https://pnpm.io/catalogs (new in pnpm v9.5.0) TODO: does dependabot or renovate bot understand pnpm workspace catalogs?