chore: migrate to pnpm and enable minimum release age

Migrates from npm workspaces to pnpm workspaces and adds a 1-day
minimum release age supply-chain guard at the package-manager layer
(pnpm-workspace.yaml) and at the Renovate layer. Internal
`@apify/*` and `@crawlee/*` packages are whitelisted at both layers
for immediate updates.

Notable changes:
- package.json: drop "workspaces" (moved to pnpm-workspace.yaml);
  set packageManager to pnpm@10.24.0; add rimraf as explicit devDep
  (was previously relying on npm transitive hoisting)
- lerna.json: npmClient: "pnpm"
- .npmrc: node-linker=hoisted (flat node_modules layout)
- packages/*/package.json scripts: "npm run X" -> "pnpm X"
- CI workflows: add pnpm/action-setup, use pnpm install --frozen-lockfile
  and pnpm/pnpm exec in place of npm/npx; drop Node 16 from matrix
  (pnpm 10 requires Node 18+)
- renovate.json: minimumReleaseAge "1 day", internalChecksFilter
  "strict", @apify/* and @crawlee/* whitelist; drop npm constraint
- Docs: CONTRIBUTING.md and CLAUDE.md updated for pnpm commands

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: B4nan

.github/workflows/publish_to_npm.yaml

@@ -22,25 +22,23 @@ jobs:
                   ref: ${{ inputs.ref }}
                   token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
                   fetch-depth: 0 # we need to pull everything to allow lerna to detect what packages changed
+            - uses: pnpm/action-setup@v4
             - name: Use Node.js 24
               uses: actions/setup-node@v6
               with:
                   node-version: 24
                   registry-url: 'https://registry.npmjs.org'
-                  cache: 'npm'
-                  cache-dependency-path: 'package-lock.json'
-            - name: Update NPM
-              run: npm install -g npm@latest
+                  cache: 'pnpm'
             - name: Install dependencies
-              run: npm ci --no-audit
+              run: pnpm install --frozen-lockfile
             - name: Build module
-              run: npm run build
+              run: pnpm build
             - name: Publish to NPM
               run: |
                   git checkout -- .
-                  npx lerna publish --contents dist --yes
-                  npm i --no-audit # reinstall to have updated lock file
-                  npx lerna ls --json | node scripts/sync-root-changelog.ts
+                  pnpm exec lerna publish --contents dist --yes
+                  pnpm install --no-frozen-lockfile # reinstall to have updated lock file
+                  pnpm exec lerna ls --json | node scripts/sync-root-changelog.ts
               env:
                   GH_TOKEN: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
                   GIT_AUTHOR_NAME: Apify Release Bot

.github/workflows/test_and_release.yaml

@@ -15,50 +15,41 @@ jobs:
         strategy:
             fail-fast: false
             matrix:
-                node-version: [ 16, 18, 20, 22 ]
+                node-version: [ 18, 20, 22 ]
 
         steps:
             -   uses: actions/checkout@v6
+            -   uses: pnpm/action-setup@v4
             -   name: Use Node.js ${{ matrix.node-version }}
                 uses: actions/setup-node@v6
                 with:
                     node-version: ${{ matrix.node-version }}
-            -   name: Cache node_modules
-                uses: actions/cache@v5
-                with:
-                    path: '**/node_modules'
-                    key: ${{ runner.os }}-${{ matrix.node-version }}-modules-${{ hashFiles('**/package-lock.json') }}
-            -   name: Update NPM
-                run: npm install --no-audit -g npm@9
-                if: matrix.node-version < 18
+                    cache: 'pnpm'
             -   name: Install Dependencies
-                run: npm ci --no-audit
+                run: pnpm install --frozen-lockfile
             -   name: Run Tests
-                run: npm test
+                run: pnpm test
 
     build:
         name: Build
         runs-on: ubuntu-latest
 
         steps:
             -   uses: actions/checkout@v6
-            -   name: Use Node.js 20
+            -   uses: pnpm/action-setup@v4
+            -   name: Use Node.js 24
                 uses: actions/setup-node@v6
                 with:
                     node-version: 24
-            -   name: Cache node_modules
-                uses: actions/cache@v5
-                with:
-                    path: '**/node_modules'
-                    key: ${{ runner.os }}-${{ matrix.node-version }}-modules-${{ hashFiles('**/package-lock.json') }}
+                    cache: 'pnpm'
             -   name: Install Dependencies
-                run: npm ci --no-audit
-            -   run: npm run build
+                run: pnpm install --frozen-lockfile
+            -   run: pnpm build
 
             -   name: Check build consistency
                 run: |
                     git diff --exit-code || {
-                        echo -e "Some files changed after running npm run build! Please build the project locally and commit the changes.";
+                        echo -e "Some files changed after running pnpm build! Please build the project locally and commit the changes.";
                         exit 1;
                     }
 
@@ -68,18 +59,15 @@ jobs:
 
         steps:
             -   uses: actions/checkout@v6
-            -   name: Use Node.js 20
+            -   uses: pnpm/action-setup@v4
+            -   name: Use Node.js 24
                 uses: actions/setup-node@v6
                 with:
                     node-version: 24
-            -   name: Cache node_modules
-                uses: actions/cache@v5
-                with:
-                    path: '**/node_modules'
-                    key: ${{ runner.os }}-${{ matrix.node-version }}-modules-${{ hashFiles('**/package-lock.json') }}
+                    cache: 'pnpm'
             -   name: Install Dependencies
-                run: npm ci --no-audit
-            -   run: npm run lint
+                run: pnpm install --frozen-lockfile
+            -   run: pnpm lint
 
     publish:
         name: Publish to NPM
@@ -90,24 +78,23 @@ jobs:
             -   uses: actions/checkout@v6
                 with:
                     fetch-depth: 0 # we need to pull everything to allow lerna to detect what packages changed
+            -   uses: pnpm/action-setup@v4
             -   uses: actions/setup-node@v6
                 with:
                     node-version: 24
-            -   name: Cache node_modules
-                uses: actions/cache@v5
-                with:
-                    path: '**/node_modules'
-                    key: ${{ runner.os }}-${{ matrix.node-version }}-modules-${{ hashFiles('**/package-lock.json') }}
+                    cache: 'pnpm'
+            -   name: Install Dependencies
+                run: pnpm install --frozen-lockfile
             -   name: Check for changes
                 id: changed_packages
                 run: |
-                    echo "changed_packages=$(npx lerna changed -p | wc -l | xargs)" | tee -a $GITHUB_OUTPUT
+                    echo "changed_packages=$(pnpm exec lerna changed -p | wc -l | xargs)" | tee -a $GITHUB_OUTPUT
             -   name: Execute publish workflow
                 if: steps.changed_packages.outputs.changed_packages != '0'
                 uses: apify/workflows/execute-workflow@main
                 with:
                     workflow: publish_to_npm.yaml
                     inputs: >
-                        { 
-                            "ref": "master" 
+                        {
+                            "ref": "master"
                         }

.gitignore

@@ -12,6 +12,5 @@ pids
 .idea
 yarn.lock
 packages/*/package-lock.json
-.npmrc
 
 .vscode

.npmrc

@@ -0,0 +1 @@
+node-linker=hoisted

CLAUDE.md

@@ -4,20 +4,20 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Overview
 
-Internal Apify monorepo of shared TypeScript utilities and constants published as `@apify/*` packages on npm. Managed with Lerna (independent versioning) and npm workspaces.
+Internal Apify monorepo of shared TypeScript utilities and constants published as `@apify/*` packages on npm. Managed with Lerna (independent versioning) and pnpm workspaces.
 
 ## Commands
 
 ```bash
-npm install              # Install all dependencies
-npm run build            # Build all packages (lerna run build)
-npm test                 # Run all tests (jest --silent)
-npm run test-cov         # Run tests with coverage
-npx jest test/consts.test.ts              # Run a single test file
-npx jest test/consts.test.ts -t "pattern" # Run specific test by name
-npm run lint             # Lint all source and test files
-npm run lint:fix         # Lint with auto-fix
-npm run clean            # Clean all dist/ folders
+pnpm install              # Install all dependencies
+pnpm build                # Build all packages (lerna run build)
+pnpm test                 # Run all tests (jest --silent)
+pnpm test-cov             # Run tests with coverage
+pnpm exec jest test/consts.test.ts              # Run a single test file
+pnpm exec jest test/consts.test.ts -t "pattern" # Run specific test by name
+pnpm lint                 # Lint all source and test files
+pnpm lint:fix             # Lint with auto-fix
+pnpm clean                # Clean all dist/ folders
 ```
 
 ## Architecture

CONTRIBUTING.md

@@ -4,20 +4,20 @@ When contributing to this repository, please first discuss the change you wish t
 
 ## Submitting a pull request
 
-- Fork the project and install NPM dependencies. **NPM 7 is needed to have support for workspaces.**
+- Fork the project and install dependencies with [pnpm](https://pnpm.io/) (we use pnpm workspaces).
 
     ```sh
-    npm install
+    pnpm install
     ```
 
 - Run tests before you start working, to be sure they all pass, and your setup is working correctly:
 
      ```sh
-     npm test
+     pnpm test
      ```
 
 - Be sure to **include appropriate test cases**.
-- Follow defined coding standard, use `npm run lint` command to check it.
+- Follow defined coding standard, use `pnpm lint` command to check it.
 - Commit your changes using a descriptive commit message that follows defined
   [commit message conventions](#commit-message-guidelines). Adherence to these conventions is necessary because release notes are automatically generated from these messages.
 - Push the code to your forked repository and create a pull request on GitHub.
@@ -52,7 +52,7 @@ empty line to separate subject and body).
 
 ## Adding new package
 
-This repository is managed via `lerna` and NPM workspaces. When adding new package, be sure to include all
+This repository is managed via `lerna` and pnpm workspaces. When adding new package, be sure to include all
 the appropriate config files (`package.json`, `tsconfig.json` and `tsconfig.build.json`). It should be mostly
 ok to just copy&paste one of the existing packages, wipe its contents and change the package name. Be sure
 to clean up the dependencies as well. Keep all the scripts defined in the `package.json`, especially the `build` one.

lerna.json

@@ -15,6 +15,7 @@
         }
     },
     "useNx": false,
+    "npmClient": "pnpm",
     "ignoreChanges": [
         "**/test/**",
         "**/*.md"