migrate to pnpm (#1468)

OmarTawfik · web-flow · commit 4fc1d6900a38 · 2025-11-19T19:05:23.000Z
With more strict/secure settings:

- set `minimumReleaseAge` to one week to mitigate issues with installing
compromised deps
- prevent installation/dependency scripts
- update node version to `24.11.0`
- replace `ts-node` with `tsx`
diff --git a/.gitattributes b/.gitattributes
@@ -7,8 +7,8 @@
 
 # Lock Files
 **/Cargo.lock linguist-generated=true
-**/package-lock.json linguist-generated=true
 **/Pipfile.lock linguist-generated=true
+**/pnpm-lock.yaml linguist-generated=true
 
 # VSCode Settings
 .vscode/*.json linguist-language=jsonc
diff --git a/.github/actions/cache/restore/action.yml b/.github/actions/cache/restore/action.yml
@@ -7,7 +7,7 @@ runs:
       uses: "actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57"
       with:
         # __SLANG_CI_CACHE_PATHS__ (keep in sync)
-        key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
+        key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('pnpm-lock.yaml') }}"
         path: |
           ~/.cache/hermit/
           ~/.local/share/virtualenvs/
diff --git a/.github/actions/cache/save/action.yml b/.github/actions/cache/save/action.yml
@@ -7,7 +7,7 @@ runs:
       uses: "actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57"
       with:
         # __SLANG_CI_CACHE_PATHS__ (keep in sync)
-        key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('package-lock.json') }}"
+        key: "cache-${{ github.ref_name }}-${{ hashFiles('Cargo.lock') }}-${{ hashFiles('pnpm-lock.yaml') }}"
         path: |
           ~/.cache/hermit/
           ~/.local/share/virtualenvs/
diff --git a/.npmrc b/.npmrc
@@ -1 +1 @@
-//registry.npmjs.org/:_authToken=${NPM_TOKEN}
+//registry.npmjs.org/:_authToken=${NPM_TOKEN:-undefined}
diff --git a/.prettierignore b/.prettierignore
@@ -20,3 +20,4 @@ documentation/overrides/**/*.html
 # Generated Artifacts
 **/target/
 **/Pipfile.lock
+**/pnpm-lock.yaml
diff --git a/.vscode/settings.json b/.vscode/settings.json
@@ -35,8 +35,8 @@
     "**/target/": true,
     // Lock Files
     "**/Cargo.lock": true,
-    "**/package-lock.json": true,
-    "**/Pipfile.lock": true
+    "**/Pipfile.lock": true,
+    "**/pnpm-lock.yaml": true
   },
   "triggerTaskOnSave.restart": true,
   "triggerTaskOnSave.tasks": {
diff --git a/bin/.node-24.11.0.pkg b/bin/.node-24.11.0.pkg
diff --git a/bin/.pnpm-10.20.0.pkg b/bin/.pnpm-10.20.0.pkg
@@ -0,0 +1 @@
+hermit
diff --git a/bin/corepack b/bin/corepack
@@ -1 +1 @@
-.node@22.9.pkg
+.node-24.11.0.pkg
diff --git a/bin/node b/bin/node
@@ -1 +1 @@
-.node@22.9.pkg
+.node-24.11.0.pkg
diff --git a/bin/npm b/bin/npm
@@ -1 +1 @@
-.node@22.9.pkg
+.node-24.11.0.pkg
diff --git a/bin/npx b/bin/npx
@@ -1 +1 @@
-.node@22.9.pkg
+.node-24.11.0.pkg
diff --git a/bin/pnpm b/bin/pnpm
@@ -0,0 +1 @@
+.pnpm-10.20.0.pkg
diff --git a/crates/infra/cli/package.json b/crates/infra/cli/package.json
diff --git a/crates/infra/cli/src/commands/lint/mod.rs b/crates/infra/cli/src/commands/lint/mod.rs
@@ -199,7 +199,7 @@ fn run_yamllint() -> Result<()> {
     let config_file = Path::repo_path(".yamllint.yml");
 
     let yaml_files = FileWalker::from_repo_root()
-        .find(["**/*.yml"])?
+        .find(["**/*.yml", "**/*.yaml", "!pnpm-lock.yaml"])?
         .inspect(|path| println!("{}", path.display()));
 
     PipEnv::run("yamllint")
diff --git a/crates/infra/cli/src/commands/publish/changesets/mod.rs b/crates/infra/cli/src/commands/publish/changesets/mod.rs
@@ -53,13 +53,6 @@ impl ChangesetsController {
             .property("--write", package_dir.unwrap_str())
             .run();
 
-        // Update NPM lock file:
-
-        Command::new("npm")
-            .arg("install")
-            .flag("--package-lock-only")
-            .run();
-
         // Update Cargo workspace:
 
         println!("Updating Cargo workspace version.");
diff --git a/crates/infra/cli/src/commands/publish/npm/mod.rs b/crates/infra/cli/src/commands/publish/npm/mod.rs
@@ -33,7 +33,7 @@ impl NpmController {
             return Ok(());
         }
 
-        let mut command = Command::new("npm")
+        let mut command = Command::new("pnpm")
             .args(["publish", package_dir.unwrap_str()])
             .flag("--provenance")
             .property("--access", "public");
diff --git a/crates/infra/cli/src/commands/setup/npm/mod.rs b/crates/infra/cli/src/commands/setup/npm/mod.rs
@@ -2,9 +2,11 @@ use infra_utils::commands::Command;
 use infra_utils::github::GitHub;
 
 pub fn setup_npm() {
+    let mut command = Command::new("pnpm").arg("install");
+
     if GitHub::is_running_in_ci() {
-        Command::new("npm").arg("ci").run();
-    } else {
-        Command::new("npm").arg("install").run();
+        command = command.flag("--frozen-lockfile");
     }
+
+    command.run();
 }
diff --git a/crates/infra/cli/src/toolchains/npm/mod.rs b/crates/infra/cli/src/toolchains/npm/mod.rs
@@ -25,7 +25,7 @@ impl Npm {
     pub fn published_version(package_dir: impl AsRef<Path>) -> Result<Version> {
         let package = load_package(package_dir.as_ref())?;
 
-        let version = Command::new("npm")
+        let version = Command::new("pnpm")
             .args(["view", package.name.as_str(), "version"])
             .evaluate()?;
 
diff --git a/crates/solidity/outputs/npm/package/package.json b/crates/solidity/outputs/npm/package/package.json
@@ -45,6 +45,6 @@
     "./utils": "./target/utils/index.mjs"
   },
   "dependencies": {
-    "@bytecodealliance/preview2-shim": "0.17.2"
+    "@bytecodealliance/preview2-shim": "catalog:"
   }
 }
diff --git a/crates/solidity/outputs/npm/package/src/compilation/index.mts b/crates/solidity/outputs/npm/package/src/compilation/index.mts
@@ -1,6 +1,7 @@
 import * as wasm from "../../wasm/index.mjs";
 
-export { CompilationBuilder, CompilationBuilderConfig } from "./builder.mjs";
+export { CompilationBuilder } from "./builder.mjs";
+export type { CompilationBuilderConfig } from "./builder.mjs";
 
 /** {@inheritDoc wasm.compilation.CompilationUnit} */
 export const CompilationUnit = wasm.compilation.CompilationUnit;
diff --git a/crates/solidity/outputs/npm/tests/package.json b/crates/solidity/outputs/npm/tests/package.json
@@ -2,14 +2,7 @@
   "name": "@slang-private/solidity-npm-tests",
   "private": true,
   "type": "module",
-  "dependencies": {
-    "@nomicfoundation/slang": "file:../package"
-  },
   "devDependencies": {
-    "@types/jest": "29.5.14",
-    "jest": "29.7.0",
-    "ts-jest": "29.3.4",
-    "ts-jest-resolver": "2.0.1",
-    "ts-node": "10.9.2"
+    "@nomicfoundation/slang": "workspace:"
   }
 }
diff --git a/crates/solidity/testing/perf/npm/package.json b/crates/solidity/testing/perf/npm/package.json
@@ -2,17 +2,13 @@
   "name": "@slang-private/solidity-testing-perf-npm",
   "private": true,
   "type": "module",
-  "dependencies": {
-    "@nomicfoundation/slang": "file:../../../outputs/npm/package/",
-    "@openzeppelin/contracts": "^5.2.0",
-    "@solidity-parser/parser": "^0.20.1",
-    "command-line-args": "^6.0.1",
-    "command-line-usage": "^7.0.3",
-    "solc": "^0.8.29"
-  },
   "devDependencies": {
-    "@types/command-line-args": "^5.2.3",
-    "@types/command-line-usage": "^5.0.4",
-    "@types/node": "^22.15.17"
+    "@nomicfoundation/slang": "workspace:",
+    "@openzeppelin/contracts": "catalog:",
+    "@solidity-parser/parser": "catalog:",
+    "@types/command-line-args": "catalog:",
+    "@types/command-line-usage": "catalog:",
+    "command-line-args": "catalog:",
+    "command-line-usage": "catalog:"
   }
 }
diff --git a/documentation/mkdocs.yml b/documentation/mkdocs.yml
@@ -17,6 +17,9 @@ edit_uri: "edit/main/documentation/public"
 
 docs_dir: "./public"
 site_dir: "./target/site" # _SLANG_MKDOCS_DOCUMENTATION_SITE_DIR_ (keep in sync)
+exclude_docs: |
+  /user-guide/node_modules
+  /user-guide/target
 
 validation:
   nav:
diff --git a/documentation/public/user-guide/package.json b/documentation/public/user-guide/package.json
@@ -2,14 +2,7 @@
   "name": "@slang-private/solidity-user-guide",
   "private": true,
   "type": "module",
-  "dependencies": {
-    "@nomicfoundation/slang": "file:../../../crates/solidity/outputs/npm/package"
-  },
   "devDependencies": {
-    "@types/jest": "29.5.14",
-    "jest": "29.7.0",
-    "ts-jest": "29.3.4",
-    "ts-jest-resolver": "2.0.1",
-    "ts-node": "10.9.2"
+    "@nomicfoundation/slang": "workspace:"
   }
 }
diff --git a/jest.config.ts b/jest.config.ts
@@ -31,7 +31,6 @@ export default {
     "^.+\\.m?[tj]sx?$": [
       "ts-jest",
       {
-        isolatedModules: true,
         useESM: true,
       },
     ],
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
diff --git a/tsconfig.json b/tsconfig.json

Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-//registry.npmjs.org/:_authToken=${NPM_TOKEN}`
	`1`	`+//registry.npmjs.org/:_authToken=${NPM_TOKEN:-undefined}`