migrate to pnpm#446
Conversation
WalkthroughThis pull request migrates the build system from npm to pnpm across the frontend and Keycloak theme, adding package manager enforcement and lockfile validation. Two enforcement scripts verify pnpm usage and lockfile integrity before install. Package.json files declare pnpm@10.33.4 via the packageManager field and run pre-checks in preinstall/dev/build scripts. pnpm-workspace.yaml files establish policies for dependency builds, release age, and registry-only sources. GitHub Actions workflows in build.yml and keycloak.yml switch to pnpm with lockfile checks and frozen-lockfile installs. Dependabot is configured for frontend npm updates. Documentation and gitignore files are updated to reflect pnpm usage. Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsGit: Failed to clone repository. Please run the Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/package.json`:
- Line 10: The package.json packageManager entry is pointing to a non-existent
pnpm version; update the "packageManager" field value (in package.json) from
"pnpm@10.33.4" to a valid release such as "pnpm@10.33.0" (or to "pnpm@11.x" if
you intend to upgrade), then commit the change so Corepack can install the
correct pnpm version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 04ecc916-5f35-4962-8813-ff651b3c2c69
⛔ Files ignored due to path filters (4)
frontend/package-lock.jsonis excluded by!**/package-lock.jsonfrontend/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlkeycloak/themes/cryptomator/common/resources/package-lock.jsonis excluded by!**/package-lock.jsonkeycloak/themes/cryptomator/common/resources/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (14)
.github/dependabot.yml.github/workflows/build.yml.github/workflows/keycloak.ymlfrontend/.gitignorefrontend/README.mdfrontend/package.jsonfrontend/pnpm-workspace.yamlfrontend/scripts/check-lockfile.shfrontend/scripts/check-pm.jskeycloak/themes/cryptomator/common/resources/.gitignorekeycloak/themes/cryptomator/common/resources/package.jsonkeycloak/themes/cryptomator/common/resources/pnpm-workspace.yamlkeycloak/themes/cryptomator/common/resources/scripts/check-lockfile.shkeycloak/themes/cryptomator/common/resources/scripts/check-pm.js
|
|
||
| - [VSCode](https://code.visualstudio.com/) + [Volar](https://marketplace.visualstudio.com/items?itemName=johnsoncodehk.volar) | ||
|
|
||
| ## Package Manager |
There was a problem hiding this comment.
is this the topmost thing we need to tell people in the readme? 😅
There was a problem hiding this comment.
oi, right, will move the section
|
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/README.md`:
- Around line 50-52: Update the README wording to refer to "GitHub Dependabot"
instead of just "Dependabot" where the file `.github/dependabot.yml` is
mentioned; edit the sentence that currently reads "Routine bumps land through
Dependabot (monthly grouped minor/patch PRs, configured in
`.github/dependabot.yml`)." to use "GitHub Dependabot" so the reference is
clearer and aligns with platform naming.
- Around line 43-45: The sentence "older than the 3 days" is ambiguous and
grammatically incorrect; update the README text (the sentence referencing the
cooldown rule near "minimumReleaseAgeExclude") to use explicit wording such as
"at least 3 days old" (or similar clear phrasing) so it reads: if the package
version is required, pnpm will resolve to the most recent version that is at
least 3 days old; mention "minimumReleaseAgeExclude" unchanged as the config to
bypass this rule.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
2 participants
This PR improves the development security.
It follows suggestions of https://github.com/lirantal/npm-security-best-practices.
The main change is to use
pnpminstead of npm for the following reasons:pnpm-lock.yamlrecords integrity per packagenode_moduleslayout prevents phantom dependencies, so acompromised transitive cannot be
require()-d directly by app codeChanges:
pnpm-lock.yamlreplacingpackage-lock.jsonpnpm-workspace.yamlconfig addedpackageManagerfield in package file for corepack setupAdditional changes:
Remarks:
pnpm11 was released. The pnpm version will be updated in a later PR.(Relates to cryptomator/docs#145)