Migrate from npm to pnpm#64
Merged
Merged
Conversation
Delete package-lock.json and yarn.lock, generate pnpm-lock.yaml via pnpm import. Configure .npmrc with strict-peer-dependencies and auto-install-peers. Approve build scripts for sharp and unrs-resolver in package.json. Refs #63 Signed-off-by: Jason Madigan <[email protected]>
Build stage: corepack enable pnpm, pnpm install --frozen-lockfile, pnpm run build. Runtime stage: remove npm from apt-get, use node_modules/.bin/next directly for supervisor. Refs #63 Signed-off-by: Jason Madigan <[email protected]>
CI: add pnpm/action-setup@v4, use pnpm install/exec. Makefile: npm run dev -> pnpm run dev, npx -> pnpm exec. Screenshots command: npm install -> pnpm add -D. Refs #63 Signed-off-by: Jason Madigan <[email protected]>
README: npm install -> pnpm install, add pnpm to prerequisites. CLAUDE.md: npm install -> pnpm install. Refs #63 Signed-off-by: Jason Madigan <[email protected]>
…r pin - playwright.config.ts: npm run dev -> pnpm run dev - .npmrc: add minimum-release-age, block-exotic-subdeps, strict-dep-builds - package.json: add packageManager field pinning [email protected] Signed-off-by: Jason Madigan <[email protected]>
jasonmadigan
marked this pull request as ready for review
June 4, 2026 20:47
Signed-off-by: Jason Madigan <[email protected]>
shanetinklenberg
pushed a commit
to shanetinklenberg/tracefinity
that referenced
this pull request
Jun 28, 2026
* Replace npm/yarn with pnpm lockfile and config Delete package-lock.json and yarn.lock, generate pnpm-lock.yaml via pnpm import. Configure .npmrc with strict-peer-dependencies and auto-install-peers. Approve build scripts for sharp and unrs-resolver in package.json. Refs tracefinity#63 Signed-off-by: Jason Madigan <[email protected]> * Update Dockerfiles for pnpm Build stage: corepack enable pnpm, pnpm install --frozen-lockfile, pnpm run build. Runtime stage: remove npm from apt-get, use node_modules/.bin/next directly for supervisor. Refs tracefinity#63 Signed-off-by: Jason Madigan <[email protected]> * Update CI, Makefile, and commands for pnpm CI: add pnpm/action-setup@v4, use pnpm install/exec. Makefile: npm run dev -> pnpm run dev, npx -> pnpm exec. Screenshots command: npm install -> pnpm add -D. Refs tracefinity#63 Signed-off-by: Jason Madigan <[email protected]> * Update docs for pnpm README: npm install -> pnpm install, add pnpm to prerequisites. CLAUDE.md: npm install -> pnpm install. Refs tracefinity#63 Signed-off-by: Jason Madigan <[email protected]> * Address review: missed npm ref, pnpm security settings, packageManager pin - playwright.config.ts: npm run dev -> pnpm run dev - .npmrc: add minimum-release-age, block-exotic-subdeps, strict-dep-builds - package.json: add packageManager field pinning [email protected] Signed-off-by: Jason Madigan <[email protected]> * Fix numba cache dir for Docker runtime Signed-off-by: Jason Madigan <[email protected]> --------- Signed-off-by: Jason Madigan <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces npm with pnpm across the frontend toolchain. pnpm's strict node_modules isolation prevents phantom dependency access, and its security defaults (lifecycle script blocking, minimum release age, exotic subdep blocking) harden the supply chain.
Closes #63
Changes
package-lock.jsonandyarn.lock, generatepnpm-lock.yaml.npmrcwith strict peers, auto-install peers, minimum release age, exotic subdep blocking, strict dep buildspackageManagerfield inpackage.jsoncorepack enable pnpm,pnpm install --frozen-lockfile,pnpm run buildpnpm/action-setup@v4, swap all npm/npx commandsTest evidence
pnpm install-- clean (476 packages)pnpm run build-- compiled successfully (Turbopack)pnpm exec vitest run-- 20/20 tests pass