chore: update package manager from yarn to pnpm#2465
chore: update package manager from yarn to pnpm#2465Suvidh-kaushik wants to merge 3 commits intoRealDevSquad:developfrom
Conversation
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Summary by CodeRabbit
WalkthroughDocumentation and tooling migrate from Yarn to PNPM. README commands are updated accordingly. package.json switches scripts to PNPM, adds packageManager and Volta PNPM config, and introduces lodash as a new dependency. Postinstall and test scripts now invoke PNPM. Production prune notes removed from docs. Changes
Sequence Diagram(s)sequenceDiagram
actor Developer
participant PNPM
participant Scripts as Project Scripts
Developer->>PNPM: pnpm install / pnpm dev / pnpm test
PNPM->>Scripts: Run tsc, lint, unit/integration tests
Scripts-->>Developer: Build/test results
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🔭 Outside diff range comments (1)
README.md (1)
31-36: Clarify pnpm installation via Corepack; minor capitalization/grammarRecommend guiding contributors to activate pnpm with Corepack and capitalize Volta.
-Please install `pnpm` and `volta` +Please install `pnpm` and `Volta`. + +If you have Node.js 16+ (Corepack is bundled), activate the pinned pnpm version: + +```shell +corepack enable +corepack prepare pnpm@10.14.0 --activate +```
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (2)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlyarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (2)
README.md(4 hunks)package.json(3 hunks)
🧰 Additional context used
🪛 GitHub Actions: Tests
package.json
[error] 1-1: Run yarn failed due to Yarn/Corepack misconfiguration: project defines packageManager 'yarn@pnpm@10.14.0' but the global Yarn version is 1.22.22. Enable Corepack by running 'corepack enable'.
🪛 LanguageTool
README.md
[grammar] ~31-~31: Use correct spacing
Context: ... Development Please install pnpm and volta [Why Volta?](https://docs.volta.sh/guide/...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~44-~44: Make sure you are using the right part of speech
Context: ...o ensure that the yarn.lock file is not update, you will need to use the --frozen-lock...
(QB_NEW_EN_OTHER_ERROR_IDS_21)
[grammar] ~44-~44: Use correct spacing
Context: ... need to use the --frozen-lockfile flag. shell pnpm install --frozen-lockfile #### Confirm correct configuration setup Thi...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~71-~71: Use correct spacing
Context: ...h #### Running a server in Dev mode shell pnpm dev ``` ## What happens in production: - Install p...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~77-~77: Use correct spacing
Context: ... dev ## What happens in production: - Install packages pnpm install --pro...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~79-~79: There might be a mistake here.
Context: ...ppens in production: - Install packages pnpm install --prod - Run tests pnpm run test - Run ...
(QB_NEW_EN_OTHER)
[grammar] ~85-~85: There might be a problem here.
Context: ...pnpm install --prod - Run tests pnpm run test - Run start command (with port information) ...
(QB_NEW_EN_MERGED_MATCH)
[grammar] ~91-~91: There might be a mistake here.
Context: ...un start command (with port information) pnpm start Note: These are handled automatically be...
(QB_NEW_EN_OTHER)
🪛 markdownlint-cli2 (0.17.2)
README.md
43-43: Fenced code blocks should be surrounded by blank lines
(MD031, blanks-around-fences)
77-77: Trailing punctuation in heading
Punctuation: ':'
(MD026, no-trailing-punctuation)
81-81: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
87-87: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
93-93: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🔇 Additional comments (4)
package.json (1)
15-15: LGTM on test script migrationThe consolidated
testscript correctly switches to pnpm equivalents.README.md (3)
56-57: LGTM: validate-setup commandThe switch to
pnpm validate-setupmatches the scripts in package.json. pnpm supports running scripts withoutrun.
68-69: LGTM: tdd script invocationUsing
pnpm tdd:watchis correct with pnpm’s script runner.
74-75: LGTM: dev server
pnpm devcorrectly maps to the existing script.
| "start": "node ./dist/server.js", | ||
| "tsc": "tsc", | ||
| "postinstall": "yarn run tsc", | ||
| "postinstall": "pnpm tsc", |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Reconsider postinstall build: will break with production-only installs
postinstall runs in production too. Since tsc is a devDependency, pnpm install --prod (as recommended in README) will not install TypeScript and this hook will fail. Move compilation to an explicit build script and call it from CI/deploy, or guard the hook against missing dev deps.
Apply one of these diffs:
Option A (preferred: explicit build)
- "postinstall": "pnpm tsc",
+ "build": "pnpm tsc",Then ensure CI/deploy runs pnpm build before pnpm start.
Option B (guarded postinstall; POSIX shells)
- "postinstall": "pnpm tsc",
+ "postinstall": "command -v tsc >/dev/null 2>&1 && pnpm tsc || echo \"Skipping TypeScript build (tsc not available)\"",If you’re deploying to Windows environments as well, prefer Option A.
To confirm whether Heroku/CI expects postinstall, and whether devDeps are available at deploy time, search your workflows/buildpack config:
🏁 Script executed:
#!/bin/bash
rg -n -C2 -g ".github/workflows/**" -P '\bpostinstall\b|\bbuild\b|\bpnpm\b|\byarn\b'Length of output: 235
I’d like to inspect your package.json scripts and search for any CI/YAML configs or Heroku references to confirm how you’re building/deploying. Running:
🏁 Script executed:
#!/bin/bash
set -e
echo ">>> package.json ‘scripts’ section:"
if command -v jq >/dev/null 2>&1; then
jq .scripts package.json
else
grep -R '"scripts"' -n package.json -A20
fi
echo -e "\n>>> CI config files (*.yml, *.yaml):"
find . -maxdepth 3 -type f \( -name "*.yml" -o -name "*.yaml" \) -print
echo -e "\n>>> Searching for ‘heroku’ references:"
rg -n "heroku" --glob '!*node_modules*' || echo "No matches"Length of output: 1103
🏁 Script executed:
#!/bin/bash
set -e
echo ">>> devDependencies in package.json:"
jq .devDependencies package.json
echo -e "\n>>> README: recommended install commands (lines around --prod):"
rg -n -C2 '\-\-prod' README.md || echo "No matches for “--prod” in README.md"
echo -e "\n>>> CI workflow install steps:"
rg -nP 'run:\s*pnpm install\b|run:\s*npm install\b' -C2 .github/workflowsLength of output: 1387
Move TypeScript compile out of postinstall
The postinstall hook still runs under pnpm install --prod, but since TypeScript lives in devDependencies it won’t be present and your build will fail. Extract compilation to a dedicated build script and invoke it explicitly in CI/deploy.
• package.json, scripts section (around line 8):
"scripts": {
- "postinstall": "pnpm tsc",
+ "build": "pnpm tsc",
"start": "node ./dist/server.js",
…
}• Update your CI/deployment workflows to run:
pnpm install
pnpm build
pnpm startOptionally, if you really must keep compilation on install, guard against missing tsc:
- "postinstall": "pnpm tsc",
+ "postinstall": "command -v tsc >/dev/null 2>&1 && pnpm tsc || echo \"Skipping TypeScript build (tsc not available)\"",🤖 Prompt for AI Agents
In package.json around line 8, the postinstall hook runs "pnpm tsc" which fails
when installing with --prod because TypeScript is a devDependency; remove
"postinstall": "pnpm tsc" and instead add a "build" script that runs the
TypeScript compiler, update CI/deploy workflows to run pnpm install then pnpm
build then pnpm start, and if you must keep compilation during install wrap the
postinstall command in a conditional that checks for tsc availability before
invoking it.
| "joi": "17.12.2", | ||
| "jsdoc": "4.0.2", | ||
| "jsonwebtoken": "^8.5.1", | ||
| "lodash": "^4.17.21", |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Question: Why introduce lodash in a package-manager-only PR?
Adding a new runtime dependency changes attack surface and deployment footprint and is out of scope for a tooling migration. If not strictly required, please drop it; otherwise, justify usage and add tests.
Run this to verify actual usage before keeping it:
If only a couple of utilities are needed, prefer ES built-ins or targeted imports like lodash.get to reduce bundle surface.
🏁 Script executed:
#!/bin/bash
# Look for explicit lodash imports/requires
rg -n -C2 -t js -t ts -P "(from\\s+['\"]lodash['\"]|require\\(['\"]lodash['\"]\\))"Length of output: 1577
🏁 Script executed:
#!/bin/bash
# Display the contents of utils/logs.js to confirm lodash usage
echo "=== utils/logs.js (first 200 lines) ==="
sed -n '1,200p' utils/logs.js
echo
echo "=== Instances of '_' usage in utils/logs.js ==="
rg -n -C1 '\b_\.' utils/logs.jsLength of output: 5223
🏁 Script executed:
#!/bin/bash
# Inspect lodash usage in test files to see which utilities are used
for f in test/unit/middlewares/oooRequests.test.ts test/integration/impersonationRequests.test.ts test/integration/requests.test.ts; do
echo "=== $f (first 200 lines) ==="
sed -n '1,200p' "$f"
echo
echo "=== lodash method calls in $f ==="
rg -n '\b_\.[a-zA-Z]\w*\b' -C1 "$f" || echo "No lodash calls found"
echo
doneLength of output: 20225
Consider removing lodash or using targeted imports
I see that lodash was added as a runtime dependency but is only used for _.omit in:
- utils/logs.js (formatTaskRequestsLogs:
..._.omit(formattedData, "users")) - Tests in
- test/unit/middlewares/oooRequests.test.ts
- test/integration/impersonationRequests.test.ts
- test/integration/requests.test.ts
If lodash isn’t strictly required, please remove it and replace all uses of _.omit with object rest/spread/destructuring. For example in utils/logs.js:
// Before
..._.omit(formattedData, "users")
// After
const { users, ...others } = formattedData;
...othersAnd in tests:
// Before
.body(_.omit(obj, "comment"))
// After
const { comment, ...body } = obj;
.body(body)Otherwise, minimize our footprint by installing only the needed function:
npm install lodash.omitimport omit from "lodash.omit";This avoids expanding our runtime attack surface and bundle size.
🤖 Prompt for AI Agents
In package.json around line 36, lodash was added as a runtime dependency but the
codebase only uses _.omit; remove the full lodash package and replace usages of
_.omit with native object rest/spread or, if you prefer to keep a tiny
dependency, replace the dependency with the specific lodash.omit package. Update
utils/logs.js and the three test files to destructure the omitted key (e.g.,
const { users, ...rest } = formattedData) and use rest instead of _.omit, or
import and use lodash.omit after installing it; finally remove "lodash" from
package.json and run install to update lockfile.
| "pnpm": "10.14.0" | ||
| }, | ||
| "packageManager": "pnpm@10.14.0" |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Fix CI: enable Corepack and migrate workflows from Yarn to pnpm
The pipeline failed with “Run yarn” and a Corepack error. With packageManager: "pnpm@10.14.0" and Volta pinning, you must:
- Enable Corepack and prepare the pinned pnpm version in CI.
- Replace any Yarn invocations in GitHub Actions with pnpm.
Use this script to locate remaining Yarn usage and lockfiles:
Suggested CI snippet (for reference):
- uses: actions/setup-node@v4
with:
node-version-file: package.json
cache: 'pnpm'
cache-dependency-path: pnpm-lock.yaml
- run: corepack enable
- run: corepack prepare pnpm@10.14.0 --activate
- run: pnpm install --frozen-lockfile
- run: pnpm testI can open a follow-up PR updating your workflows to pnpm with Corepack if you’d like.
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Workflows using yarn:"
rg -n -C2 -g ".github/workflows/**" -P '\byarn\b'
echo -e "\nLockfiles present:"
fd -H -a 'yarn.lock' || true
fd -H -a 'pnpm-lock.yaml' || trueLength of output: 273
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Searching for 'yarn' in GitHub Actions workflows..."
rg -n -C2 '\byarn\b' .github/workflows || echo "No 'yarn' usage found in .github/workflows"
echo -e "\nListing lockfiles in the repo:"
find . -type f \( -name 'yarn.lock' -o -name 'pnpm-lock.yaml' \) || trueLength of output: 564
Fix CI workflows: replace Yarn invocations and enable Corepack for pnpm
The repo still has a Yarn command in your GitHub Actions (no yarn.lock detected, only pnpm-lock.yaml):
• .github/workflows/test.yml (lines 26–27)
run: yarnrun: yarn test
Please update your workflow to use pnpm and Corepack, for example:
- uses: actions/setup-node@v4
with:
node-version-file: package.json
cache: 'pnpm'
cache-dependency-path: pnpm-lock.yaml
- run: corepack enable
- run: corepack prepare pnpm@10.14.0 --activate
- run: pnpm install --frozen-lockfile
- run: pnpm testLet me know if you’d like me to open a follow-up PR converting all workflows.
🤖 Prompt for AI Agents
In package.json around lines 89-91, CI still references Yarn in workflows
(actions/test.yml uses `yarn` at lines ~26-27) while the repo uses pnpm; update
the workflow to use pnpm and Corepack by switching the setup-node step to read
node-version-file from package.json and enable pnpm caching, then add steps to
run `corepack enable`, prepare/activate the specific pnpm version from
package.json, run `pnpm install --frozen-lockfile`, and replace `yarn`/`yarn
test` invocations with `pnpm`/`pnpm test`.
| ```shell | ||
| yarn | ||
| pnpm | ||
| ``` | ||
| Now if one runs yarn install. The yarn.lock will be unexpectedly updated with an unknown future version of a dependency, potentially breaking the build in the future. To ensure that the yarn.lock file is not update, you will need to use the --frozen-lockfile flag. | ||
|
|
||
| ```shell | ||
| yarn install --frozen-lockfile | ||
| pnpm install --frozen-lockfile | ||
| ``` |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Fix install command and remove Yarn-specific paragraph
The code block pnpm is not a valid install command. The paragraph below still references Yarn and yarn.lock, which is inconsistent with the pnpm migration. Also add the fenced code language and surround fences with blank lines.
-```shell
-pnpm
-```
-Now if one runs yarn install. The yarn.lock will be unexpectedly updated with an unknown future version of a dependency, potentially breaking the build in the future. To ensure that the yarn.lock file is not update, you will need to use the --frozen-lockfile flag.
-
-```shell
-pnpm install --frozen-lockfile
-```
+```shell
+pnpm install
+```
+
+To ensure your lockfile is not modified during CI or reproducible installs, use the frozen lockfile:
+
+```shell
+pnpm install --frozen-lockfile
+```
+
+Note: pnpm uses `pnpm-lock.yaml` (not `yarn.lock`).🧰 Tools
🪛 LanguageTool
[grammar] ~44-~44: Make sure you are using the right part of speech
Context: ...o ensure that the yarn.lock file is not update, you will need to use the --frozen-lock...
(QB_NEW_EN_OTHER_ERROR_IDS_21)
[grammar] ~44-~44: Use correct spacing
Context: ... need to use the --frozen-lockfile flag. shell pnpm install --frozen-lockfile #### Confirm correct configuration setup Thi...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
🪛 markdownlint-cli2 (0.17.2)
43-43: Fenced code blocks should be surrounded by blank lines
(MD031, blanks-around-fences)
🤖 Prompt for AI Agents
In README.md around lines 41 to 48, replace the invalid code block containing
just "pnpm" with a proper fenced shell block showing "pnpm install" (ensure
blank lines before and after the fences), remove the Yarn-specific paragraph and
references to yarn.lock, add a short paragraph instructing to use the frozen
lockfile for reproducible installs, and include a second fenced shell block
showing "pnpm install --frozen-lockfile"; also add a final note that pnpm uses
pnpm-lock.yaml (not yarn.lock).
| ## What happens in production: | ||
|
|
||
| - Install packages | ||
|
|
||
| ``` | ||
| yarn | ||
| pnpm install --prod | ||
| ``` | ||
|
|
||
| - Run tests | ||
|
|
||
| ``` | ||
| yarn run test | ||
| ``` | ||
|
|
||
| - Prune dev dependencies | ||
|
|
||
| ``` | ||
| npm prune --production | ||
| pnpm run test | ||
| ``` | ||
|
|
||
| - Run start command (with port information) | ||
|
|
||
| ``` | ||
| yarn start | ||
| pnpm start | ||
| ``` | ||
|
|
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Production section: heading, fenced languages, and install/test flow
- Remove trailing colon in the heading (markdownlint MD026).
- Add language specifiers to code fences (MD040) and blank lines around fences (MD031).
- Running
pnpm install --prodand thenpnpm run testwill fail because tests need devDependencies. Either:- Run tests after a full install, then prune to prod; or
- Don’t run tests in production docs and leave that to CI.
-## What happens in production:
+## What happens in production
- Install packages
-
-```
-pnpm install --prod
-```
+```shell
+# Install all deps to run tests (CI step)
+pnpm install --frozen-lockfile
+```
- Run tests
-
-```
-pnpm run test
-```
+```shell
+pnpm run test
+```
- Run start command (with port information)
-
-```
-pnpm start
-```
+```shell
+pnpm start
+```
Note: These are handled automatically behind the scene when pushing to [Heroku](https://devcenter.heroku.com/)If you prefer to keep the “prod-only install” guidance, drop the test step or add a prune step after tests:
🏁 Script executed:
#!/bin/bash
echo "If keeping tests, prefer:"
echo "pnpm install --frozen-lockfile && pnpm test && pnpm prune --prod"Length of output: 199
Update production instructions
Please remove the trailing colon, add blank lines around your fenced blocks, specify shell as the language, and correct the install/test flow so tests don’t break when devDependencies are omitted. For example:
-## What happens in production:
+## What happens in production
- Install packages
-
-```
-pnpm install --prod
-```
+```shell
+# Install all deps, run tests, then prune devDependencies for production
+pnpm install --frozen-lockfile
+pnpm run test
+pnpm prune --prod
+```
- Run start command (with port information)
-
-```
-pnpm start
-```
+```shell
+pnpm start
+```
Note: When deploying to Heroku this entire workflow is run automatically.🧰 Tools
🪛 LanguageTool
[grammar] ~77-~77: Use correct spacing
Context: ... dev ## What happens in production: - Install packages pnpm install --pro...
(QB_NEW_EN_OTHER_ERROR_IDS_5)
[grammar] ~79-~79: There might be a mistake here.
Context: ...ppens in production: - Install packages pnpm install --prod - Run tests pnpm run test - Run ...
(QB_NEW_EN_OTHER)
[grammar] ~85-~85: There might be a problem here.
Context: ...pnpm install --prod - Run tests pnpm run test - Run start command (with port information) ...
(QB_NEW_EN_MERGED_MATCH)
[grammar] ~91-~91: There might be a mistake here.
Context: ...un start command (with port information) pnpm start Note: These are handled automatically be...
(QB_NEW_EN_OTHER)
🪛 markdownlint-cli2 (0.17.2)
77-77: Trailing punctuation in heading
Punctuation: ':'
(MD026, no-trailing-punctuation)
81-81: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
87-87: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
93-93: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
In README.md around lines 77 to 96, remove the trailing colon after the heading,
add blank lines before and after each fenced code block, mark the fenced blocks
with "shell" as the language, and replace the install/test/production steps so
tests run before removing devDependencies: change the install line to run a full
install with the lockfile (pnpm install --frozen-lockfile), run tests (pnpm run
test), then prune devDependencies for production (pnpm prune --prod) inside a
single fenced shell block, and update the start command block to a separate
fenced shell block containing pnpm start.
Suvidh-kaushik
force-pushed
the
update/package_manager
branch
2 times, most recently
from
cbe47d7 to
838aed8
Compare
Suvidh-kaushik
force-pushed
the
update/package_manager
branch
from
838aed8 to
5ebf7c4
Compare
1 participant
Date: 18/08/2025
Developer Name: Suvidh Kaushik
Issue Ticket Number
Description
Documentation Updated?
Under Feature Flag
Database Changes
Breaking Changes
Development Tested?
Screenshots
Screenshot 1
Test Coverage
Screenshot 1
Additional Notes
Description by Korbit AI
What change is being made?
Update the package manager from Yarn to PNPM in the codebase and documentation.
Why are these changes being made?
Switching to PNPM improves package installation speed and disk space efficiency due to its unique monorepo package management approach. The change ensures consistency across development and production environments and prevents unintended updates to lock files, thus enhancing build reliability.