Dedupe node & pnpm versions; bump pnpm to 10.33.1

Address feedback: make package.json the single source of truth for node
and pnpm versions where possible, and bump pnpm to the latest release.

- package.json: bump `packageManager` to `pnpm@10.33.1` (pinned with
  the upstream sha512 integrity hash so corepack/pnpm verify the binary).
- package.json: tighten `engines.node` from `>=22` to `22.14.0` so
  dev's built-in node-version validator catches any drift against
  dev.yml on every `dev up`.
- dev.yml: bump to `package_manager: pnpm@10.33.1` and add a comment
  noting the versions must stay in lockstep with package.json.
- .github/actions/setup: read node from `engines.node` via
  `node-version-file: package.json`, and let `pnpm/action-setup`
  read the version from the `packageManager` field (drop the hardcoded
  `version: 10.28.0` and `node-version: 22.22.1`).

dev.yml itself is plain YAML (no ERB/interpolation) and the node task
requires an explicit `version:` + `package_manager:`, so full
deduplication into a single literal isn't supported upstream. Every
other pnpm-using zone in World mirrors the value. The setup we have
here — package.json as SoT, dev's validator as the enforcer, CI
reading directly from package.json — is the closest equivalent.

Requested by Kieran Osgood <kieran.osgood@shopify.com>

Author: shopify-river[bot]

.github/actions/setup/action.yml

@@ -4,15 +4,17 @@ description: Setup Node.js and install dependencies
 runs:
   using: composite
   steps:
+    # Versions are sourced from package.json:
+    #   - pnpm: `packageManager` field (read by pnpm/action-setup)
+    #   - node: `engines.node` field (read by setup-node via node-version-file)
+    # Keep package.json as the single source of truth.
     - name: Install pnpm
       uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
-      with:
-        version: 10.28.0
 
     - name: Setup Node.js
       uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3.8.2
       with:
-        node-version: 22.22.1
+        node-version-file: package.json
         registry-url: 'https://registry.npmjs.org'
         cache: pnpm
 

.github/workflows/ci.yml

@@ -32,9 +32,9 @@ jobs:
         uses: ./.github/actions/setup
 
       - run: |
-          yarn module clean
-          yarn module build
-          yarn compare-snapshot
+          pnpm module clean
+          pnpm module build
+          pnpm compare-snapshot
 
   lint:
     name: Lint module + sample
@@ -52,9 +52,9 @@ jobs:
         uses: ./.github/actions/setup
 
       - run: |
-          yarn module build
-          yarn module lint
-          yarn sample lint
+          pnpm module build
+          pnpm module lint
+          pnpm sample lint
 
   test:
     name: Run jest tests
@@ -70,7 +70,7 @@ jobs:
         uses: ./.github/actions/setup
 
       - run:
-          yarn test --coverage
+          pnpm test --coverage
           --testPathPatterns="modules/@shopify/checkout-sheet-kit/tests"
           --coverageReporters=json-summary
 
@@ -111,8 +111,8 @@ jobs:
           java -version
           javac -version
           echo "STOREFRONT_DOMAIN=myshopify.com" > sample/.env
-          yarn module build
-          yarn sample test:android --no-daemon
+          pnpm module build
+          pnpm sample test:android --no-daemon
 
   test-ios:
     name: Run Swift Tests
@@ -138,4 +138,4 @@ jobs:
 
       - name: Run Swift tests
         run: |
-          yarn sample test:ios
+          pnpm sample test:ios

.github/workflows/publish.yml

@@ -38,8 +38,8 @@ jobs:
       - name: Prepare release
         run: |
           cp README.md modules/@shopify/checkout-sheet-kit
-          yarn module clean
-          yarn module build
+          pnpm module clean
+          pnpm module build
           cd modules/@shopify/checkout-sheet-kit
           npm publish --access public --tag ${{ steps.npm-tag.outputs.tag }}
         env:

dev.yml

@@ -15,9 +15,13 @@ up:
         ios:
           - version: 23C54 # 26.2
             architecture_variant: arm64
+  # Node / pnpm versions are mirrored from package.json (engines.node,
+  # packageManager). dev validates engines.node matches the version below on
+  # every `dev up`, so drift is caught automatically. If you bump one, bump
+  # both.
   - node:
       version: v22.14.0
-      package_manager: pnpm@10.28.0
+      package_manager: pnpm@10.33.1
   - custom:
       name: Install NPM dependencies
       met?: ls -l | grep node_modules

package.json

@@ -10,7 +10,7 @@
     "url": "https://github.com/Shopify/checkout-sheet-kit-react-native/issues"
   },
   "homepage": "https://github.com/Shopify/checkout-sheet-kit-react-native",
-  "packageManager": "pnpm@10.28.0",
+  "packageManager": "pnpm@10.33.1+sha512.05ba3c1d5d1c18f68df06470d74055e62d41fc110a0c660db1b2dfb2785327f04cf0f68345d4609bc52089e7fa0343c31593b2f9594e2c5d5da426230acc9820",
   "pnpm": {
     "onlyBuiltDependencies": [
       "unrs-resolver"
@@ -58,7 +58,7 @@
     "typescript": "^5.9.2"
   },
   "engines": {
-    "node": ">=22"
+    "node": "22.14.0"
   },
   "prettier": {
     "arrowParens": "avoid",

sample/ios/Podfile.lock

@@ -8,7 +8,7 @@ PODS:
   - hermes-engine (0.80.2):
     - hermes-engine/Pre-built (= 0.80.2)
   - hermes-engine/Pre-built (0.80.2)
-  - NitroModules (0.33.7):
+  - NitroModules (0.33.9):
     - boost
     - DoubleConversion
     - fast_float
@@ -38,7 +38,7 @@ PODS:
     - ReactCommon/turbomodule/core
     - SocketRocket
     - Yoga
-  - QuickCrypto (1.0.9):
+  - QuickCrypto (1.0.19):
     - boost
     - DoubleConversion
     - fast_float
@@ -1717,7 +1717,7 @@ PODS:
     - React-Core
   - react-native-quick-base64 (2.2.2):
     - React-Core
-  - react-native-safe-area-context (5.6.1):
+  - react-native-safe-area-context (5.7.0):
     - boost
     - DoubleConversion
     - fast_float
@@ -1736,8 +1736,8 @@ PODS:
     - React-hermes
     - React-ImageManager
     - React-jsi
-    - react-native-safe-area-context/common (= 5.6.1)
-    - react-native-safe-area-context/fabric (= 5.6.1)
+    - react-native-safe-area-context/common (= 5.7.0)
+    - react-native-safe-area-context/fabric (= 5.7.0)
     - React-NativeModulesApple
     - React-RCTFabric
     - React-renderercss
@@ -1748,7 +1748,7 @@ PODS:
     - ReactCommon/turbomodule/core
     - SocketRocket
     - Yoga
-  - react-native-safe-area-context/common (5.6.1):
+  - react-native-safe-area-context/common (5.7.0):
     - boost
     - DoubleConversion
     - fast_float
@@ -1777,7 +1777,7 @@ PODS:
     - ReactCommon/turbomodule/core
     - SocketRocket
     - Yoga
-  - react-native-safe-area-context/fabric (5.6.1):
+  - react-native-safe-area-context/fabric (5.7.0):
     - boost
     - DoubleConversion
     - fast_float
@@ -1807,7 +1807,7 @@ PODS:
     - ReactCommon/turbomodule/core
     - SocketRocket
     - Yoga
-  - react-native-webview (13.16.0):
+  - react-native-webview (13.16.1):
     - boost
     - DoubleConversion
     - fast_float
@@ -2517,7 +2517,7 @@ PODS:
     - ReactCommon/turbomodule/core
     - SocketRocket
     - Yoga
-  - RNScreens (4.16.0):
+  - RNScreens (4.24.0):
     - boost
     - DoubleConversion
     - fast_float
@@ -2545,10 +2545,10 @@ PODS:
     - ReactCodegen
     - ReactCommon/turbomodule/bridging
     - ReactCommon/turbomodule/core
-    - RNScreens/common (= 4.16.0)
+    - RNScreens/common (= 4.24.0)
     - SocketRocket
     - Yoga
-  - RNScreens/common (4.16.0):
+  - RNScreens/common (4.24.0):
     - boost
     - DoubleConversion
     - fast_float
@@ -2654,8 +2654,8 @@ DEPENDENCIES:
   - fmt (from `../../node_modules/react-native/third-party-podspecs/fmt.podspec`)
   - glog (from `../../node_modules/react-native/third-party-podspecs/glog.podspec`)
   - hermes-engine (from `../../node_modules/react-native/sdks/hermes-engine/hermes-engine.podspec`)
-  - NitroModules (from `../node_modules/react-native-nitro-modules`)
-  - QuickCrypto (from `../node_modules/react-native-quick-crypto`)
+  - NitroModules (from `../../node_modules/react-native-nitro-modules`)
+  - QuickCrypto (from `../../node_modules/react-native-quick-crypto`)
   - RCT-Folly (from `../../node_modules/react-native/third-party-podspecs/RCT-Folly.podspec`)
   - RCTDeprecation (from `../../node_modules/react-native/ReactApple/Libraries/RCTFoundation/RCTDeprecation`)
   - RCTRequired (from `../../node_modules/react-native/Libraries/Required`)
@@ -2690,11 +2690,11 @@ DEPENDENCIES:
   - React-logger (from `../../node_modules/react-native/ReactCommon/logger`)
   - React-Mapbuffer (from `../../node_modules/react-native/ReactCommon`)
   - React-microtasksnativemodule (from `../../node_modules/react-native/ReactCommon/react/nativemodule/microtasks`)
-  - react-native-config (from `../node_modules/react-native-config`)
-  - react-native-encrypted-storage (from `../node_modules/react-native-encrypted-storage`)
-  - react-native-quick-base64 (from `../node_modules/react-native-quick-base64`)
-  - react-native-safe-area-context (from `../node_modules/react-native-safe-area-context`)
-  - react-native-webview (from `../node_modules/react-native-webview`)
+  - react-native-config (from `../../node_modules/react-native-config`)
+  - react-native-encrypted-storage (from `../../node_modules/react-native-encrypted-storage`)
+  - react-native-quick-base64 (from `../../node_modules/react-native-quick-base64`)
+  - react-native-safe-area-context (from `../../node_modules/react-native-safe-area-context`)
+  - react-native-webview (from `../../node_modules/react-native-webview`)
   - React-NativeModulesApple (from `../../node_modules/react-native/ReactCommon/react/nativemodule/core/platform/ios`)
   - React-oscompat (from `../../node_modules/react-native/ReactCommon/oscompat`)
   - React-perflogger (from `../../node_modules/react-native/ReactCommon/reactperflogger`)
@@ -2726,12 +2726,12 @@ DEPENDENCIES:
   - ReactAppDependencyProvider (from `build/generated/ios`)
   - ReactCodegen (from `build/generated/ios`)
   - ReactCommon/turbomodule/core (from `../../node_modules/react-native/ReactCommon`)
-  - "RNCMaskedView (from `../node_modules/@react-native-masked-view/masked-view`)"
+  - "RNCMaskedView (from `../../node_modules/@react-native-masked-view/masked-view`)"
   - RNGestureHandler (from `../../node_modules/react-native-gesture-handler`)
-  - RNReanimated (from `../node_modules/react-native-reanimated`)
-  - RNScreens (from `../node_modules/react-native-screens`)
+  - RNReanimated (from `../../node_modules/react-native-reanimated`)
+  - RNScreens (from `../../node_modules/react-native-screens`)
   - "RNShopifyCheckoutSheetKit (from `../../modules/@shopify/checkout-sheet-kit`)"
-  - RNVectorIcons (from `../node_modules/react-native-vector-icons`)
+  - RNVectorIcons (from `../../node_modules/react-native-vector-icons`)
   - SocketRocket (~> 0.7.1)
   - Yoga (from `../../node_modules/react-native/ReactCommon/yoga`)
 
@@ -2757,9 +2757,9 @@ EXTERNAL SOURCES:
     :podspec: "../../node_modules/react-native/sdks/hermes-engine/hermes-engine.podspec"
     :tag: hermes-2025-07-24-RNv0.80.2-5c7dbc0a78cb2d2a8bc81c41c617c3abecf209ff
   NitroModules:
-    :path: "../node_modules/react-native-nitro-modules"
+    :path: "../../node_modules/react-native-nitro-modules"
   QuickCrypto:
-    :path: "../node_modules/react-native-quick-crypto"
+    :path: "../../node_modules/react-native-quick-crypto"
   RCT-Folly:
     :podspec: "../../node_modules/react-native/third-party-podspecs/RCT-Folly.podspec"
   RCTDeprecation:
@@ -2827,15 +2827,15 @@ EXTERNAL SOURCES:
   React-microtasksnativemodule:
     :path: "../../node_modules/react-native/ReactCommon/react/nativemodule/microtasks"
   react-native-config:
-    :path: "../node_modules/react-native-config"
+    :path: "../../node_modules/react-native-config"
   react-native-encrypted-storage:
-    :path: "../node_modules/react-native-encrypted-storage"
+    :path: "../../node_modules/react-native-encrypted-storage"
   react-native-quick-base64:
-    :path: "../node_modules/react-native-quick-base64"
+    :path: "../../node_modules/react-native-quick-base64"
   react-native-safe-area-context:
-    :path: "../node_modules/react-native-safe-area-context"
+    :path: "../../node_modules/react-native-safe-area-context"
   react-native-webview:
-    :path: "../node_modules/react-native-webview"
+    :path: "../../node_modules/react-native-webview"
   React-NativeModulesApple:
     :path: "../../node_modules/react-native/ReactCommon/react/nativemodule/core/platform/ios"
   React-oscompat:
@@ -2899,17 +2899,17 @@ EXTERNAL SOURCES:
   ReactCommon:
     :path: "../../node_modules/react-native/ReactCommon"
   RNCMaskedView:
-    :path: "../node_modules/@react-native-masked-view/masked-view"
+    :path: "../../node_modules/@react-native-masked-view/masked-view"
   RNGestureHandler:
     :path: "../../node_modules/react-native-gesture-handler"
   RNReanimated:
-    :path: "../node_modules/react-native-reanimated"
+    :path: "../../node_modules/react-native-reanimated"
   RNScreens:
-    :path: "../node_modules/react-native-screens"
+    :path: "../../node_modules/react-native-screens"
   RNShopifyCheckoutSheetKit:
     :path: "../../modules/@shopify/checkout-sheet-kit"
   RNVectorIcons:
-    :path: "../node_modules/react-native-vector-icons"
+    :path: "../../node_modules/react-native-vector-icons"
   Yoga:
     :path: "../../node_modules/react-native/ReactCommon/yoga"
 
@@ -2921,8 +2921,8 @@ SPEC CHECKSUMS:
   fmt: a40bb5bd0294ea969aaaba240a927bd33d878cdd
   glog: 5683914934d5b6e4240e497e0f4a3b42d1854183
   hermes-engine: bbc1152da7d2d40f9e59c28acc6576fcf5d28e2a
-  NitroModules: 8935a8a663e760521ce52adf38038a8481ec2b8f
-  QuickCrypto: be031b34e1004b427bdaca1be5283a3288bf6ce4
+  NitroModules: 30c376f96874896e2ebf2ef16c5d84019c06d93b
+  QuickCrypto: b16c61795b9025ecb154671d5a08e386ed119a69
   RCT-Folly: 846fda9475e61ec7bcbf8a3fe81edfcaeb090669
   RCTDeprecation: 300c5eb91114d4339b0bb39505d0f4824d7299b7
   RCTRequired: e0446b01093475b7082fbeee5d1ef4ad1fe20ac4
@@ -2959,8 +2959,8 @@ SPEC CHECKSUMS:
   react-native-config: f1dde39f8468ad922fc7e8bd4308c8e6223d5ee8
   react-native-encrypted-storage: 569d114e329b1c2c2d9f8c84bcdbe4478dda2258
   react-native-quick-base64: 6568199bb2ac8e72ecdfdc73a230fbc5c1d3aac4
-  react-native-safe-area-context: 8ed800930eb7d0b6651218f69656e823d37b6ef7
-  react-native-webview: 38b7d49cbe748b6fa02381be0a097d3922caf94a
+  react-native-safe-area-context: 1792c367881ef3be64cc01df775c19c6d217a015
+  react-native-webview: a5f4076e4e0c1c84d8fe1ffe4ff720df685bbbcd
   React-NativeModulesApple: 37c08c3c54db55854de816b0df0f3683832be35a
   React-oscompat: 56d6de59f9ae95cd006a1c40be2cde83bc06a4e1
   React-perflogger: 4008bd05a8b6c157b06608c0ea0b8bd5d9c5e6c9
@@ -2994,8 +2994,8 @@ SPEC CHECKSUMS:
   ReactCommon: 592ef441605638b95e533653259254b4bd35ff4f
   RNCMaskedView: 7e0ce15656772a939ff0d269100bca3a182163c8
   RNGestureHandler: eeb622199ef1fb3a076243131095df1c797072f0
-  RNReanimated: 288616f9c66ff4b0911f3862ffcf4104482a2adc
-  RNScreens: 3fc29af06302e1f1c18a7829fe57cbc2c0259912
+  RNReanimated: 237d420b7bb4378ef1dacc7d7a5c674fddb4b5d2
+  RNScreens: 7769b3511c8c7245694295a8e9d8ebb93cb4975c
   RNShopifyCheckoutSheetKit: 5587e0fc360607d832f7f10f8436883d1db4b5ef
   RNVectorIcons: be4d047a76ad307ffe54732208fb0498fcb8477f
   ShopifyCheckoutSheetKit: 5253ca4da4c4f31069286509693930d02b4150d8