  const afterHeading = changelog.slice(start);
-  const nextHeading = afterHeading.slice(match[0].length).search(/^##\s+/m);
-  const section =
-    nextHeading === -1
-      ? afterHeading
-      : afterHeading.slice(0, match[0].length + nextHeading);
-
-  return `# ${packageName}\n\n${section.trim()}`;
-}
-
-async function fetchGithub(endpoint, authToken, options) {
-  const response = await fetch(`https://api.github.com${endpoint}`, {
-    method: options.method,
-    headers: {
-      Accept: "application/vnd.github+json",
-      Authorization: `Bearer ${authToken}`,
-      "Content-Type": "application/json",
-      "X-GitHub-Api-Version": "2022-11-28",
-    },
-    body: options.body,
-  });
-
-  if (options.allow404 && response.status === 404) {
-    return response;
-  }
-
-  if (!response.ok) {
-    const body = await response.text();
-    throw new Error(
-      `${options.method} ${endpoint} failed: ${response.status} ${body}`,
-    );
-  }
-
-  return response;
-}
diff --git a/scripts/release/pack-publishable-packages.mjs b/scripts/release/pack-publishable-packages.mjs
index fe73eeff8..be10bed68 100644
--- a/scripts/release/pack-publishable-packages.mjs
+++ b/scripts/release/pack-publishable-packages.mjs
@@ -1,11 +1,23 @@
 import { execFileSync } from "node:child_process";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  mkdtempSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import os from "node:os";
 import path from "node:path";
 
 import {
   PUBLISHABLE_PACKAGES,
   appendSummary,
+  orderPackagesForPublish,
+  packageArtifactBase,
   parseArgs,
+  readPackage,
   repoPath,
 } from "./_shared.mjs";
 
@@ -16,40 +28,74 @@ const reportPath =
   args.report ?? path.posix.join(outputDir, "pack-report.json");
 
 const targets = getTargets(manifestPath);
-mkdirSync(repoPath(outputDir), { recursive: true });
-
-const tarballs = [];
-for (const target of targets) {
-  const relativeOutputDir = path.posix.relative(target.dir, outputDir);
-  const tarball = execFileSync(
-    "npm",
-    ["pack", "--pack-destination", relativeOutputDir],
-    {
-      cwd: repoPath(target.dir),
-      encoding: "utf8",
-    },
-  ).trim();
-
-  tarballs.push({
-    name: target.name,
-    dir: target.dir,
-    version: target.version,
-    tarball,
-  });
-}
+const absoluteOutputDir = repoPath(outputDir);
+mkdirSync(absoluteOutputDir, { recursive: true });
+
+const artifacts = targets.map(packPackage);
 
 writeFileSync(
   repoPath(reportPath),
-  `${JSON.stringify({ tarballs }, null, 2)}\n`,
+  `${JSON.stringify({ artifacts }, null, 2)}\n`,
   "utf8",
 );
-console.log(`Packed ${tarballs.length} package(s) into ${outputDir}`);
+console.log(`Packed ${artifacts.length} package(s) into ${outputDir}`);
 appendSummary(
-  `## Packed publishable packages\n\n${tarballs
-    .map((entry) => `- ${entry.name}@${entry.version}: ${entry.tarball}`)
+  `## Packed publishable packages\n\n${artifacts
+    .map(
+      (entry) =>
+        `- ${entry.name}@${entry.version}: ${entry.tarball}, ${entry.sbom}`,
+    )
     .join("\n")}`,
 );
 
+function packPackage(target) {
+  const packDir = mkdtempSync(path.join(os.tmpdir(), "braintrust-pack-"));
+  try {
+    runPnpm(["pack", "--pack-destination", packDir], {
+      cwd: repoPath(target.dir),
+    });
+
+    const packedTarballs = readdirSync(packDir).filter((file) =>
+      file.endsWith(".tgz"),
+    );
+    if (packedTarballs.length !== 1) {
+      throw new Error(
+        `Expected pnpm pack for ${target.name} to create one tarball, found ${packedTarballs.length}`,
+      );
+    }
+
+    const tarballAsset =
+      target.tarball_asset ??
+      `${packageArtifactBase(target.name, target.version)}.tgz`;
+    const sbomAsset =
+      target.sbom_asset ??
+      `${packageArtifactBase(target.name, target.version)}.sbom.json`;
+    for (const asset of [tarballAsset, sbomAsset]) {
+      if (path.basename(asset) !== asset) {
+        throw new Error(`Release artifact must be a basename: ${asset}`);
+      }
+    }
+
+    const tarballPath = path.join(absoluteOutputDir, tarballAsset);
+    const sbomPath = path.join(absoluteOutputDir, sbomAsset);
+    renameSync(path.join(packDir, packedTarballs[0]), tarballPath);
+    runPnpm(
+      ["sbom", "--sbom-format", "cyclonedx", "--prod", "--out", sbomPath],
+      { cwd: repoPath(target.dir) },
+    );
+
+    return {
+      name: target.name,
+      dir: target.dir,
+      version: target.version,
+      tarball: path.relative(repoPath(), tarballPath),
+      sbom: path.relative(repoPath(), sbomPath),
+    };
+  } finally {
+    rmSync(packDir, { force: true, recursive: true });
+  }
+}
+
 function getTargets(maybeManifestPath) {
   if (!maybeManifestPath) {
     return PUBLISHABLE_PACKAGES.map((pkg) =>
@@ -57,26 +103,34 @@ function getTargets(maybeManifestPath) {
     );
   }
 
-  const manifest = JSON.parse(
+  const releaseManifest = JSON.parse(
     readFileSync(repoPath(maybeManifestPath), "utf8"),
   );
-  return manifest.packages.map((pkg) => readPackageInfo(pkg.dir, pkg.name));
+  return orderPackagesForPublish(releaseManifest.packages ?? []).map((pkg) =>
+    readPackageInfo(pkg.dir, pkg.name, pkg),
+  );
 }
 
-function readPackageInfo(relativeDir, expectedName) {
-  const manifest = JSON.parse(
-    readFileSync(repoPath(relativeDir, "package.json"), "utf8"),
-  );
+function readPackageInfo(relativeDir, expectedName, releasePackage = {}) {
+  const packageJson = readPackage(relativeDir);
 
-  if (manifest.name !== expectedName) {
+  if (packageJson.name !== expectedName) {
     throw new Error(
-      `Expected ${relativeDir} to be ${expectedName}, found ${manifest.name}`,
+      `Expected ${relativeDir} to be ${expectedName}, found ${packageJson.name}`,
     );
   }
 
   return {
+    ...releasePackage,
     dir: relativeDir,
-    name: manifest.name,
-    version: manifest.version,
+    name: packageJson.name,
+    version: packageJson.version,
   };
 }
+
+function runPnpm(pnpmArgs, options) {
+  execFileSync("pnpm", pnpmArgs, {
+    ...options,
+    stdio: "inherit",
+  });
+}
diff --git a/scripts/release/publish-release-manifest.mjs b/scripts/release/publish-release-manifest.mjs
index 22631221a..44500a5dd 100644
--- a/scripts/release/publish-release-manifest.mjs
+++ b/scripts/release/publish-release-manifest.mjs
@@ -3,6 +3,7 @@ import { readFileSync } from "node:fs";
 
 import {
   isPublishedToNpm,
+  orderPackagesForPublish,
   parseArgs,
   readPackage,
   repoPath,
@@ -49,66 +50,3 @@ for (const pkg of packages) {
     stdio: "inherit",
   });
 }
-
-function orderPackagesForPublish(packages) {
-  const packageMap = new Map(
-    packages.map((pkg) => [
-      pkg.name,
-      { ...pkg, manifest: readPackage(pkg.dir) },
-    ]),
-  );
-  const visiting = new Set();
-  const visited = new Set();
-  const ordered = [];
-
-  for (const pkg of packageMap.values()) {
-    visit(pkg);
-  }
-
-  return ordered.map(({ manifest: _manifest, ...pkg }) => pkg);
-
-  function visit(pkg) {
-    if (visited.has(pkg.name)) {
-      return;
-    }
-
-    if (visiting.has(pkg.name)) {
-      throw new Error(
-        `Detected a publish dependency cycle involving ${pkg.name}`,
-      );
-    }
-
-    visiting.add(pkg.name);
-
-    for (const dependencyName of getWorkspaceReleaseDependencies(
-      pkg.manifest,
-    )) {
-      const dependency = packageMap.get(dependencyName);
-      if (dependency) {
-        visit(dependency);
-      }
-    }
-
-    visiting.delete(pkg.name);
-    visited.add(pkg.name);
-    ordered.push(pkg);
-  }
-}
-
-function getWorkspaceReleaseDependencies(manifest) {
-  const dependencyNames = new Set();
-
-  for (const field of [
-    "dependencies",
-    "optionalDependencies",
-    "peerDependencies",
-    "devDependencies",
-  ]) {
-    for (const dependencyName of Object.keys(manifest[field] ?? {})) {
-      dependencyNames.add(dependencyName);
-    }
-  }
-
-  dependencyNames.delete(manifest.name);
-  return dependencyNames;
-}
diff --git a/scripts/release/release-manifest.mjs b/scripts/release/release-manifest.mjs
index 65f6e4a8a..23247e29d 100644
--- a/scripts/release/release-manifest.mjs
+++ b/scripts/release/release-manifest.mjs
@@ -1,13 +1,16 @@
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 import { readFileSync, writeFileSync } from "node:fs";
 
 import {
   PUBLISHABLE_PACKAGES,
+  extractReleaseNotes,
   filterPublishableReleases,
   formatPackageList,
   getApprovedPackageByName,
   getReleaseTag,
   isPublishedToNpm,
+  orderPackagesForPublish,
+  packageArtifactBase,
   parseArgs,
   readPackage,
   writeGithubOutput,
@@ -99,50 +102,129 @@ function handleStableManifest({
   outputPath: currentOutputPath,
   title: currentTitle,
 }) {
-  const packages = getUnpublishedPackages();
+  const packages = orderPackagesForPublish(getStableReleasePackages());
   const hasWork = packages.length > 0;
-
-  writeManifestFile(currentOutputPath, {
+  const releaseManifest = {
     mode: currentMode,
     commit: headCommit,
     packages,
-  });
+  };
+
+  writeManifestFile(currentOutputPath, releaseManifest);
 
   const markdownList = packagesToMarkdown(packages);
   const plainList = packagesToPlain(packages);
 
   writeGithubOutput("has_work", hasWork);
-  writeGithubOutput("needs_publish", hasWork);
+  writeGithubOutput("needs_artifacts", hasWork);
   writeGithubOutput("package_count", packages.length);
+  writeGithubOutput("manifest_json", JSON.stringify(releaseManifest));
   writeGithubOutput("title", currentTitle);
   writeGithubOutput("markdown", markdownList);
   writeGithubOutput("plain", plainList);
 
   if (!hasWork) {
-    console.log("No unpublished package versions were found at this ref.");
+    console.log("No stable release work was found at this ref.");
     process.exit(0);
   }
 
   console.log(
-    `Stable release work detected for ${packages.length} unpublished package version(s):\n${formatPackageList(packages)}`,
+    `Stable release work detected for ${packages.length} package version(s):\n${formatPackageList(packages)}`,
   );
 }
 
-function getUnpublishedPackages() {
-  return PUBLISHABLE_PACKAGES.map((approved) => {
-    const manifest = readPackage(approved.dir);
-    if (isPublishedToNpm(manifest.name, manifest.version)) {
-      return null;
+function getStableReleasePackages() {
+  const packages = [];
+
+  for (const approvedPackage of PUBLISHABLE_PACKAGES) {
+    const packageJson = readPackage(approvedPackage.dir);
+    const alreadyPublished = isPublishedToNpm(
+      packageJson.name,
+      packageJson.version,
+    );
+    const tag = getReleaseTag(packageJson.name, packageJson.version);
+    const tagCommit = getTagCommit(tag);
+
+    if (tagCommit && tagCommit !== headCommit) {
+      if (!alreadyPublished) {
+        throw new Error(
+          `${tag} points to ${tagCommit}, but ${packageJson.name}@${packageJson.version} is not published`,
+        );
+      }
+      continue;
     }
 
-    return {
-      dir: approved.dir,
-      name: manifest.name,
-      version: manifest.version,
-      tag: getReleaseTag(manifest.name, manifest.version),
-      published: false,
-    };
-  }).filter(Boolean);
+    packages.push(
+      buildStablePackageEntry(
+        approvedPackage.dir,
+        packageJson,
+        alreadyPublished,
+      ),
+    );
+  }
+
+  return packages;
+}
+
+function getTagCommit(tag) {
+  const tagRef = `refs/tags/${tag}`;
+  const tagExists = spawnSync(
+    "git",
+    ["show-ref", "--verify", "--quiet", tagRef],
+    {
+      encoding: "utf8",
+    },
+  );
+  if (tagExists.error) {
+    throw tagExists.error;
+  }
+  if (tagExists.status === 1) {
+    return null;
+  }
+  if (tagExists.status !== 0) {
+    throw new Error(`Failed to inspect release tag ${tag}`);
+  }
+
+  return execFileSync("git", ["rev-list", "-n", "1", tagRef], {
+    encoding: "utf8",
+  }).trim();
+}
+
+function buildStablePackageEntry(dir, packageJson, alreadyPublished) {
+  const tag = getReleaseTag(packageJson.name, packageJson.version);
+  const artifactBase = packageArtifactBase(
+    packageJson.name,
+    packageJson.version,
+  );
+  const channel = "latest";
+  const npmVersionUrl = `https://www.npmjs.com/package/${encodeURIComponent(packageJson.name)}/v/${packageJson.version}`;
+
+  return {
+    dir,
+    name: packageJson.name,
+    version: packageJson.version,
+    label: packageJson.name,
+    tag,
+    tarball_asset: `${artifactBase}.tgz`,
+    sbom_asset: `${artifactBase}.sbom.json`,
+    release_title: tag,
+    release_body: extractReleaseNotes(
+      dir,
+      packageJson.name,
+      packageJson.version,
+    ),
+    channel,
+    provenance: packageJson.publishConfig?.provenance ?? true,
+    registries: {
+      npm: {
+        name: packageJson.name,
+        version: packageJson.version,
+        version_url: npmVersionUrl,
+        channel,
+        already_published: alreadyPublished,
+      },
+    },
+  };
 }
 
 function writeManifestFile(currentOutputPath, manifest) {

From 480f9c13f685a8508c186e7598eebada918c37c0 Mon Sep 17 00:00:00 2001
From: lforst <8118419+lforst@users.noreply.github.com>
Date: Tue, 28 Jul 2026 14:51:29 +0000
Subject: [PATCH 2/4] Update PR #2301

---
 .changeset/streamlined-release-actions.md     |  4 ++
 .tool-versions                                |  2 +-
 e2e/Dockerfile.canary                         |  2 +-
 e2e/Dockerfile.e2e-bump                       |  2 +-
 e2e/helpers/scenario-installer.ts             | 18 +--------
 .../docker-sandbox.mjs                        |  2 +-
 .../ai-sdk-instrumentation/package.json       |  8 ++++
 .../pnpm-workspace.yaml                       |  5 ---
 e2e/scenarios/ai-sdk-otel-export/package.json |  8 ++++
 .../ai-sdk-otel-export/pnpm-workspace.yaml    |  5 ---
 .../package.json                              |  5 +++
 .../pnpm-workspace.yaml                       |  2 -
 .../cohere-instrumentation/package.json       |  6 +++
 .../cohere-instrumentation/pnpm-lock.yaml     | 10 ++---
 .../pnpm-workspace.yaml                       |  3 --
 .../cursor-sdk-instrumentation/package.json   |  9 +++++
 .../cursor-sdk-instrumentation/pnpm-lock.yaml |  4 +-
 .../pnpm-workspace.yaml                       |  5 ---
 .../flue-instrumentation/package.json         |  7 ++++
 .../flue-instrumentation/pnpm-workspace.yaml  |  4 --
 .../versions/v1/package.json                  |  7 ++++
 .../versions/v1/pnpm-workspace.yaml           |  4 --
 .../genkit-instrumentation/package.json       | 12 ++++++
 .../pnpm-workspace.yaml                       |  9 -----
 .../package.json                              |  5 +++
 .../pnpm-lock.yaml                            |  4 +-
 .../pnpm-workspace.yaml                       |  2 -
 .../google-adk-instrumentation/package.json   | 17 +++++++++
 .../pnpm-workspace.yaml                       | 14 -------
 .../google-genai-instrumentation/package.json |  6 +++
 .../pnpm-lock.yaml                            | 10 ++---
 .../pnpm-workspace.yaml                       |  3 --
 .../package.json                              |  6 +++
 .../pnpm-lock.yaml                            | 18 ++++-----
 .../pnpm-workspace.yaml                       |  3 --
 .../mastra-instrumentation/package.json       | 10 +++++
 .../pnpm-workspace.yaml                       |  7 ----
 .../mistral-instrumentation/package.json      |  5 +++
 .../pnpm-workspace.yaml                       |  2 -
 .../versions/next-14/package.json             |  5 +++
 .../versions/next-14/pnpm-workspace.yaml      |  2 -
 .../versions/next-16/package.json             |  5 +++
 .../versions/next-16/pnpm-workspace.yaml      |  4 --
 .../nextjs-instrumentation/package.json       |  6 +++
 .../pnpm-workspace.yaml                       |  3 --
 .../package.json                              |  9 +++++
 .../pnpm-workspace.yaml                       |  6 ---
 .../package.json                              |  6 +++
 .../pnpm-workspace.yaml                       |  3 --
 .../wrap-langchain-js-traces/package.json     |  6 +++
 .../wrap-langchain-js-traces/pnpm-lock.yaml   | 12 +++---
 .../pnpm-workspace.yaml                       |  3 --
 integrations/otel-js/otel-v1/package.json     | 21 +++++++++++
 .../otel-js/otel-v1/pnpm-workspace.yaml       | 18 ---------
 integrations/otel-js/otel-v2/package.json     | 21 +++++++++++
 .../otel-js/otel-v2/pnpm-workspace.yaml       | 18 ---------
 package.json                                  | 37 ++++++++++++++++++-
 pnpm-workspace.yaml                           | 31 +---------------
 58 files changed, 264 insertions(+), 207 deletions(-)
 create mode 100644 .changeset/streamlined-release-actions.md
 delete mode 100644 e2e/scenarios/ai-sdk-instrumentation/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/ai-sdk-otel-export/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/claude-agent-sdk-instrumentation/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/cohere-instrumentation/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/cursor-sdk-instrumentation/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/flue-instrumentation/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/flue-instrumentation/versions/v1/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/genkit-instrumentation/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/github-copilot-instrumentation/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/google-adk-instrumentation/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/google-genai-instrumentation/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/langgraph-auto-instrumentation/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/mastra-instrumentation/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/mistral-instrumentation/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/nextjs-instrumentation/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/openai-agents-instrumentation/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/strands-agent-sdk-instrumentation/pnpm-workspace.yaml
 delete mode 100644 e2e/scenarios/wrap-langchain-js-traces/pnpm-workspace.yaml
 delete mode 100644 integrations/otel-js/otel-v1/pnpm-workspace.yaml
 delete mode 100644 integrations/otel-js/otel-v2/pnpm-workspace.yaml

diff --git a/.changeset/streamlined-release-actions.md b/.changeset/streamlined-release-actions.md
new file mode 100644
index 000000000..236664f07
--- /dev/null
+++ b/.changeset/streamlined-release-actions.md
@@ -0,0 +1,4 @@
+---
+---
+
+ci: Use streamlined release actions
diff --git a/.tool-versions b/.tool-versions
index ebcb7cd34..1d471a553 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,4 +1,4 @@
 nodejs 24.15.0
 npm 11.12.1
-pnpm 11.9.0
+pnpm 10.33.0
 deno 2.7.6
diff --git a/e2e/Dockerfile.canary b/e2e/Dockerfile.canary
index df3dc00eb..d48e422ab 100644
--- a/e2e/Dockerfile.canary
+++ b/e2e/Dockerfile.canary
@@ -7,7 +7,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-RUN npm install -g pnpm@11.9.0
+RUN npm install -g pnpm@10.33.0
 
 WORKDIR /workspace
 COPY . .
diff --git a/e2e/Dockerfile.e2e-bump b/e2e/Dockerfile.e2e-bump
index c9397c365..949b67c72 100644
--- a/e2e/Dockerfile.e2e-bump
+++ b/e2e/Dockerfile.e2e-bump
@@ -7,7 +7,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     python3 \
     && rm -rf /var/lib/apt/lists/*
 
-RUN npm install -g pnpm@11.9.0
+RUN npm install -g pnpm@10.33.0
 
 WORKDIR /workspace
 COPY . .
diff --git a/e2e/helpers/scenario-installer.ts b/e2e/helpers/scenario-installer.ts
index 065ca41c7..bcb254546 100644
--- a/e2e/helpers/scenario-installer.ts
+++ b/e2e/helpers/scenario-installer.ts
@@ -47,7 +47,6 @@ const E2E_ROOT = path.resolve(HELPERS_DIR, "..");
 type ScenarioInstallInputs = {
   lockfileRaw: string;
   manifestRaw: string;
-  workspaceConfigRaw: string | null;
 };
 
 type CachedScenarioDependenciesResult =
@@ -200,14 +199,6 @@ async function readScenarioInstallInputs(
   return {
     lockfileRaw: await fs.readFile(lockfilePath, "utf8"),
     manifestRaw,
-    workspaceConfigRaw: await fs
-      .readFile(path.join(scenarioDir, "pnpm-workspace.yaml"), "utf8")
-      .catch((err: NodeJS.ErrnoException) => {
-        if (err.code === "ENOENT") {
-          return null;
-        }
-        throw err;
-      }),
   };
 }
 
@@ -227,8 +218,6 @@ function scenarioDependencyCacheKey(
   hash.update(inputs.manifestRaw);
   hash.update("\0");
   hash.update(inputs.lockfileRaw);
-  hash.update("\0");
-  hash.update(inputs.workspaceConfigRaw ?? "");
 
   return `${scenarioNameForPath(scenarioDir)}-${hash.digest("hex").slice(0, 16)}`;
 }
@@ -275,12 +264,6 @@ async function installCachedScenarioDependencies({
       path.join(stagingDir, "pnpm-lock.yaml"),
       inputs.lockfileRaw,
     );
-    // Give the staging directory its own workspace root so pnpm 11 reads any
-    // fixture-level settings without inheriting the repository workspace.
-    await fs.writeFile(
-      path.join(stagingDir, "pnpm-workspace.yaml"),
-      inputs.workspaceConfigRaw ?? "packages: []\n",
-    );
     await installScenarioDependencies({
       preferOffline,
       scenarioDir: stagingDir,
@@ -361,6 +344,7 @@ export async function installScenarioDependencies({
     "install",
     "--dir",
     scenarioDir,
+    "--ignore-workspace",
     "--frozen-lockfile",
     "--ignore-scripts=false",
     "--strict-peer-dependencies=false",
diff --git a/e2e/scenarios/ai-sdk-harness-instrumentation/docker-sandbox.mjs b/e2e/scenarios/ai-sdk-harness-instrumentation/docker-sandbox.mjs
index a34d2ac33..5112456c9 100644
--- a/e2e/scenarios/ai-sdk-harness-instrumentation/docker-sandbox.mjs
+++ b/e2e/scenarios/ai-sdk-harness-instrumentation/docker-sandbox.mjs
@@ -95,7 +95,7 @@ export async function createDockerSandbox() {
       containerName,
       "/bin/sh",
       "-lc",
-      "corepack enable pnpm && corepack install --global pnpm@11.9.0 && mkdir -p /workspace /root/.codex",
+      "corepack enable pnpm && corepack install --global pnpm@10.33.0 && mkdir -p /workspace /root/.codex",
     ]);
   }
 
diff --git a/e2e/scenarios/ai-sdk-instrumentation/package.json b/e2e/scenarios/ai-sdk-instrumentation/package.json
index 4039e9792..3bfd800a5 100644
--- a/e2e/scenarios/ai-sdk-instrumentation/package.json
+++ b/e2e/scenarios/ai-sdk-instrumentation/package.json
@@ -96,5 +96,13 @@
     "ai-sdk-openai-v7": "npm:@ai-sdk/openai@4.0.0-beta.44",
     "ai-sdk-openai-v7-latest": "npm:@ai-sdk/openai@4.0.0-beta.44",
     "ai-sdk-workflow-v1": "npm:@ai-sdk/workflow@1.0.8"
+  },
+  "pnpm": {
+    "overrides": {
+      "devalue@>=4.0.0 <5.6.4": "^5.6.4",
+      "devalue@>=5.6.3 <5.8.1": "^5.8.1",
+      "fast-uri@<3.1.4": "^3.1.4",
+      "svelte": "^5.55.7"
+    }
   }
 }
diff --git a/e2e/scenarios/ai-sdk-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/ai-sdk-instrumentation/pnpm-workspace.yaml
deleted file mode 100644
index db1d12d6c..000000000
--- a/e2e/scenarios/ai-sdk-instrumentation/pnpm-workspace.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-overrides:
-  devalue@>=4.0.0 <5.6.4: ^5.6.4
-  devalue@>=5.6.3 <5.8.1: ^5.8.1
-  fast-uri@<3.1.4: ^3.1.4
-  svelte: ^5.55.7
diff --git a/e2e/scenarios/ai-sdk-otel-export/package.json b/e2e/scenarios/ai-sdk-otel-export/package.json
index caaeb64d5..48d80f704 100644
--- a/e2e/scenarios/ai-sdk-otel-export/package.json
+++ b/e2e/scenarios/ai-sdk-otel-export/package.json
@@ -34,5 +34,13 @@
     "ai-sdk-v6-latest": "npm:ai@6.0.219",
     "ai-sdk-openai-v6": "npm:@ai-sdk/openai@3.0.7",
     "ai-sdk-openai-v6-latest": "npm:@ai-sdk/openai@3.0.80"
+  },
+  "pnpm": {
+    "overrides": {
+      "protobufjs@<7.5.8": "^7.5.8",
+      "@opentelemetry/sdk-node@<0.217.0": "^0.217.0",
+      "@opentelemetry/exporter-prometheus@<0.217.0": "^0.217.0",
+      "@opentelemetry/propagator-jaeger@<2.9.0": "^2.9.0"
+    }
   }
 }
diff --git a/e2e/scenarios/ai-sdk-otel-export/pnpm-workspace.yaml b/e2e/scenarios/ai-sdk-otel-export/pnpm-workspace.yaml
deleted file mode 100644
index d180e7164..000000000
--- a/e2e/scenarios/ai-sdk-otel-export/pnpm-workspace.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-overrides:
-  protobufjs@<7.5.8: ^7.5.8
-  "@opentelemetry/sdk-node@<0.217.0": ^0.217.0
-  "@opentelemetry/exporter-prometheus@<0.217.0": ^0.217.0
-  "@opentelemetry/propagator-jaeger@<2.9.0": ^2.9.0
diff --git a/e2e/scenarios/claude-agent-sdk-instrumentation/package.json b/e2e/scenarios/claude-agent-sdk-instrumentation/package.json
index 53c49cc82..7ea3f6db9 100644
--- a/e2e/scenarios/claude-agent-sdk-instrumentation/package.json
+++ b/e2e/scenarios/claude-agent-sdk-instrumentation/package.json
@@ -15,5 +15,10 @@
     "zod": "4.3.6",
     "claude-agent-sdk-v0": "npm:@anthropic-ai/claude-agent-sdk@0.2.76",
     "claude-agent-sdk-v0-latest": "npm:@anthropic-ai/claude-agent-sdk@0.2.141"
+  },
+  "pnpm": {
+    "overrides": {
+      "fast-uri@<3.1.4": "^3.1.4"
+    }
   }
 }
diff --git a/e2e/scenarios/claude-agent-sdk-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/claude-agent-sdk-instrumentation/pnpm-workspace.yaml
deleted file mode 100644
index 7da97640c..000000000
--- a/e2e/scenarios/claude-agent-sdk-instrumentation/pnpm-workspace.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-overrides:
-  fast-uri@<3.1.4: ^3.1.4
diff --git a/e2e/scenarios/cohere-instrumentation/package.json b/e2e/scenarios/cohere-instrumentation/package.json
index 168a75da1..07bae9f05 100644
--- a/e2e/scenarios/cohere-instrumentation/package.json
+++ b/e2e/scenarios/cohere-instrumentation/package.json
@@ -20,5 +20,11 @@
     "cohere-sdk-v7-latest": "npm:cohere-ai@7.21.0",
     "cohere-sdk-v8": "npm:cohere-ai@8.0.0",
     "cohere-sdk-v8-latest": "npm:cohere-ai@8.0.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "fast-xml-builder@<1.1.7": "^1.1.7",
+      "qs@>=6.7.0 <6.15.2": "^6.15.2"
+    }
   }
 }
diff --git a/e2e/scenarios/cohere-instrumentation/pnpm-lock.yaml b/e2e/scenarios/cohere-instrumentation/pnpm-lock.yaml
index cb1f257d9..d48d70b2a 100644
--- a/e2e/scenarios/cohere-instrumentation/pnpm-lock.yaml
+++ b/e2e/scenarios/cohere-instrumentation/pnpm-lock.yaml
@@ -12,16 +12,16 @@ importers:
 
   .:
     dependencies:
-      cohere-sdk-v7:
-        specifier: npm:cohere-ai@7.14.0
-        version: cohere-ai@7.14.0
       cohere-sdk-v7-latest:
         specifier: npm:cohere-ai@7.21.0
         version: cohere-ai@7.21.0
-      cohere-sdk-v8:
+      cohere-sdk-v7:
+        specifier: npm:cohere-ai@7.14.0
+        version: cohere-ai@7.14.0
+      cohere-sdk-v8-latest:
         specifier: npm:cohere-ai@8.0.0
         version: cohere-ai@8.0.0(@aws-crypto/sha256-js@5.2.0)(@aws-sdk/credential-providers@3.1028.0)(@smithy/protocol-http@5.3.13)(@smithy/signature-v4@5.3.13)
-      cohere-sdk-v8-latest:
+      cohere-sdk-v8:
         specifier: npm:cohere-ai@8.0.0
         version: cohere-ai@8.0.0(@aws-crypto/sha256-js@5.2.0)(@aws-sdk/credential-providers@3.1028.0)(@smithy/protocol-http@5.3.13)(@smithy/signature-v4@5.3.13)
 
diff --git a/e2e/scenarios/cohere-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/cohere-instrumentation/pnpm-workspace.yaml
deleted file mode 100644
index b68be0393..000000000
--- a/e2e/scenarios/cohere-instrumentation/pnpm-workspace.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-overrides:
-  fast-xml-builder@<1.1.7: ^1.1.7
-  qs@>=6.7.0 <6.15.2: ^6.15.2
diff --git a/e2e/scenarios/cursor-sdk-instrumentation/package.json b/e2e/scenarios/cursor-sdk-instrumentation/package.json
index ac095fae9..9c19fef4e 100644
--- a/e2e/scenarios/cursor-sdk-instrumentation/package.json
+++ b/e2e/scenarios/cursor-sdk-instrumentation/package.json
@@ -14,5 +14,14 @@
   "dependencies": {
     "cursor-sdk-v1": "npm:@cursor/sdk@1.0.12",
     "cursor-sdk-v1-latest": "npm:@cursor/sdk@1.0.12"
+  },
+  "pnpm": {
+    "overrides": {
+      "@tootallnate/once@>=3.0.0 <3.0.1": "^3.0.1",
+      "@tootallnate/once@<2.0.1": "^2.0.1"
+    },
+    "onlyBuiltDependencies": [
+      "sqlite3"
+    ]
   }
 }
diff --git a/e2e/scenarios/cursor-sdk-instrumentation/pnpm-lock.yaml b/e2e/scenarios/cursor-sdk-instrumentation/pnpm-lock.yaml
index 5d58907db..09aa7629c 100644
--- a/e2e/scenarios/cursor-sdk-instrumentation/pnpm-lock.yaml
+++ b/e2e/scenarios/cursor-sdk-instrumentation/pnpm-lock.yaml
@@ -12,10 +12,10 @@ importers:
 
   .:
     dependencies:
-      cursor-sdk-v1:
+      cursor-sdk-v1-latest:
         specifier: npm:@cursor/sdk@1.0.12
         version: '@cursor/sdk@1.0.12'
-      cursor-sdk-v1-latest:
+      cursor-sdk-v1:
         specifier: npm:@cursor/sdk@1.0.12
         version: '@cursor/sdk@1.0.12'
 
diff --git a/e2e/scenarios/cursor-sdk-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/cursor-sdk-instrumentation/pnpm-workspace.yaml
deleted file mode 100644
index 0dc7df533..000000000
--- a/e2e/scenarios/cursor-sdk-instrumentation/pnpm-workspace.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
-allowBuilds:
-  sqlite3: true
-overrides:
-  "@tootallnate/once@>=3.0.0 <3.0.1": ^3.0.1
-  "@tootallnate/once@<2.0.1": ^2.0.1
diff --git a/e2e/scenarios/flue-instrumentation/package.json b/e2e/scenarios/flue-instrumentation/package.json
index d488f15c9..c1fae7e68 100644
--- a/e2e/scenarios/flue-instrumentation/package.json
+++ b/e2e/scenarios/flue-instrumentation/package.json
@@ -5,5 +5,12 @@
   "dependencies": {
     "@flue/cli": "0.8.0",
     "@flue/runtime": "0.8.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "@hono/node-server@>=2.0.0 <2.0.10": "^2.0.10",
+      "fast-uri@<3.1.4": "^3.1.4",
+      "hono@>=4.0.0 <4.12.27": "^4.12.27"
+    }
   }
 }
diff --git a/e2e/scenarios/flue-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/flue-instrumentation/pnpm-workspace.yaml
deleted file mode 100644
index 1b5dfa6fc..000000000
--- a/e2e/scenarios/flue-instrumentation/pnpm-workspace.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-overrides:
-  "@hono/node-server@>=2.0.0 <2.0.10": ^2.0.10
-  fast-uri@<3.1.4: ^3.1.4
-  hono@>=4.0.0 <4.12.27: ^4.12.27
diff --git a/e2e/scenarios/flue-instrumentation/versions/v1/package.json b/e2e/scenarios/flue-instrumentation/versions/v1/package.json
index 1f92eb0ab..566055e87 100644
--- a/e2e/scenarios/flue-instrumentation/versions/v1/package.json
+++ b/e2e/scenarios/flue-instrumentation/versions/v1/package.json
@@ -7,5 +7,12 @@
     "@flue/runtime": "1.0.0-beta.3",
     "hono": "^4.8.3",
     "valibot": "^1.1.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "@hono/node-server@>=2.0.0 <2.0.10": "^2.0.10",
+      "fast-uri@<3.1.4": "^3.1.4",
+      "fast-xml-parser@>=5.9.3 <5.10.1": "^5.10.1"
+    }
   }
 }
diff --git a/e2e/scenarios/flue-instrumentation/versions/v1/pnpm-workspace.yaml b/e2e/scenarios/flue-instrumentation/versions/v1/pnpm-workspace.yaml
deleted file mode 100644
index e525f4e0b..000000000
--- a/e2e/scenarios/flue-instrumentation/versions/v1/pnpm-workspace.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-overrides:
-  "@hono/node-server@>=2.0.0 <2.0.10": ^2.0.10
-  fast-uri@<3.1.4: ^3.1.4
-  fast-xml-parser@>=5.9.3 <5.10.1: ^5.10.1
diff --git a/e2e/scenarios/genkit-instrumentation/package.json b/e2e/scenarios/genkit-instrumentation/package.json
index f7edfd400..888d868a9 100644
--- a/e2e/scenarios/genkit-instrumentation/package.json
+++ b/e2e/scenarios/genkit-instrumentation/package.json
@@ -20,5 +20,17 @@
     "genkit-v1-latest": "npm:genkit@1.33.0",
     "genkit-google-genai-v1": "npm:@genkit-ai/google-genai@1.33.0",
     "genkit-google-genai-v1-latest": "npm:@genkit-ai/google-genai@1.33.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "protobufjs@<7.5.8": "^7.5.8",
+      "uuid": "^11.1.1",
+      "qs@>=6.7.0 <6.15.2": "^6.15.2",
+      "ws@>=8.0.0 <8.20.1": "^8.20.1",
+      "fast-uri@<3.1.4": "^3.1.4",
+      "@opentelemetry/sdk-node@<0.217.0": "^0.217.0",
+      "@opentelemetry/auto-instrumentations-node@<0.75.0": "^0.75.0",
+      "@opentelemetry/propagator-jaeger@<2.9.0": "^2.9.0"
+    }
   }
 }
diff --git a/e2e/scenarios/genkit-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/genkit-instrumentation/pnpm-workspace.yaml
deleted file mode 100644
index 0b3ffb898..000000000
--- a/e2e/scenarios/genkit-instrumentation/pnpm-workspace.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-overrides:
-  protobufjs@<7.5.8: ^7.5.8
-  uuid: ^11.1.1
-  qs@>=6.7.0 <6.15.2: ^6.15.2
-  ws@>=8.0.0 <8.20.1: ^8.20.1
-  fast-uri@<3.1.4: ^3.1.4
-  "@opentelemetry/sdk-node@<0.217.0": ^0.217.0
-  "@opentelemetry/auto-instrumentations-node@<0.75.0": ^0.75.0
-  "@opentelemetry/propagator-jaeger@<2.9.0": ^2.9.0
diff --git a/e2e/scenarios/github-copilot-instrumentation/package.json b/e2e/scenarios/github-copilot-instrumentation/package.json
index 97776d377..61f8031ca 100644
--- a/e2e/scenarios/github-copilot-instrumentation/package.json
+++ b/e2e/scenarios/github-copilot-instrumentation/package.json
@@ -15,5 +15,10 @@
     "vscode-jsonrpc": "8.2.1",
     "github-copilot-sdk-v0": "npm:@github/copilot-sdk@0.3.0",
     "github-copilot-sdk-v0-latest": "npm:@github/copilot-sdk@0.3.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "@github/copilot@<1.0.43": "^1.0.43"
+    }
   }
 }
diff --git a/e2e/scenarios/github-copilot-instrumentation/pnpm-lock.yaml b/e2e/scenarios/github-copilot-instrumentation/pnpm-lock.yaml
index 3494d3720..de00e07bc 100644
--- a/e2e/scenarios/github-copilot-instrumentation/pnpm-lock.yaml
+++ b/e2e/scenarios/github-copilot-instrumentation/pnpm-lock.yaml
@@ -11,10 +11,10 @@ importers:
 
   .:
     dependencies:
-      github-copilot-sdk-v0:
+      github-copilot-sdk-v0-latest:
         specifier: npm:@github/copilot-sdk@0.3.0
         version: '@github/copilot-sdk@0.3.0'
-      github-copilot-sdk-v0-latest:
+      github-copilot-sdk-v0:
         specifier: npm:@github/copilot-sdk@0.3.0
         version: '@github/copilot-sdk@0.3.0'
       vscode-jsonrpc:
diff --git a/e2e/scenarios/github-copilot-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/github-copilot-instrumentation/pnpm-workspace.yaml
deleted file mode 100644
index daf52a431..000000000
--- a/e2e/scenarios/github-copilot-instrumentation/pnpm-workspace.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-overrides:
-  "@github/copilot@<1.0.43": ^1.0.43
diff --git a/e2e/scenarios/google-adk-instrumentation/package.json b/e2e/scenarios/google-adk-instrumentation/package.json
index fd9ec93e0..3576ebbf1 100644
--- a/e2e/scenarios/google-adk-instrumentation/package.json
+++ b/e2e/scenarios/google-adk-instrumentation/package.json
@@ -20,5 +20,22 @@
     "google-adk-sdk-v0-latest": "npm:@google/adk@0.6.1",
     "google-adk-sdk-v1": "npm:@google/adk@1.0.0",
     "google-adk-sdk-v1-latest": "npm:@google/adk@1.3.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "protobufjs@<7.5.8": "^7.5.8",
+      "uuid": "^11.1.1",
+      "qs@>=6.7.0 <6.15.2": "^6.15.2",
+      "hono@>=4.0.0 <4.12.27": "^4.12.27",
+      "ws@>=8.0.0 <8.20.1": "^8.20.1",
+      "fast-uri@<3.1.4": "^3.1.4",
+      "fast-xml-builder@<1.1.7": "^1.1.7",
+      "ip-address@>=10.0.0 <10.1.1": "^10.1.1",
+      "brace-expansion@>=4.0.0 <5.0.6": "^5.0.6",
+      "@tootallnate/once@>=3.0.0 <3.0.1": "^3.0.1",
+      "@tootallnate/once@<2.0.1": "^2.0.1",
+      "@mikro-orm/knex@>=6.0.0 <6.6.14": "^6.6.14",
+      "@mikro-orm/knex@>=7.0.0 <7.0.14": "^7.0.14"
+    }
   }
 }
diff --git a/e2e/scenarios/google-adk-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/google-adk-instrumentation/pnpm-workspace.yaml
deleted file mode 100644
index 8fce5c1b2..000000000
--- a/e2e/scenarios/google-adk-instrumentation/pnpm-workspace.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-overrides:
-  protobufjs@<7.5.8: ^7.5.8
-  uuid: ^11.1.1
-  qs@>=6.7.0 <6.15.2: ^6.15.2
-  hono@>=4.0.0 <4.12.27: ^4.12.27
-  ws@>=8.0.0 <8.20.1: ^8.20.1
-  fast-uri@<3.1.4: ^3.1.4
-  fast-xml-builder@<1.1.7: ^1.1.7
-  ip-address@>=10.0.0 <10.1.1: ^10.1.1
-  brace-expansion@>=4.0.0 <5.0.6: ^5.0.6
-  "@tootallnate/once@>=3.0.0 <3.0.1": ^3.0.1
-  "@tootallnate/once@<2.0.1": ^2.0.1
-  "@mikro-orm/knex@>=6.0.0 <6.6.14": ^6.6.14
-  "@mikro-orm/knex@>=7.0.0 <7.0.14": ^7.0.14
diff --git a/e2e/scenarios/google-genai-instrumentation/package.json b/e2e/scenarios/google-genai-instrumentation/package.json
index 657987702..03c403417 100644
--- a/e2e/scenarios/google-genai-instrumentation/package.json
+++ b/e2e/scenarios/google-genai-instrumentation/package.json
@@ -20,5 +20,11 @@
     "google-genai-sdk-v1-latest": "npm:@google/genai@1.52.0",
     "google-genai-sdk-v2": "npm:@google/genai@2.8.0",
     "google-genai-sdk-v2-latest": "npm:@google/genai@2.8.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "protobufjs@<7.5.8": "^7.5.8",
+      "ws@>=8.0.0 <8.20.1": "^8.20.1"
+    }
   }
 }
diff --git a/e2e/scenarios/google-genai-instrumentation/pnpm-lock.yaml b/e2e/scenarios/google-genai-instrumentation/pnpm-lock.yaml
index 7d374dcc3..b173a126d 100644
--- a/e2e/scenarios/google-genai-instrumentation/pnpm-lock.yaml
+++ b/e2e/scenarios/google-genai-instrumentation/pnpm-lock.yaml
@@ -12,16 +12,16 @@ importers:
 
   .:
     dependencies:
-      google-genai-sdk-v1:
-        specifier: npm:@google/genai@1.30.0
-        version: '@google/genai@1.30.0'
       google-genai-sdk-v1-latest:
         specifier: npm:@google/genai@1.52.0
         version: '@google/genai@1.52.0'
-      google-genai-sdk-v2:
+      google-genai-sdk-v1:
+        specifier: npm:@google/genai@1.30.0
+        version: '@google/genai@1.30.0'
+      google-genai-sdk-v2-latest:
         specifier: npm:@google/genai@2.8.0
         version: '@google/genai@2.8.0'
-      google-genai-sdk-v2-latest:
+      google-genai-sdk-v2:
         specifier: npm:@google/genai@2.8.0
         version: '@google/genai@2.8.0'
 
diff --git a/e2e/scenarios/google-genai-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/google-genai-instrumentation/pnpm-workspace.yaml
deleted file mode 100644
index e86622e4d..000000000
--- a/e2e/scenarios/google-genai-instrumentation/pnpm-workspace.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-overrides:
-  protobufjs@<7.5.8: ^7.5.8
-  ws@>=8.0.0 <8.20.1: ^8.20.1
diff --git a/e2e/scenarios/langgraph-auto-instrumentation/package.json b/e2e/scenarios/langgraph-auto-instrumentation/package.json
index d679d9bb2..343249b2c 100644
--- a/e2e/scenarios/langgraph-auto-instrumentation/package.json
+++ b/e2e/scenarios/langgraph-auto-instrumentation/package.json
@@ -26,5 +26,11 @@
     "langchain-langgraph-v1-latest": "npm:@langchain/langgraph@1.4.7",
     "langchain-openai-v1": "npm:@langchain/openai@1.3.0",
     "langchain-openai-v1-latest": "npm:@langchain/openai@1.5.3"
+  },
+  "pnpm": {
+    "overrides": {
+      "langsmith@<0.3.30": "^0.3.30",
+      "uuid": "^11.1.1"
+    }
   }
 }
diff --git a/e2e/scenarios/langgraph-auto-instrumentation/pnpm-lock.yaml b/e2e/scenarios/langgraph-auto-instrumentation/pnpm-lock.yaml
index b265b700a..542a5ca6c 100644
--- a/e2e/scenarios/langgraph-auto-instrumentation/pnpm-lock.yaml
+++ b/e2e/scenarios/langgraph-auto-instrumentation/pnpm-lock.yaml
@@ -12,24 +12,24 @@ importers:
 
   .:
     dependencies:
-      langchain-core-v1:
-        specifier: npm:@langchain/core@1.1.35
-        version: '@langchain/core@1.1.35(openai@6.45.0(zod@4.3.6))'
       langchain-core-v1-latest:
         specifier: npm:@langchain/core@1.2.1
         version: '@langchain/core@1.2.1(openai@6.45.0(zod@4.3.6))'
-      langchain-langgraph-v1:
-        specifier: npm:@langchain/langgraph@1.0.7
-        version: '@langchain/langgraph@1.0.7(@langchain/core@1.2.1(openai@6.45.0(zod@4.3.6)))(zod@4.3.6)'
+      langchain-core-v1:
+        specifier: npm:@langchain/core@1.1.35
+        version: '@langchain/core@1.1.35(openai@6.45.0(zod@4.3.6))'
       langchain-langgraph-v1-latest:
         specifier: npm:@langchain/langgraph@1.4.7
         version: '@langchain/langgraph@1.4.7(@langchain/core@1.2.1(openai@6.45.0(zod@4.3.6)))(zod@4.3.6)'
-      langchain-openai-v1:
-        specifier: npm:@langchain/openai@1.3.0
-        version: '@langchain/openai@1.3.0(@langchain/core@1.2.1(openai@6.45.0(zod@4.3.6)))'
+      langchain-langgraph-v1:
+        specifier: npm:@langchain/langgraph@1.0.7
+        version: '@langchain/langgraph@1.0.7(@langchain/core@1.2.1(openai@6.45.0(zod@4.3.6)))(zod@4.3.6)'
       langchain-openai-v1-latest:
         specifier: npm:@langchain/openai@1.5.3
         version: '@langchain/openai@1.5.3(@langchain/core@1.2.1(openai@6.45.0(zod@4.3.6)))'
+      langchain-openai-v1:
+        specifier: npm:@langchain/openai@1.3.0
+        version: '@langchain/openai@1.3.0(@langchain/core@1.2.1(openai@6.45.0(zod@4.3.6)))'
 
 packages:
 
diff --git a/e2e/scenarios/langgraph-auto-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/langgraph-auto-instrumentation/pnpm-workspace.yaml
deleted file mode 100644
index 9f89d3b5c..000000000
--- a/e2e/scenarios/langgraph-auto-instrumentation/pnpm-workspace.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-overrides:
-  langsmith@<0.3.30: ^0.3.30
-  uuid: ^11.1.1
diff --git a/e2e/scenarios/mastra-instrumentation/package.json b/e2e/scenarios/mastra-instrumentation/package.json
index 3dd1fb177..eba54f4af 100644
--- a/e2e/scenarios/mastra-instrumentation/package.json
+++ b/e2e/scenarios/mastra-instrumentation/package.json
@@ -17,5 +17,15 @@
     "mastra-core-v1": "npm:@mastra/core@1.26.0",
     "mastra-core-v1-latest": "npm:@mastra/core@1.26.1-alpha.0",
     "@mastra/observability": "npm:@mastra/observability@1.15.2"
+  },
+  "pnpm": {
+    "overrides": {
+      "hono@>=4.0.0 <4.12.27": "^4.12.27",
+      "fast-uri@<3.1.4": "^3.1.4",
+      "ip-address@>=10.0.0 <10.1.1": "^10.1.1",
+      "ws@>=8.0.0 <8.20.1": "^8.20.1",
+      "uuid@<11.1.1": "^11.1.1",
+      "qs@>=6.7.0 <6.15.2": "^6.15.2"
+    }
   }
 }
diff --git a/e2e/scenarios/mastra-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/mastra-instrumentation/pnpm-workspace.yaml
deleted file mode 100644
index ea32e6350..000000000
--- a/e2e/scenarios/mastra-instrumentation/pnpm-workspace.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-overrides:
-  hono@>=4.0.0 <4.12.27: ^4.12.27
-  fast-uri@<3.1.4: ^3.1.4
-  ip-address@>=10.0.0 <10.1.1: ^10.1.1
-  ws@>=8.0.0 <8.20.1: ^8.20.1
-  uuid@<11.1.1: ^11.1.1
-  qs@>=6.7.0 <6.15.2: ^6.15.2
diff --git a/e2e/scenarios/mistral-instrumentation/package.json b/e2e/scenarios/mistral-instrumentation/package.json
index ed42c4f99..a8b471c4c 100644
--- a/e2e/scenarios/mistral-instrumentation/package.json
+++ b/e2e/scenarios/mistral-instrumentation/package.json
@@ -20,5 +20,10 @@
     "mistral-sdk-v1-latest": "npm:@mistralai/mistralai@1.15.1",
     "mistral-sdk-v2": "npm:@mistralai/mistralai@2.1.2",
     "mistral-sdk-v2-latest": "npm:@mistralai/mistralai@2.5.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "ws@>=8.0.0 <8.20.1": "^8.20.1"
+    }
   }
 }
diff --git a/e2e/scenarios/mistral-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/mistral-instrumentation/pnpm-workspace.yaml
deleted file mode 100644
index 42d97ee84..000000000
--- a/e2e/scenarios/mistral-instrumentation/pnpm-workspace.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-overrides:
-  ws@>=8.0.0 <8.20.1: ^8.20.1
diff --git a/e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/package.json b/e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/package.json
index 472f1d754..ffdfddd28 100644
--- a/e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/package.json
+++ b/e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/package.json
@@ -10,5 +10,10 @@
   "devDependencies": {
     "@types/react": "18.3.27",
     "@types/react-dom": "18.3.7"
+  },
+  "pnpm": {
+    "overrides": {
+      "postcss@<8.5.10": "^8.5.10"
+    }
   }
 }
diff --git a/e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/pnpm-workspace.yaml b/e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/pnpm-workspace.yaml
deleted file mode 100644
index d184b4fdc..000000000
--- a/e2e/scenarios/nextjs-auto-instrumentation/versions/next-14/pnpm-workspace.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-overrides:
-  postcss@<8.5.10: ^8.5.10
diff --git a/e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/package.json b/e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/package.json
index 89aa8e2ab..1b0d5ea03 100644
--- a/e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/package.json
+++ b/e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/package.json
@@ -9,5 +9,10 @@
   },
   "devDependencies": {
     "@types/react": "19.2.14"
+  },
+  "pnpm": {
+    "overrides": {
+      "postcss@<8.5.10": "^8.5.10"
+    }
   }
 }
diff --git a/e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/pnpm-workspace.yaml b/e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/pnpm-workspace.yaml
deleted file mode 100644
index 7438791f9..000000000
--- a/e2e/scenarios/nextjs-auto-instrumentation/versions/next-16/pnpm-workspace.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-allowBuilds:
-  sharp: true
-overrides:
-  postcss@<8.5.10: ^8.5.10
diff --git a/e2e/scenarios/nextjs-instrumentation/package.json b/e2e/scenarios/nextjs-instrumentation/package.json
index 2017e3a1f..2febcb69f 100644
--- a/e2e/scenarios/nextjs-instrumentation/package.json
+++ b/e2e/scenarios/nextjs-instrumentation/package.json
@@ -16,5 +16,11 @@
     "@types/react": "^18",
     "@types/react-dom": "^18",
     "typescript": "5.4.4"
+  },
+  "pnpm": {
+    "overrides": {
+      "protobufjs@<7.5.8": "^7.5.8",
+      "@protobufjs/utf8@<1.1.1": "^1.1.1"
+    }
   }
 }
diff --git a/e2e/scenarios/nextjs-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/nextjs-instrumentation/pnpm-workspace.yaml
deleted file mode 100644
index d4c01e41a..000000000
--- a/e2e/scenarios/nextjs-instrumentation/pnpm-workspace.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-overrides:
-  protobufjs@<7.5.8: ^7.5.8
-  "@protobufjs/utf8@<1.1.1": ^1.1.1
diff --git a/e2e/scenarios/openai-agents-instrumentation/package.json b/e2e/scenarios/openai-agents-instrumentation/package.json
index 883a24a8a..658fe5d30 100644
--- a/e2e/scenarios/openai-agents-instrumentation/package.json
+++ b/e2e/scenarios/openai-agents-instrumentation/package.json
@@ -17,5 +17,14 @@
         }
       }
     }
+  },
+  "pnpm": {
+    "overrides": {
+      "qs@>=6.7.0 <6.15.2": "^6.15.2",
+      "hono@>=4.0.0 <4.12.27": "^4.12.27",
+      "ws@>=8.0.0 <8.20.1": "^8.20.1",
+      "fast-uri@<3.1.4": "^3.1.4",
+      "ip-address@>=10.0.0 <10.1.1": "^10.1.1"
+    }
   }
 }
diff --git a/e2e/scenarios/openai-agents-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/openai-agents-instrumentation/pnpm-workspace.yaml
deleted file mode 100644
index d97992ca9..000000000
--- a/e2e/scenarios/openai-agents-instrumentation/pnpm-workspace.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-overrides:
-  qs@>=6.7.0 <6.15.2: ^6.15.2
-  hono@>=4.0.0 <4.12.27: ^4.12.27
-  ws@>=8.0.0 <8.20.1: ^8.20.1
-  fast-uri@<3.1.4: ^3.1.4
-  ip-address@>=10.0.0 <10.1.1: ^10.1.1
diff --git a/e2e/scenarios/strands-agent-sdk-instrumentation/package.json b/e2e/scenarios/strands-agent-sdk-instrumentation/package.json
index 5e13a7769..ba7e2802d 100644
--- a/e2e/scenarios/strands-agent-sdk-instrumentation/package.json
+++ b/e2e/scenarios/strands-agent-sdk-instrumentation/package.json
@@ -6,6 +6,12 @@
     "strands-agent-sdk-v1": "npm:@strands-agents/sdk@1.6.0",
     "strands-agent-sdk-v1-latest": "npm:@strands-agents/sdk@1.7.0"
   },
+  "pnpm": {
+    "overrides": {
+      "fast-uri@<3.1.4": "^3.1.4",
+      "hono@>=4.0.0 <4.12.27": "^4.12.27"
+    }
+  },
   "braintrustScenario": {
     "bump": {
       "dependencies": {
diff --git a/e2e/scenarios/strands-agent-sdk-instrumentation/pnpm-workspace.yaml b/e2e/scenarios/strands-agent-sdk-instrumentation/pnpm-workspace.yaml
deleted file mode 100644
index 33355258a..000000000
--- a/e2e/scenarios/strands-agent-sdk-instrumentation/pnpm-workspace.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-overrides:
-  fast-uri@<3.1.4: ^3.1.4
-  hono@>=4.0.0 <4.12.27: ^4.12.27
diff --git a/e2e/scenarios/wrap-langchain-js-traces/package.json b/e2e/scenarios/wrap-langchain-js-traces/package.json
index bb71f2069..7ef2d95ee 100644
--- a/e2e/scenarios/wrap-langchain-js-traces/package.json
+++ b/e2e/scenarios/wrap-langchain-js-traces/package.json
@@ -21,5 +21,11 @@
     "langchain-core-v1-latest": "npm:@langchain/core@1.2.1",
     "langchain-openai-v1": "npm:@langchain/openai@1.3.0",
     "langchain-openai-v1-latest": "npm:@langchain/openai@1.5.3"
+  },
+  "pnpm": {
+    "overrides": {
+      "langsmith@<0.3.30": "^0.3.30",
+      "uuid": "^11.1.1"
+    }
   }
 }
diff --git a/e2e/scenarios/wrap-langchain-js-traces/pnpm-lock.yaml b/e2e/scenarios/wrap-langchain-js-traces/pnpm-lock.yaml
index 632a2c8cb..5dcbf1544 100644
--- a/e2e/scenarios/wrap-langchain-js-traces/pnpm-lock.yaml
+++ b/e2e/scenarios/wrap-langchain-js-traces/pnpm-lock.yaml
@@ -12,18 +12,18 @@ importers:
 
   .:
     dependencies:
-      langchain-core-v1:
-        specifier: npm:@langchain/core@1.1.35
-        version: '@langchain/core@1.1.35(openai@6.45.0(zod@3.25.76))'
       langchain-core-v1-latest:
         specifier: npm:@langchain/core@1.2.1
         version: '@langchain/core@1.2.1(openai@6.45.0(zod@3.25.76))'
-      langchain-openai-v1:
-        specifier: npm:@langchain/openai@1.3.0
-        version: '@langchain/openai@1.3.0(@langchain/core@1.2.1(openai@6.45.0(zod@3.25.76)))'
+      langchain-core-v1:
+        specifier: npm:@langchain/core@1.1.35
+        version: '@langchain/core@1.1.35(openai@6.45.0(zod@3.25.76))'
       langchain-openai-v1-latest:
         specifier: npm:@langchain/openai@1.5.3
         version: '@langchain/openai@1.5.3(@langchain/core@1.2.1(openai@6.45.0(zod@3.25.76)))'
+      langchain-openai-v1:
+        specifier: npm:@langchain/openai@1.3.0
+        version: '@langchain/openai@1.3.0(@langchain/core@1.2.1(openai@6.45.0(zod@3.25.76)))'
       zod:
         specifier: 3.25.76
         version: 3.25.76
diff --git a/e2e/scenarios/wrap-langchain-js-traces/pnpm-workspace.yaml b/e2e/scenarios/wrap-langchain-js-traces/pnpm-workspace.yaml
deleted file mode 100644
index 9f89d3b5c..000000000
--- a/e2e/scenarios/wrap-langchain-js-traces/pnpm-workspace.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
-overrides:
-  langsmith@<0.3.30: ^0.3.30
-  uuid: ^11.1.1
diff --git a/integrations/otel-js/otel-v1/package.json b/integrations/otel-js/otel-v1/package.json
index 66fdb0267..ff0a41801 100644
--- a/integrations/otel-js/otel-v1/package.json
+++ b/integrations/otel-js/otel-v1/package.json
@@ -41,5 +41,26 @@
     "tsup": "^8.5.0",
     "typescript": "5.5.4",
     "vitest": "4.1.5"
+  },
+  "pnpm": {
+    "overrides": {
+      "protobufjs": "^7.6.5",
+      "body-parser@>=2.0.0 <2.3.0": "^2.3.0",
+      "uuid": "^11.1.1",
+      "qs@>=6.7.0 <6.15.2": "^6.15.2",
+      "fast-uri@<3.1.4": "^3.1.4",
+      "path-to-regexp@<0.1.13": "^0.1.13",
+      "vite@>=8.0.0 <8.0.5": "^8.0.5",
+      "vite@>=7.0.0 <7.3.2": "^7.3.2",
+      "vite@>=6.0.0 <6.4.2": "^6.4.2",
+      "vite@>=5.0.0 <6.0.0": "^5.4.21",
+      "postcss@<8.5.10": "^8.5.10",
+      "picomatch@<2.3.2": "^2.3.2",
+      "picomatch@>=3.0.0 <3.0.2": "^3.0.2",
+      "picomatch@>=4.0.0 <4.0.4": "^4.0.4",
+      "brace-expansion@<1.1.16": "^1.1.16",
+      "brace-expansion@>=2.0.0 <2.1.2": "^2.1.2",
+      "brace-expansion@>=3.0.0 <5.0.7": "^5.0.7"
+    }
   }
 }
diff --git a/integrations/otel-js/otel-v1/pnpm-workspace.yaml b/integrations/otel-js/otel-v1/pnpm-workspace.yaml
deleted file mode 100644
index 8fe2e0ed1..000000000
--- a/integrations/otel-js/otel-v1/pnpm-workspace.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-overrides:
-  protobufjs: ^7.6.5
-  body-parser@>=2.0.0 <2.3.0: ^2.3.0
-  uuid: ^11.1.1
-  qs@>=6.7.0 <6.15.2: ^6.15.2
-  fast-uri@<3.1.4: ^3.1.4
-  path-to-regexp@<0.1.13: ^0.1.13
-  vite@>=8.0.0 <8.0.5: ^8.0.5
-  vite@>=7.0.0 <7.3.2: ^7.3.2
-  vite@>=6.0.0 <6.4.2: ^6.4.2
-  vite@>=5.0.0 <6.0.0: ^5.4.21
-  postcss@<8.5.10: ^8.5.10
-  picomatch@<2.3.2: ^2.3.2
-  picomatch@>=3.0.0 <3.0.2: ^3.0.2
-  picomatch@>=4.0.0 <4.0.4: ^4.0.4
-  brace-expansion@<1.1.16: ^1.1.16
-  brace-expansion@>=2.0.0 <2.1.2: ^2.1.2
-  brace-expansion@>=3.0.0 <5.0.7: ^5.0.7
diff --git a/integrations/otel-js/otel-v2/package.json b/integrations/otel-js/otel-v2/package.json
index 3ae9eddd6..6ffa2bb8f 100644
--- a/integrations/otel-js/otel-v2/package.json
+++ b/integrations/otel-js/otel-v2/package.json
@@ -39,5 +39,26 @@
     "tsup": "^8.5.0",
     "typescript": "5.5.4",
     "vitest": "4.1.5"
+  },
+  "pnpm": {
+    "overrides": {
+      "protobufjs": "^7.6.5",
+      "body-parser@>=2.0.0 <2.3.0": "^2.3.0",
+      "uuid": "^11.1.1",
+      "qs@>=6.7.0 <6.15.2": "^6.15.2",
+      "fast-uri@<3.1.4": "^3.1.4",
+      "path-to-regexp@<0.1.13": "^0.1.13",
+      "vite@>=8.0.0 <8.0.5": "^8.0.5",
+      "vite@>=7.0.0 <7.3.2": "^7.3.2",
+      "vite@>=6.0.0 <6.4.2": "^6.4.2",
+      "vite@>=5.0.0 <6.0.0": "^5.4.21",
+      "postcss@<8.5.10": "^8.5.10",
+      "picomatch@<2.3.2": "^2.3.2",
+      "picomatch@>=3.0.0 <3.0.2": "^3.0.2",
+      "picomatch@>=4.0.0 <4.0.4": "^4.0.4",
+      "brace-expansion@<1.1.16": "^1.1.16",
+      "brace-expansion@>=2.0.0 <2.1.2": "^2.1.2",
+      "brace-expansion@>=3.0.0 <5.0.7": "^5.0.7"
+    }
   }
 }
diff --git a/integrations/otel-js/otel-v2/pnpm-workspace.yaml b/integrations/otel-js/otel-v2/pnpm-workspace.yaml
deleted file mode 100644
index 8fe2e0ed1..000000000
--- a/integrations/otel-js/otel-v2/pnpm-workspace.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-overrides:
-  protobufjs: ^7.6.5
-  body-parser@>=2.0.0 <2.3.0: ^2.3.0
-  uuid: ^11.1.1
-  qs@>=6.7.0 <6.15.2: ^6.15.2
-  fast-uri@<3.1.4: ^3.1.4
-  path-to-regexp@<0.1.13: ^0.1.13
-  vite@>=8.0.0 <8.0.5: ^8.0.5
-  vite@>=7.0.0 <7.3.2: ^7.3.2
-  vite@>=6.0.0 <6.4.2: ^6.4.2
-  vite@>=5.0.0 <6.0.0: ^5.4.21
-  postcss@<8.5.10: ^8.5.10
-  picomatch@<2.3.2: ^2.3.2
-  picomatch@>=3.0.0 <3.0.2: ^3.0.2
-  picomatch@>=4.0.0 <4.0.4: ^4.0.4
-  brace-expansion@<1.1.16: ^1.1.16
-  brace-expansion@>=2.0.0 <2.1.2: ^2.1.2
-  brace-expansion@>=3.0.0 <5.0.7: ^5.0.7
diff --git a/package.json b/package.json
index 0f51a96b9..a29ec1039 100644
--- a/package.json
+++ b/package.json
@@ -31,7 +31,7 @@
     "yalc:publish": "turbo run yalc:publish"
   },
   "engines": {
-    "pnpm": ">=11.9.0",
+    "pnpm": ">=10.27.0",
     "npm": "please-use-pnpm",
     "yarn": "please-use-pnpm"
   },
@@ -56,5 +56,38 @@
   "lint-staged": {
     "**/*.{js,jsx,ts,tsx,mjs,cjs,css,md,mdx,html,yaml,yml,json}": "prettier --write"
   },
-  "packageManager": "pnpm@11.9.0"
+  "packageManager": "pnpm@10.33.0",
+  "pnpm": {
+    "overrides": {
+      "handlebars": "^4.7.9",
+      "protobufjs": "^7.6.5",
+      "body-parser@>=2.0.0 <2.3.0": "^2.3.0",
+      "brace-expansion@<1.1.16": "^1.1.16",
+      "brace-expansion@>=2.0.0 <2.1.2": "^2.1.2",
+      "brace-expansion@>=3.0.0 <5.0.7": "^5.0.7",
+      "esbuild": "0.28.1",
+      "uuid": "11.1.1",
+      "router@2.2.0>path-to-regexp": "8.4.0",
+      "express@5.2.1>qs": "6.15.2",
+      "qs@>=6.7.0 <6.15.2": "^6.15.2",
+      "tar@>=7.0.0 <7.5.19": "^7.5.19",
+      "tar@>=6.0.0 <7.0.0": "^6.2.1",
+      "hono@>=4.0.0 <4.12.27": "^4.12.27",
+      "flatted@<3.4.2": "^3.4.2",
+      "markdown-it@>=13.0.0 <14.1.1": "^14.1.1",
+      "ip-address@<10.1.1": "^10.1.1",
+      "js-yaml@>=4.0.0 <4.3.0": "^4.3.0",
+      "js-yaml@>=3.0.0 <3.15.0": "^3.15.0",
+      "@mikro-orm/knex@>=6.0.0 <6.6.14": "^6.6.14",
+      "glob@>=10.2.0 <10.5.0": "^10.5.0",
+      "fast-uri@<3.1.4": "^3.1.4",
+      "linkify-it@<5.0.2": "^5.0.2"
+    },
+    "ignoredBuiltDependencies": [
+      "@swc/core",
+      "esbuild",
+      "msw",
+      "protobufjs"
+    ]
+  }
 }
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 7dc2678f3..dd63d0ea2 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -11,35 +11,6 @@ minimumReleaseAge: 4320 # 3 days (in minutes)
 minimumReleaseAgeExclude:
   - "@braintrust/bt-*" # bt binary packages, published in lockstep with braintrust
 trustPolicy: no-downgrade
-# Ignore the check for packages published more than 30 days ago.
+# Ignore the check for packages published more than 30 days ago (pnpm 10.27+)
 # Useful for older packages that pre-date provenance support
 trustPolicyIgnoreAfter: 43200 # minutes (30 days)
-allowBuilds:
-  "@swc/core": false
-  esbuild: false
-  msw: false
-  protobufjs: false
-overrides:
-  handlebars: ^4.7.9
-  protobufjs: ^7.6.5
-  body-parser@>=2.0.0 <2.3.0: ^2.3.0
-  brace-expansion@<1.1.16: ^1.1.16
-  brace-expansion@>=2.0.0 <2.1.2: ^2.1.2
-  brace-expansion@>=3.0.0 <5.0.7: ^5.0.7
-  esbuild: 0.28.1
-  uuid: 11.1.1
-  router@2.2.0>path-to-regexp: 8.4.0
-  express@5.2.1>qs: 6.15.2
-  qs@>=6.7.0 <6.15.2: ^6.15.2
-  tar@>=7.0.0 <7.5.19: ^7.5.19
-  tar@>=6.0.0 <7.0.0: ^6.2.1
-  hono@>=4.0.0 <4.12.27: ^4.12.27
-  flatted@<3.4.2: ^3.4.2
-  markdown-it@>=13.0.0 <14.1.1: ^14.1.1
-  ip-address@<10.1.1: ^10.1.1
-  js-yaml@>=4.0.0 <4.3.0: ^4.3.0
-  js-yaml@>=3.0.0 <3.15.0: ^3.15.0
-  "@mikro-orm/knex@>=6.0.0 <6.6.14": ^6.6.14
-  glob@>=10.2.0 <10.5.0: ^10.5.0
-  fast-uri@<3.1.4: ^3.1.4
-  linkify-it@<5.0.2: ^5.0.2

From 2d545fb7cf128824a7f52977f599cb4641c67f9d Mon Sep 17 00:00:00 2001
From: lforst <8118419+lforst@users.noreply.github.com>
Date: Tue, 28 Jul 2026 15:53:53 +0000
Subject: [PATCH 3/4] Update PR #2301

---
 scripts/release/pack-publishable-packages.mjs | 23 +++++++++++++------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/scripts/release/pack-publishable-packages.mjs b/scripts/release/pack-publishable-packages.mjs
index be10bed68..54a7d64f3 100644
--- a/scripts/release/pack-publishable-packages.mjs
+++ b/scripts/release/pack-publishable-packages.mjs
@@ -26,6 +26,7 @@ const outputDir = args["output-dir"] ?? "artifacts/release-packages";
 const manifestPath = args.manifest;
 const reportPath =
   args.report ?? path.posix.join(outputDir, "pack-report.json");
+const PACKAGING_PNPM_VERSION = "11.9.0";
 
 const targets = getTargets(manifestPath);
 const absoluteOutputDir = repoPath(outputDir);
@@ -51,7 +52,7 @@ appendSummary(
 function packPackage(target) {
   const packDir = mkdtempSync(path.join(os.tmpdir(), "braintrust-pack-"));
   try {
-    runPnpm(["pack", "--pack-destination", packDir], {
+    runPackagingPnpm(["pack", "--pack-destination", packDir], {
       cwd: repoPath(target.dir),
     });
 
@@ -79,7 +80,7 @@ function packPackage(target) {
     const tarballPath = path.join(absoluteOutputDir, tarballAsset);
     const sbomPath = path.join(absoluteOutputDir, sbomAsset);
     renameSync(path.join(packDir, packedTarballs[0]), tarballPath);
-    runPnpm(
+    runPackagingPnpm(
       ["sbom", "--sbom-format", "cyclonedx", "--prod", "--out", sbomPath],
       { cwd: repoPath(target.dir) },
     );
@@ -128,9 +129,17 @@ function readPackageInfo(relativeDir, expectedName, releasePackage = {}) {
   };
 }
 
-function runPnpm(pnpmArgs, options) {
-  execFileSync("pnpm", pnpmArgs, {
-    ...options,
-    stdio: "inherit",
-  });
+function runPackagingPnpm(pnpmArgs, options) {
+  execFileSync(
+    "corepack",
+    [`pnpm@${PACKAGING_PNPM_VERSION}`, "--pm-on-fail=ignore", ...pnpmArgs],
+    {
+      ...options,
+      env: {
+        ...process.env,
+        COREPACK_ENABLE_DOWNLOAD_PROMPT: "0",
+      },
+      stdio: "inherit",
+    },
+  );
 }

From 07e613a20976589be8d56f338d98b381b4cafff2 Mon Sep 17 00:00:00 2001
From: OpenAI Codex <codex@openai.com>
Date: Thu, 30 Jul 2026 14:47:20 +0000
Subject: [PATCH 4/4] fix: Harden stable release metadata

---
 scripts/release/pack-publishable-packages.mjs | 27 +++++++++++++++++--
 scripts/release/release-manifest.mjs          |  7 +++++
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/scripts/release/pack-publishable-packages.mjs b/scripts/release/pack-publishable-packages.mjs
index 54a7d64f3..fbf0ff86e 100644
--- a/scripts/release/pack-publishable-packages.mjs
+++ b/scripts/release/pack-publishable-packages.mjs
@@ -81,10 +81,33 @@ function packPackage(target) {
     const sbomPath = path.join(absoluteOutputDir, sbomAsset);
     renameSync(path.join(packDir, packedTarballs[0]), tarballPath);
     runPackagingPnpm(
-      ["sbom", "--sbom-format", "cyclonedx", "--prod", "--out", sbomPath],
-      { cwd: repoPath(target.dir) },
+      [
+        "--filter",
+        target.name,
+        "sbom",
+        "--sbom-format",
+        "cyclonedx",
+        "--prod",
+        "--out",
+        sbomPath,
+      ],
+      { cwd: repoPath() },
     );
 
+    const sbom = JSON.parse(readFileSync(sbomPath, "utf8"));
+    const rootComponent = sbom.metadata?.component;
+    const rootPackageName = rootComponent?.group
+      ? `${rootComponent.group}/${rootComponent.name}`
+      : rootComponent?.name;
+    if (
+      rootPackageName !== target.name ||
+      rootComponent?.version !== target.version
+    ) {
+      throw new Error(
+        `Expected SBOM for ${target.name}@${target.version}, found ${rootPackageName}@${rootComponent?.version}`,
+      );
+    }
+
     return {
       name: target.name,
       dir: target.dir,
diff --git a/scripts/release/release-manifest.mjs b/scripts/release/release-manifest.mjs
index 23247e29d..50f2c5073 100644
--- a/scripts/release/release-manifest.mjs
+++ b/scripts/release/release-manifest.mjs
@@ -154,6 +154,13 @@ function getStableReleasePackages() {
       continue;
     }
 
+    if (!tagCommit && alreadyPublished) {
+      console.warn(
+        `Skipping ${tag}: the package is already published but the release tag is missing`,
+      );
+      continue;
+    }
+
     packages.push(
       buildStablePackageEntry(
         approvedPackage.dir,