port remaining changes from stable branch

.github/workflows/lint-web.yml

@@ -37,8 +37,9 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
         with:
+          package_json_file: web/package.json
           cache: true
-          version: 11
+          run_install: false
 
       - name: Install deps
         working-directory: web

.github/workflows/release.yml

@@ -94,15 +94,29 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
         with:
+          package_json_file: web/package.json
           cache: true
-          version: 11
+          run_install: false
 
       - name: Build frontend
         working-directory: web
         run: |
           pnpm install --ignore-scripts --frozen-lockfile
           pnpm build
 
+      - name: Build source code archive
+        run: tar --exclude='.github' --exclude-vcs --exclude-vcs-ignores --xform='s|^\./|proxy-${{ env.VERSION }}/|' --xz -cf ${{ runner.temp }}/defguard-proxy-${{ env.VERSION }}.tar.xz .
+
+      - name: Upload source code archive
+        uses: shogo82148/actions-upload-release-asset@394b3c11c3cfc038b5396ad265c074065cf875c3 # v1.10.2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ needs.create-release.outputs.upload_url }}
+          asset_path: ${{ runner.temp }}/defguard-proxy-${{ env.VERSION }}.tar.xz
+          asset_content_type: application/x-xz
+          overwrite: true
+
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
@@ -353,14 +367,14 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
         with:
-          version: 11
+          package_json_file: web/package.json
+          cache: true
+          run_install: false
 
-      # Change to '--frozen-lockfile' once this gets fixed:
-      # https://github.com/pnpm/action-setup/issues/40
       - name: Build frontend
         working-directory: web
         run: |
-          pnpm install --ignore-scripts --no-frozen-lockfile
+          pnpm install --ignore-scripts --frozen-lockfile
           pnpm build
 
       - name: Install Rust stable

.github/workflows/test.yml

@@ -71,7 +71,7 @@ jobs:
           tool: cargo-deny
 
       - name: Run cargo deny
-        run: cargo deny check
+        run: cargo deny check --hide-inclusion-graph
 
       - name: Run tests
         run: cargo test --locked --no-fail-fast

.trivyignore.yaml

@@ -1,10 +1 @@
-vulnerabilities:
-  - id: GHSA-w5hq-g745-h8pq
-    expired_at: 2026-05-23
-    statement: "Waiting for upstream patch in paraglide"
-  - id: CVE-2026-29111
-    expired_at: 2026-05-31
-    statement: "No fixed version available in debian:13-slim - waiting for Debian to backport systemd patch"
-  - id: CVE-2025-69720
-    expired_at: 2026-05-31
-    statement: "No fixed version available in debian:13-slim - waiting for Debian to release ncurses patch"
+vulnerabilities: []

package.json

@@ -1,4 +1,5 @@
 {
+	"packageManager": "pnpm@11.9.0",
 	"devDependencies": {
 		"@tanstack/devtools-vite": "^0.3.12"
 	}

renovate.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>DefGuard/ci-workflows//renovate/default.json"]
+}

web/package.json

@@ -2,6 +2,7 @@
   "name": "web",
   "private": true,
   "version": "0.0.1",
+  "packageManager": "pnpm@11.9.0",
   "type": "module",
   "scripts": {
     "dev": "vite",