chore: migrate dependency management to pnpm

Replace the root and demo npm lockfiles with a single committed pnpm-lock.yaml and add pnpm-workspace.yaml covering the root package, subpackages, test/ts, and demo. Pin packageManager to pnpm@11.1.0 and move the Volta Node pin to 24.15.0 so the repository runs on a Node version supported by pnpm 11.

Enable pnpm supply-chain hardening in workspace config: strict minimum release age, no-downgrade trust policy, blocked exotic transitive dependencies, strict dependency builds, engine strictness, and an explicit install-script allowBuilds policy. Keep trust-policy exceptions narrow and version-specific for chokidar@4.0.3, preact-render-to-string@6.5.0, reselect@5.1.1, and semver@6.3.1 instead of using a broad age-based bypass. Allow only esbuild build scripts and explicitly deny optional/native watcher or compatibility scripts for @parcel/watcher, fsevents, and styled-components.

Update CI and developer workflows for pnpm: use pnpm/action-setup@v6, pnpm cache keys, frozen installs, pnpm script invocations, pnpm exec for the Husky hook, and pnpm contributor docs. Declare nano-staged as a dev dependency because pnpm exec requires hook tools to be local instead of relying on npx to fetch them. Keep npm pack and npm publish behavior intact for the package release path.

Tighten dependency declarations exposed by pnpm's isolated linker: add demo's explicit sass-embedded dependency for SCSS builds, pin Vite resolutions that were previously coming from npm lockfiles, pin the direct undici dev dependency, and update @actions/github and @actions/glob dev tooling to current versions to avoid older trust-downgrade transitive resolution.

Verification run: pnpm install --frozen-lockfile; pnpm ignored-builds; pnpm run build; pnpm run lint; pnpm run test:unit; pnpm --dir demo run build; npm pack --ignore-scripts --dry-run --json. Also ran pnpm run format:check, which still fails on existing repository-wide formatting and CRLF diagnostics unrelated to this migration.

Author: andrewiggins

.github/workflows/build-test.yml

@@ -26,17 +26,22 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ inputs.ref || '' }}
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        with:
+          run_install: false
+      - uses: actions/setup-node@v4
         with:
           node-version-file: 'package.json'
-      - run: npm ci
+          cache: 'pnpm'
+          cache-dependency-path: pnpm-lock.yaml
+      - run: pnpm install --frozen-lockfile
       - name: test
         env:
           CI: true
           COVERAGE: true
           FLAKEY: false
-        # Not using `npm test` since it rebuilds source which npm ci has already done
-        run: npm run lint && npm run test:unit
+        # Not using `pnpm test` since it rebuilds source which install has already done
+        run: pnpm run lint && pnpm run test:unit
       - name: Coveralls GitHub Action
         uses: coverallsapp/github-action@643bc377ffa44ace6394b2b5d0d3950076de9f63 # v2.3.0
         timeout-minutes: 2

.github/workflows/run-bench.yml

@@ -4,7 +4,7 @@ name: Benchmark Worker
 #
 # This workflow expects calling workflows to have uploaded an artifact named
 # "bench-environment" that contains any built artifacts required to run the
-# benchmark. This typically is the dist/ folder that running `npm run build`
+# benchmark. This typically is the dist/ folder that running `pnpm run build`
 # produces and/or a tarball of a previous build to bench the local build against
 
 on:
@@ -34,29 +34,16 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
-      - uses: actions/setup-node@v4
-        with:
-          node-version-file: 'package.json'
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
-
-      # Setup pnpm
-      - name: Install pnpm
-        uses: pnpm/action-setup@v3
+      - uses: pnpm/action-setup@v6
         with:
-          version: 8
           run_install: false
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        run: |
-          echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT
-      - uses: actions/cache@v4
-        name: Setup pnpm cache
+      - uses: actions/setup-node@v4
         with:
-          path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
+          node-version-file: 'package.json'
+          cache: 'pnpm'
+          cache-dependency-path: |
+            pnpm-lock.yaml
+            benchmarks/pnpm-lock.yaml
 
       # Install benchmark dependencies
       - uses: actions/download-artifact@v4
@@ -119,4 +106,4 @@ jobs:
         with:
           name: ${{ steps.log-artifact-name.outputs.artifact_name }}
           path: benchmarks/out/${{ inputs.benchmark }}_logs.tgz
-          if-no-files-found: ignore
+          if-no-files-found: ignore

.github/workflows/size.yml

@@ -8,14 +8,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v6
+        with:
+          run_install: false
       - uses: actions/setup-node@v4
         with:
           node-version-file: 'package.json'
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: 'pnpm'
+          cache-dependency-path: pnpm-lock.yaml
       - uses: preactjs/compressed-size-action@v2
         with:
           repo-token: '${{ secrets.GITHUB_TOKEN }}'
           # Our `prepare` script already builds the app post-install,
           # building it again would be redundant
-          build-script: 'npm run --if-present noop'
+          build-script: 'pnpm run --if-present noop'

.gitignore

@@ -1,6 +1,7 @@
 .DS_Store
 node_modules
 npm-debug.log
+package-lock.json
 dist
 */package-lock.json
 yarn.lock

.husky/pre-commit

@@ -1 +1 @@
-npx nano-staged
+pnpm exec nano-staged

CONTRIBUTING.md

@@ -8,7 +8,7 @@ These steps will help you set up your development environment. That includes all
 
 1. Clone the git repository: `git clone git@github.com:preactjs/preact.git`
 2. Go into the cloned folder: `cd preact/`
-3. Install all dependencies: `npm install`
+3. Install all dependencies: `pnpm install`
 
 ## The Repo Structure
 
@@ -100,7 +100,7 @@ The short summary is:
 
 ## Commonly used scripts for contributions
 
-Scripts can be executed via `npm run [script]`.
+Scripts can be executed via `pnpm run [script]`.
 
 - `build` - compiles all packages ready for publishing to npm
 - `build:core` - builds just Preact itself
@@ -142,7 +142,7 @@ it.only('should test something', () => {
 
 ## Benchmarks
 
-We have a benchmark suite that we use to measure the performance of Preact. Our benchmark suite lives in our [preactjs/benchmarks repository](https://github.com/preactjs/benchmarks), but is included here as Git submodule. To run the benchmarks, first ensure [PNPM](https://pnpm.io/installation) is installed on your system and initialize and setup the submodule (it uses `pnpm` as a package manager):
+We have a benchmark suite that we use to measure the performance of Preact. Our benchmark suite lives in our [preactjs/benchmarks repository](https://github.com/preactjs/benchmarks), but is included here as Git submodule. To run the benchmarks, first ensure [pnpm](https://pnpm.io/installation) is installed on your system and initialize and setup the submodule:
 
 ```bash
 pnpm -v # Make sure pnpm is installed
@@ -212,13 +212,13 @@ Before using the automated npm publishing flow, make sure npm trusted publishing
 > **ATTENTION:** Make sure that you've cleared the project correctly
 > when switching from a 10.x branch.
 
-0. Run `rm -rf dist node_modules && npm i` to make sure to have the correct dependencies.
+0. Run `rm -rf dist node_modules && pnpm install` to make sure to have the correct dependencies.
 1. [Write the release notes](#writing-release-notes) and keep them as a draft in GitHub
    1. I'd recommend writing them in an offline editor because each edit to a draft will change the URL in GitHub.
 2. Make a PR where **only** the version number is incremented in `package.json` (note: We follow `SemVer` conventions)
 3. Wait until the PR is approved and merged.
 4. Switch back to the `main` branch and pull the merged PR
-5. Run `npm run build && npm publish`
+5. Run `pnpm run build && npm publish`
    1. Make sure you have 2FA enabled in npm, otherwise the above command will fail.
    2. If you're doing a pre-release add `--tag next` to the `npm publish` command to publish it under a different tag (default is `latest`)
 6. Publish the release notes and create the correct git tag.