updating frontend deps

Author: RishiDesai

README.md

@@ -48,7 +48,7 @@ export ODDISH_API_KEY="ok_..."
 
 ```bash
 # Run a single agent
-oddish run -d terminal-bench@2.0 -a codex -m gpt-5.4 --n-trials 3
+oddish run -d terminal-bench@2.0 -a codex -m gpt-5.5 --n-trials 3
 ```
 
 ```bash

frontend/Dockerfile

@@ -6,8 +6,11 @@ FROM base AS deps
 RUN apk add --no-cache libc6-compat
 WORKDIR /app
 
-# Install pnpm
-RUN corepack enable && corepack prepare pnpm@latest --activate
+# Pin pnpm to the exact version declared in package.json's ``packageManager``
+# field.  Using ``pnpm@latest`` would defeat the purpose of a frozen lockfile
+# if pnpm itself were compromised upstream; ``--activate`` with an exact
+# version is reproducible across builds.
+RUN corepack enable && corepack prepare pnpm@10.0.0 --activate
 
 # Copy package files
 COPY package.json pnpm-lock.yaml ./
@@ -19,8 +22,8 @@ RUN pnpm install --frozen-lockfile
 FROM base AS builder
 WORKDIR /app
 
-# Install pnpm
-RUN corepack enable && corepack prepare pnpm@latest --activate
+# Install pnpm (same pin as deps stage).
+RUN corepack enable && corepack prepare pnpm@10.0.0 --activate
 
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .