chore: pnpm — the fleet has one package manager - #889
Merged
Conversation
- packageManager pnpm@11.25.0; lockfile via pnpm import, package-lock.json removed - npm "overrides" moved to pnpm-workspace.yaml overrides (pnpm ignores the npm-only package.json field); nested gray-matter>js-yaml pin kept; $sharp reference spelled out (pnpm 11 deprecates $ syntax) - allowBuilds for native/postinstall deps; temporary minimumReleaseAgeExclude for our own @bitbaum/ai-kit@0.6.2 (published <24h ago — pnpm 11's supply-chain window would refuse it) - postinstall dropped: it was the npm optional-deps sharp workaround (npm/cli#4828); pnpm resolves optional deps correctly - CI/CD/e2e-auth workflows: pnpm/action-setup@v6, store-dir pinned outside the action's bin dir, cache: pnpm, frozen-lockfile installs, pnpm run; Next cache key now hashes pnpm-lock.yaml; npm audit → pnpm audit --prod - phantom deps declared: espree (eslint.config.mjs) and @mdx-js/mdx (scripts/check-mdx.mjs), previously resolved via npm hoisting only - package.json scripts, husky hooks, deploy-selfhost.sh converted to pnpm Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WqKqMnHQHSmkGFfc5t7Rxn
@radix-ui/react-visually-hidden (CommandPalette.tsx) resolved locally through the parent repo's hoisted npm node_modules. Declared; a full src/ bare-import sweep against package.json now reports no other undeclared specifier. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WqKqMnHQHSmkGFfc5t7Rxn
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WqKqMnHQHSmkGFfc5t7Rxn
…o save The audit step itself passed (2 moderate, below the high gate); the job went red in setup-node's POST step, which fails when the cache path it was told to save (the pnpm store) was never created. This job only needs the lockfile. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WqKqMnHQHSmkGFfc5t7Rxn
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Converts orangecat to pnpm 11.25.0 (Wave 7 Phase B, batch 3a).
packageManager: pnpm@11.25.0; lockfile generated viapnpm import,package-lock.jsonremovedoverridesmoved from package.json topnpm-workspace.yamloverrides— pnpm silently ignores the npm-only field, so the security pins were about to stop applying. Nestedgray-matter > js-yamlpin kept; the deprecated$sharpreference is spelled out as^0.35.4allowBuildsfor native/postinstall deps; temporaryminimumReleaseAgeExcludefor our own@bitbaum/ai-kit@0.6.2(published <24h ago, inside pnpm 11's supply-chain release-age window)postinstalldropped: it was the npm optional-deps sharp workaround ([BUG] Platform-specific optional dependencies not being included inpackage-lock.jsonwhen reinstalling withnode_modulespresent npm/cli#4828); pnpm resolves optional deps correctlypnpm/action-setup@v6, store-dir pinned outside the action's bin dir,cache: pnpm,pnpm install --frozen-lockfile,pnpm run; Next build cache key hashespnpm-lock.yaml;npm audit --omit=dev→pnpm audit --prodespree(eslint.config.mjs) and@mdx-js/mdx(scripts/check-mdx.mjs) now declared devDependenciesVerified locally: lint (0 errors), type-check, full vitest (282 files, 2648 passed), production build with CI-style env.
.env.localuntouched.🤖 Generated with Claude Code
https://claude.ai/code/session_01WqKqMnHQHSmkGFfc5t7Rxn