Skip to content

build: migrate from npm to pnpm 11 - #106

Draft
HughParry wants to merge 1 commit into
mainfrom
feat/pnpm-migration-v2
Draft

HughParry wants to merge 1 commit into
mainfrom
feat/pnpm-migration-v2

Conversation

@HughParry

@HughParry HughParry commented Sep 29, 2026 •

Copy link
Copy Markdown

What changed

The docs site moves from npm to pnpm 11:

  • pnpm-lock.yaml replaces package-lock.json. It was converted with pnpm import, so no versions change.
  • pnpm-workspace.yaml replaces .npmrc.
  • CI, Netlify and the pin-check scripts use pnpm.
  • Four @babel/* packages that scripts/add-language.mjs imports are now declared. npm only provided them through hoisting.

Effect

The site is the same. The build produces the same 417 pages with the same text; only hashed asset names differ.

Tests

Run locally against an npm baseline:

  • clean pnpm install --frozen-lockfile
  • lint
  • full build
  • astro check
  • check-pinned-versions
  • dev and preview servers

All pass, as they do on npm.

Merge order

Independent of the other PRs. It is excluded from captcha-private's workspace, which only bumps its pointer.

Links: prosopo/fingerprintjs#10 · prosopo/captcha#3447 · prosopo/Protect#1120 · #106 · prosopo/captcha-private#5035

Swap npm for pnpm 11.27.1 (packageManager, engines.pnpm >=11).

- pnpm-lock.yaml generated with `pnpm import` from package-lock.json, so
  every resolved version already existed in the npm lockfile; package-lock.json
  removed and gitignored.
- pnpm-workspace.yaml holds the pnpm settings: allowBuilds for the deps whose
  install scripts must run (@biomejs/biome, esbuild, sharp), plus the
  savePrefix/fetch-retry/maxSockets settings from .npmrc, which pnpm 11 no
  longer reads from .npmrc.
- package.json scripts use pnpm run / pnpm exec / pnpm --filter instead of
  npm run / npx.
- scripts/add-language.mjs imported @babel/generator, @babel/parser,
  @babel/traverse and @babel/types without declaring them (npm hoisted them
  from transitive deps); they are now devDependencies pinned to the versions the
  npm lockfile resolved.
- CI installs pnpm with pnpm/action-setup (pinned SHA, v6.1.0) before
  setup-node, caches the pnpm store via setup-node `cache: pnpm`, and runs
  `pnpm install --frozen-lockfile`. The hand-rolled ~/.npm and Cypress cache
  steps are dropped; the cache workflow now just primes the pnpm store.
- check-pinned-versions.mjs verifies integrity hashes in pnpm-lock.yaml;
  pin-versions.mjs reads resolved versions from `pnpm list`.
- Netlify builds with `pnpm run build`.

Co-Authored-By: Claude <noreply@anthropic.com>
@netlify

netlify Bot commented Sep 29, 2026 •

Copy link
Copy Markdown

❌ Deploy Preview for peaceful-pothos-9e62ce failed. Why did it fail? →

Name Link
🔨 Latest commit 26ff1db
🔍 Latest deploy log https://app.netlify.com/projects/peaceful-pothos-9e62ce/deploys/6abba23c4c1f190008bdf399

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants