pnpm-lock.yaml incompatible with PNPM 7

[clintcs]

pnpm-lock.yaml is a version 6 lock file, which is incompatible with PNPM versions older than 8. Package installation can be made to fail immediately if an incompatible PNPM version is detected using package.json's engines field. PR welcome?

[clintcs]

Scratch that. PNPM 7 supports version 6 lock files. The issue was with my version: 7.14.2. I'll report back.

[clintcs]

After some testing, it looks like they quietly added support in PNPM 7 for version 6 lock files sometime around 7.24.2. So we'd set engines in package.json to at least "7.24.2".

However, they bumped the lock file version again—to 6.1—at 7.33.0 for PNPM 7 and 8.6.0 for PNPM 8. So we may want to require 7.33.0 or 8.6.0 if we want those running newer PNPM releases to not get a pnpm-lock.yaml diff upon running pnpm install, which we're seeing in CI.

Question about CI. Anyone know why we're logging lock file differences but not failing the build?

[vitch]

We should manage the pnpm version via volta as mentioned in CrowdStrike/ember-headless-table#184

[clintcs]

It's unfortunate that Volta uses a non-standard field (volta) in package.json. I'm fine using it for our convenience.
However, I think we should also use the standard engines field. We can't guarantee that consumers use Volta and we should prevent them from using versions of PNPM that we don't support.