[HughParry]

What changed

The repo moves from npm to pnpm 11 (packageManager: pnpm@11.27.1).

• Lockfile and config: pnpm-lock.yaml replaces package-lock.json. It was converted with pnpm import, so no versions change. pnpm-workspace.yaml replaces the workspaces field and .npmrc.
• Internal packages link locally: every @prosopo/* dependency is workspace:*, so packages always use the local copy. changeset publish now runs pnpm publish, which swaps in exact versions, so published packages look the same as before. Checked with pnpm pack and a --dry-run publish.
• Scripts and CI: scripts, workflows, release tooling and Docker bake use pnpm. pnpm passes a literal -- through to scripts, so scripts no longer put one before their arguments.
• Code that asked npm things:
  • getDependencies (bundle externals) now walks node_modules instead of parsing npm ls.
  • The lint tools read pnpm-workspace.yaml through a new getWorkspacePatterns in @prosopo/workspace, which keeps the workspace's exclusions.
  • The webpack and vite configs now resolve babel, loaders and polyfill shims from @prosopo/config, instead of relying on them being hoisted.
• Undeclared dependencies: pnpm only lets a package import what it declares. Types and tools that npm's hoisting used to provide are now declared.
• Supply-chain policy: pnpm refuses versions younger than 7 days, git or tarball subdependencies, and provenance downgrades. The currently locked exceptions are listed in pnpm-workspace.yaml, and Dependabot gets a matching 7-day cooldown.
• verifyDepsBeforeRun is off, so running a script inside captcha-private can't install captcha standalone over the parent's node_modules.

Effect

• 54 of 58 production bundles are byte-identical to npm's, including every widget bundle.
• The provider, provider-mock and client-example-server bundles contain the same package versions, but are about 20% smaller. npm had installed duplicate copies of mongodb and express at the same version; pnpm installs one.

Tests

Standalone, locally, against an npm baseline on the same commit:

• Pass on both: install, lint, build, build:cjs, build:tsc, typecheck, webpack, CLI bundle and every production bundle.
• Tests: turbo run test gives the same pass/fail per package as npm. The 8 packages that need Mongo, Redis or the provider fail on both; Docker was not available locally.
• New or rewritten unit tests: the node_modules walk, workspace lookup and getWorkspaceGlobs.
• Not testable before merge: GitHub Actions runs and real publishing (OIDC trusted publishing and provenance).

Merge order

fingerprintjs first, then this PR, then Protect (its CI builds fingerprintjs from captcha main), then captcha-private.

Links: prosopo/fingerprintjs#10 · #3447 · prosopo/Protect#1120 · prosopo/docs#106 · prosopo/captcha-private#5035

[github-actions]

No updates since 2026-09-29T14:05:34Z (over 1 days), so this PR has been converted to draft. That stops it holding CI runners.

Nothing is lost — gh pr ready 3447, or the "Ready for review" button, picks it straight back up. Add the keep-ready label to exempt it permanently.

Converting to draft disables auto-merge, so PRs with auto-merge enabled are excluded from this entirely.