Migrate to pnpm v10 as package manager - #435
Conversation
|
@nohwnd I just noticed Netlify has been using |
yarn.lock was deleted here and bumped by dependabot on main. Keeping it deleted, pnpm-lock.yaml already resolves brace-expansion 1.1.18 and js-yaml 4.3.1.
Netlify was still running 'npm run build' from the UI settings. Move the build command and publish dir into the repo so they are versioned.
|
Went with netlify.toml, pushed it to your branch along with a merge of main. yarn.lock conflicted, kept it deleted, pnpm-lock already has the versions dependabot bumped. Build command is The UI settings are overridden by the file now, so leave them or clear them, does not matter. One thing I cannot check: if there is a 🤖 |
…444) Main does not build since #435. The tutorial components and the swizzled theme files from #421 import @docusaurus/plugin-content-docs/client and @docusaurus/theme-common, but neither package is in package.json. They only ever came in transitively through @docusaurus/preset-classic, and yarn hoisted them into a flat node_modules so the imports resolved. pnpm uses a strict layout where a package that is not declared is not resolvable, so the client bundle now fails with 8 "Module not found" errors. Both PRs are green on their own, the combination is what breaks, so neither deploy preview caught it. Verified: pnpm build fails on 1c880e9 and passes with this change. 🤖
2 participants
Replaces yarn v1 (classic) with pnpm v10 as new package manager. pnpm is a popular and modern package manager:
Pinning pnpm v10 for now because Dependabot-support for v11 is still in beta. Might go straight to v12 when ready.
One of the security features is blocking postinstall-scripts in packages. Currently configured:
@swc/core: Allowed. Used by docusaurus. Downloads a OS-dependent native binary.core-js: Denied. Just a funding notice.Fix #275