feat: Switch to pnpm for build (#497)

Applied the requested change from @sedghi on this.

* feat: Switch to pnpm for build

* fix: pnpm version specified twice

* fix GHSA-px68-xx5g-48q5

* fix: Node versions 20 and later now

* Update pinned versions to fix a moderate security issue

* .claude ignore

* fix: Update to pnpm 11 for better security

* fix: pnpm supply chain recommendations

* Update to node 22.13 or later for testing

Author: wayfarer3130

.github/workflows/lint-and-format.yml

@@ -7,21 +7,27 @@ on:
 jobs:
   lint-and-format:
     runs-on: ubuntu-latest
+    env:
+      PNPM_CONFIG_FROZEN_LOCKFILE: "true"
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 18
+          node-version: 24
+          cache: pnpm
 
       - name: Install packages
-        run: yarn install --frozen-lockfile
+        run: pnpm install
 
       - name: Run ESLint
-        run: yarn lint
+        run: pnpm lint
 
       - name: Check Prettier formatting
-        run: yarn format:check
+        run: pnpm format:check

.github/workflows/pnpm-audit.yml

@@ -0,0 +1,34 @@
+name: pnpm audit
+
+on:
+  push:
+    paths:
+      - "pnpm-lock.yaml"
+  pull_request:
+    paths:
+      - "pnpm-lock.yaml"
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    env:
+      PNPM_CONFIG_FROZEN_LOCKFILE: "true"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install packages
+        run: pnpm install
+
+      - name: Audit (fail on high or critical)
+        run: pnpm audit --audit-level=high

.github/workflows/publish-package.yml

@@ -15,27 +15,33 @@ jobs:
   publish-package:
     runs-on: ubuntu-latest
     environment: publish
+    env:
+      PNPM_CONFIG_FROZEN_LOCKFILE: "true"
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 24
           registry-url: 'https://registry.npmjs.org'
+          cache: pnpm
 
       - name: Install packages
-        uses: bahmutov/npm-install@v1
+        run: pnpm install
 
       - name: Run tests
-        run: npm run test
+        run: pnpm test
 
       - name: Run build
-        run: npm run build
+        run: pnpm build
 
       - name: Semantic release
         uses: cycjimmy/semantic-release-action@v6

.github/workflows/tests.yml

@@ -7,18 +7,52 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: [22, 24]
+    env:
+      PNPM_CONFIG_FROZEN_LOCKFILE: "true"
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 18
+          node-version: ${{ matrix.node-version }}
+          cache: pnpm
 
       - name: Install packages
-        run: yarn install --frozen-lockfile
+        run: pnpm install
 
       - name: Run tests
-        run: yarn test
+        run: pnpm test
+
+  build:
+    runs-on: ubuntu-latest
+    env:
+      PNPM_CONFIG_FROZEN_LOCKFILE: "true"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - name: Install packages
+        run: pnpm install
+
+      - name: Build
+        run: pnpm run build

.gitignore

@@ -1,11 +1,13 @@
-
+.claude
 *.sw*
 *~
 
 node_modules
 .idea
 *.iml
 yarn-error.log
+pnpm-debug.log
 .DS_Store
 build
+examples/js/dcmjs*
 *.code-workspace

.husky/pre-commit

@@ -0,0 +1 @@
+pnpm exec lint-staged

.npmrc

@@ -0,0 +1,5 @@
+save-exact=true
+# Supply-chain / install policy (minimumReleaseAge, trustPolicy, allowBuilds, …): pnpm-workspace.yaml
+# In GitHub Actions, workflows set PNPM_CONFIG_FROZEN_LOCKFILE=true so `pnpm install`
+# fails when pnpm-lock.yaml is out of date with package.json. Locally, run
+# `pnpm run install:update-lockfile` after dependency changes.

README.md

@@ -56,24 +56,41 @@ _Parts of DICOM that dcmjs *will not* focus on:_
 
 ## In Node
 
-```None
-// To install latest _stable_ release
-npm install --save dcmjs
+Add **dcmjs** to your application (pnpm):
 
-// To install latest code merged to master
-npm install --save dcmjs@dev
+```bash
+pnpm add dcmjs       # latest stable release
+pnpm add dcmjs@dev   # latest code merged to master
 ```
 
+The same versions can be installed with `npm install` or Yarn in **your** project; those clients are fine for consuming the published package. **Building this repository** is pnpm-only (see below).
+
 ## For Developers
 
-```None
+Building and testing this repository requires **[pnpm](https://pnpm.io/)** and **Node.js 22.13 or newer** (pnpm 11 and this repo’s tooling expect that baseline; Rollup’s dependency chain expects a modern `crypto` global). CI runs tests on Node 22 and 24, and runs the production Rollup build on Node 24. The pnpm version is pinned under `packageManager` in `package.json`. Enable [Corepack](https://nodejs.org/api/corepack.html) (`corepack enable`) and use pnpm for every install and script:
+
+```bash
+corepack enable
 git clone https://github.com/dcmjs-org/dcmjs
 cd dcmjs
-npm install
-npm run build
-npm test
+pnpm install
+pnpm run build
+pnpm test
+```
+
+Other common tasks:
+
+```bash
+pnpm run build:examples   # Rollup build + copy bundles into examples/js
+pnpm run lint             # ESLint (writes fixes)
+pnpm run format           # Prettier (writes)
+pnpm run format:check     # Prettier (check only)
 ```
 
+**Yarn is no longer supported** for working in this repo: there is no `yarn.lock`, and installs, builds, and CI are aligned with `pnpm-lock.yaml` only. Use pnpm so dependency resolution matches lockfile and automation.
+
+After changing dependencies in `package.json`, refresh the lockfile with `pnpm run install:update-lockfile` (or `pnpm install --no-frozen-lockfile`) before opening a PR.
+
 ## For Maintainers and Contributors
 
 Publish new version automatically from commit:
@@ -94,8 +111,9 @@ It is advised to use the git-cz, i.e.:
 
 - install git-cz
 
-```
-npm install -g git-cz
+```bash
+pnpm add -g git-cz
+# or: npm install -g git-cz
 ```
 
 - how to commit
@@ -122,13 +140,13 @@ When DICOM standards are updated or new tags need to be added:
 
 1. **Generate the dictionary from DICOM standards** (downloads latest PS3.6 and PS3.7 XML from dicom.nema.org):
    ```bash
-   npm run generate-dictionary
+   pnpm run generate-dictionary
    ```
    This creates/updates `generate/dictionary.js` with the latest tag definitions.
 
 2. **Pack the dictionary into optimized format**:
    ```bash
-   npm run pack-dictionary
+   pnpm run pack-dictionary
    ```
    This generates the optimized `src/dictionary.fast.js` used at runtime.
 
@@ -168,7 +186,7 @@ Tests are written using the [Jest](https://jestjs.io) testing framework and live
 
 Pull requests should either update existing tests or add new tests in order to ensure good test coverage of the changes being made.
 
-To run all tests use `npm run test`. To only run specific tests use Jest's [`.only`](https://www.testim.io/blog/unit-testing-best-practices/) feature. If you're using VS Code, an extension such as [`firsttris.vscode-jest-runner`](https://marketplace.visualstudio.com/items?itemName=firsttris.vscode-jest-runner) can be used to step through specific tests in the debugger.
+To run all tests use `pnpm test`. To only run specific tests use Jest's [`.only`](https://www.testim.io/blog/unit-testing-best-practices/) feature. If you're using VS Code, an extension such as [`firsttris.vscode-jest-runner`](https://marketplace.visualstudio.com/items?itemName=firsttris.vscode-jest-runner) can be used to step through specific tests in the debugger.
 
 Read all about unit testing best practices [here](https://www.testim.io/blog/unit-testing-best-practices/).
 

netlify.toml

@@ -10,13 +10,13 @@
   # This is where we will look for package.json/.nvmrc/etc.
   base = ""
   publish = "examples/"
-  command = "npm run build:examples"
-  environment = { NODE_VERSION = "18.18.0" }
+  command = "pnpm run build:examples"
+  environment = { NODE_VERSION = "24" }
 
 # Deploy Preview context: all deploys generated from a pull/merge request will
 # inherit these settings.
 [context.deploy-preview]
   base = ""
   publish = "examples/"
-  command = "npm run build:examples"
-  environment = { NODE_VERSION = "18.18.0" }
+  command = "pnpm run build:examples"
+  environment = { NODE_VERSION = "24" }