Migrate to pnpm - #2166
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR migrates the repository’s developer/CI workflows from npm to pnpm to improve install performance and align with a pinned package manager version.
Changes:
- Switches CI/release pipelines, local scripts, and test harnesses from
npm/npxtopnpm/pnpm exec/pnpm dlx. - Updates contributor and test documentation to use pnpm commands and adds a
packageManagerpin inpackage.json. - Introduces
pnpm-workspace.yamlto configure build-script allowlisting.
Reviewed changes
Copilot reviewed 11 out of 13 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/rspack/rspack.test.js | Uses pnpm run build to ensure dist artifacts exist before rspack tests. |
| tests/browser/README.md | Updates Docker-based browser test instructions to pnpm. |
| tests/browser/playwright.config.js | Runs the Playwright web server via pnpm script. |
| tests/bench/size.js | Updates the “run build first” message to reference pnpm. |
| tasks/version.js | Uses pnpm for the build step during versioning workflow. |
| README.md | Updates benchmark usage examples from npm to pnpm. |
| pnpm-workspace.yaml | Adds pnpm workspace configuration (allowBuilds). |
| package.json | Converts scripts to pnpm, switches npx to pnpm dlx, pins packageManager. |
| CONTRIBUTING.md | Documents pnpm/Corepack-based setup and command updates. |
| .github/workflows/release.yml | Migrates release workflow install/publish steps to pnpm with caching. |
| .github/workflows/ci.yml | Migrates CI to pnpm with caching and adjusts Node test matrix. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+1
to
+2
| allowBuilds: | ||
| husky: true |
Contributor
Author
There was a problem hiding this comment.
this is wrong, packages is optional
| Before building, you need to make sure that the Git submodule `spec/mustache` is included (i.e. the directory `spec/mustache` should not be empty). To include it, if using Git version 1.6.5 or newer, use `git clone --recursive` rather than `git clone`. Or, if you already cloned without `--recursive`, use `git submodule update --init`. | ||
|
|
||
| Project dependencies may be installed via `npm install`. | ||
| This project uses [pnpm](https://pnpm.io/) as its package manager (the required version is pinned in the `packageManager` field of `package.json`). The easiest way to get the right version is via [Corepack](https://nodejs.org/api/corepack.html), which ships with Node.js: run `corepack enable` once, and pnpm commands will automatically use the pinned version. |
| "test:serve": "npx serve -l 9999 .", | ||
| "test:integration": "npm run build && ./tests/integration/run-integration-tests.sh", | ||
| "test:serve": "pnpm dlx serve -l 9999 .", | ||
| "test:integration": "pnpm run build && ./tests/integration/run-integration-tests.sh", |
Contributor
Author
There was a problem hiding this comment.
Intentional. The fixtures (rollup-test, webpack-test, multi-nodejs-test) deliberately use npm/nvm to simulate real downstream consumers installing the published package with different toolchains. Migrating them to pnpm would change what's being tested.
| pnpm run build | ||
| docker pull mcr.microsoft.com/playwright:focal | ||
| docker run -it --rm --volume $(pwd):/srv/app --workdir /srv/app --ipc=host mcr.microsoft.com/playwright:focal npm run test:browser | ||
| docker run -it --rm --volume $(pwd):/srv/app --workdir /srv/app --ipc=host mcr.microsoft.com/playwright:focal pnpm run test:browser |
Comment on lines
39
to
+42
| # https://nodejs.org/en/about/releases/ | ||
| node-version: ['20', '22', '24'] | ||
| # Node 20 is supported at runtime (see "engines" in package.json) but is | ||
| # not exercised in CI because pnpm >=11 requires Node >=22.13. | ||
| node-version: ['22', '24'] |
jaylinski
approved these changes
Jun 15, 2026
jaylinski
left a comment
jaylinski
left a comment
Member
There was a problem hiding this comment.
Thanks! I'm very much in favor of switching to pnpm. npm is waking up regarding security, but who knows how long it will take them to actually ship those security features that pnpm already has.
Please have a look at the Copilot review, but from my point of view the PR is approved.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pnpm is both a more secure and faster alternative to npm