[Misc] Record how to regenerate the lockfile when upgrading a JavaScript dependency

* dependencies: the pnpm and node versions the build uses are pinned in the xwiki-commons parent
  pom, so the lockfile must be regenerated with that pnpm and then deduped — not with whatever
  pnpm is on PATH.

Author: manuelleduc

xwiki/okf/conventions/dependencies.md

@@ -27,3 +27,15 @@ for that dependency — except for the license criterion.
 
 Upgrading dependencies is a separate flow: upgrade PRs (including Renovate's) have per-ecosystem
 default assignees — see the `xwiki-pull-request` skill.
+
+## Upgrading a JavaScript dependency
+
+The branch pins its own toolchain: `pnpm.version` and `node.version` are properties of the
+**xwiki-commons parent pom**, and the build runs pnpm through that pin, not the one on your `PATH`.
+Regenerate the lockfile with **that** version (`npx pnpm@<pnpm.version> install --lockfile-only`) —
+a newer pnpm resolves peers differently and produces a lockfile the build then rewrites. Then run
+`pnpm dedupe --lockfile-only` with the same version, so the upgrade does not leave duplicated
+versions behind; expect it to touch entries unrelated to the dependency you bumped.
+
+Whether the bump is `[Misc]` or needs an issue, and what that issue's description holds, are in
+[[commit-messages]] and [[jira]].