refactor(many): upgrade to pnpm 11

matyasf · matyasf · commit 2e5baacdb171 · 2026-06-11T16:39:27.000+02:00
also do not allow some dependencies to run scripts for better security.
Some dependencies needed to be added because pnpm now has a more
strict peer dependency resolution.

INSTUI-5064
diff --git a/package.json b/package.json
@@ -50,14 +50,6 @@
     "ts:check": "pnpm -r --stream ts:check"
   },
   "license": "MIT",
-  "pnpm": {
-    "overrides": {
-      "react": "18.3.1",
-      "react-dom": "18.3.1",
-      "@types/react": "18.3.26",
-      "git-raw-commits>dargs": "7.0.0"
-    }
-  },
   "devDependencies": {
     "@babel/cli": "^7.27.2",
     "@commitlint/cli": "^20.5.3",
@@ -140,5 +132,5 @@
   "browserslist": [
     "extends @instructure/browserslist-config-instui"
   ],
-  "packageManager": "pnpm@10.23.0+sha512.21c4e5698002ade97e4efe8b8b4a89a8de3c85a37919f957e7a0f30f38fbc5bbdd05980ffe29179b2fb6e6e691242e098d945d1601772cad0fef5fb6411e2a4b"
+  "packageManager": "pnpm@11.5.3+sha512.7ac1c919341c213a34dc0d02afb7143c5c26ac26ee8c4782deea821b8ac64d2134a081fd8941dae6e29bbb48f58dfc2b7fbceeccc07cb2f09d219d342a4969ed"
 }
diff --git a/packages/__docs__/package.json b/packages/__docs__/package.json
@@ -27,7 +27,6 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@babel/standalone": "^7.29.3",
     "@instructure/canvas-high-contrast-theme": "workspace:*",
     "@instructure/canvas-theme": "workspace:*",
     "@instructure/console": "workspace:*",
@@ -114,14 +113,18 @@
     "@instructure/ui-utils": "workspace:*",
     "@instructure/ui-view": "workspace:*",
     "babel-loader": "^10.1.1",
+    "@babel/runtime": "^7.29.2",
+    "@babel/standalone": "^7.29.3",
     "codesandbox": "^2.2.3",
     "lorem-ipsum": "^3.0.0",
     "marked-react": "^4.0.0",
     "moment": "^2.30.1",
     "react": "18.3.1",
     "react-dom": "18.3.1",
     "uuid": "^14.0.0",
-    "webpack-merge": "^6.0.1"
+    "webpack-merge": "^6.0.1",
+    "hoist-non-react-statics": "^3.3.2",
+    "buffer": "^6.0.3"
   },
   "devDependencies": {
     "@instructure/ui-babel-preset": "workspace:*",
@@ -135,7 +138,9 @@
     "mkdirp": "3.0.1",
     "react-docgen": "8.0.3",
     "style-loader": "4.0.0",
-    "webpack-bundle-analyzer": "5.3.0"
+    "thread-loader": "^4.0.4",
+    "webpack-bundle-analyzer": "5.3.0",
+    "@types/hoist-non-react-statics": "^3.3.7"
   },
   "//dependency-comments": {
     "chokidar": "4.0.1 seems to have issues watching an array of paths. Check later if fixed..."
diff --git a/packages/console/package.json b/packages/console/package.json
@@ -22,6 +22,9 @@
     "ts:check": "tsc -p tsconfig.build.json --noEmit --emitDeclarationOnly false"
   },
   "license": "MIT",
+  "dependencies": {
+    "@babel/runtime": "^7.29.2"
+  },
   "devDependencies": {
     "@instructure/ui-babel-preset": "workspace:*"
   },
diff --git a/packages/debounce/package.json b/packages/debounce/package.json
@@ -22,7 +22,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@babel/runtime": "^7.27.6"
+    "@babel/runtime": "^7.29.2"
   },
   "devDependencies": {
     "@instructure/ui-babel-preset": "workspace:*"
diff --git a/packages/emotion/package.json b/packages/emotion/package.json
@@ -40,6 +40,7 @@
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "15.0.7",
     "@testing-library/user-event": "^14.6.1",
+    "@types/hoist-non-react-statics": "^3.3.7",
     "react-dom": "18.3.1",
     "vitest": "^3.2.2"
   },
diff --git a/packages/ui-codemods/lib/utils/codemodHelpers.ts b/packages/ui-codemods/lib/utils/codemodHelpers.ts
@@ -259,8 +259,10 @@ function findAttribute(
  * again a `JSXText` with `"  \n"`. This function removes the empty text nodes.
  * This does not modify the input array.
  */
-function getVisibleChildren(nodes?: JSXElement['children']) {
-  const result: JSXElement['children'] = []
+function getVisibleChildren(
+  nodes?: JSXElement['children']
+): NonNullable<JSXElement['children']> {
+  const result: NonNullable<JSXElement['children']> = []
   if (!nodes) {
     return result
   }
diff --git a/packages/ui-codemods/package.json b/packages/ui-codemods/package.json
@@ -28,7 +28,7 @@
     "@instructure/ui-babel-preset": "workspace:*",
     "@types/jscodeshift": "^17.3.0",
     "@types/prettier": "^2.7.3",
-    "esbuild": "^0.25.5",
+    "esbuild": "^0.28.0",
     "vitest": "^3.2.2"
   },
   "publishConfig": {
diff --git a/packages/ui-decorator/package.json b/packages/ui-decorator/package.json
@@ -22,7 +22,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@babel/runtime": "^7.27.6"
+    "@babel/runtime": "^7.29.2"
   },
   "devDependencies": {
     "@instructure/ui-babel-preset": "workspace:*"
diff --git a/packages/ui-i18n/package.json b/packages/ui-i18n/package.json
@@ -36,7 +36,7 @@
     "@instructure/ui-babel-preset": "workspace:*",
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "15.0.7",
-    "@types/hoist-non-react-statics": "^3.3.6",
+    "@types/hoist-non-react-statics": "^3.3.7",
     "react-dom": "18.3.1",
     "vitest": "^3.2.2"
   },
diff --git a/packages/ui-react-utils/package.json b/packages/ui-react-utils/package.json
@@ -35,7 +35,8 @@
     "@instructure/ui-babel-preset": "workspace:*",
     "@testing-library/jest-dom": "^6.6.3",
     "@testing-library/react": "15.0.7",
-    "vitest": "^3.2.2"
+    "vitest": "^3.2.2",
+    "@types/hoist-non-react-statics": "^3.3.7"
   },
   "peerDependencies": {
     "react": ">=18 <=19",
diff --git a/packages/ui-scripts/lib/build/buildThemes/setupThemes.ts b/packages/ui-scripts/lib/build/buildThemes/setupThemes.ts
@@ -32,8 +32,7 @@ import generateSemantics, {
 import generateComponent, {
   generateComponentType
 } from './generateComponents.js'
-import { exec } from 'child_process'
-import { promisify } from 'node:util'
+import { resolveBin, runCommandAsync } from '@instructure/command-utils'
 
 // transform to an object for easier handling
 export const transformThemes = (themes: any, input: any) =>
@@ -369,11 +368,12 @@ const setupThemes = async (targetPath: string, input: any): Promise<void> => {
     }
   `
   await createFile(`${targetPath}/index.ts`, exportIndexFileContent)
-  const execAsync = promisify(exec)
   try {
-    const { stdout, stderr } = await execAsync(
-      "dprint fmt '" + targetPath + "/**/*.*'"
-    )
+    const dprintBin = resolveBin('dprint')
+    const { stdout, stderr } = await runCommandAsync(dprintBin, [
+      'fmt',
+      `${targetPath}/**/*.*`
+    ])
     console.log('[dprint]', stdout)
     if (stderr) {
       console.error('[dprint error]:', stderr)
diff --git a/packages/ui-scripts/lib/commands/create-component-version.ts b/packages/ui-scripts/lib/commands/create-component-version.ts
@@ -25,7 +25,6 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { execSync } from 'node:child_process'
-// @ts-expect-error no types for inquirer 8.x
 import inquirer from 'inquirer'
 import { info, error } from '@instructure/command-utils'
 import type { Argv } from 'yargs'
@@ -143,10 +142,7 @@ async function detectOrPromptComponent(
 /**
  * Detect if cwd is inside a component directory (has v1/v2 subdirs).
  */
-function detectComponentFromCwd(
-  repoRoot: string,
-  cwd: string
-): string | null {
+function detectComponentFromCwd(repoRoot: string, cwd: string): string | null {
   let dir = cwd
   while (dir.startsWith(repoRoot) && dir !== repoRoot) {
     // Check if this directory has version subdirectories
@@ -199,7 +195,10 @@ function discoverComponents(repoRoot: string): ComponentInfo[] {
 /**
  * Simple fuzzy match: all query characters must appear in order.
  */
-function fuzzyMatch(components: ComponentInfo[], query: string): ComponentInfo[] {
+function fuzzyMatch(
+  components: ComponentInfo[],
+  query: string
+): ComponentInfo[] {
   const q = query.toLowerCase()
   return components.filter((c) => {
     const target = `${c.pkg} ${c.name}`.toLowerCase()
diff --git a/packages/ui-scripts/package.json b/packages/ui-scripts/package.json
@@ -25,7 +25,7 @@
     "@instructure/instructure-design-tokens": "github:instructure/instructure-design-tokens#v1.1.0",
     "@instructure/pkg-utils": "workspace:*",
     "@lerna/project": "^6.4.1",
-    "dprint": "^0.53.2",
+    "dprint": "^0.54.0",
     "http-server": "^14.1.1",
     "jscodeshift": "^0.16.1",
     "lerna": "9.0.7",
@@ -37,7 +37,9 @@
     "style-dictionary": "4.4.0",
     "webpack-cli": "^7.0.2",
     "webpack-dev-server": "^5.2.3",
-    "yargs": "^17.7.2"
+    "yargs": "^17.7.2",
+    "lucide-react": "1.7.0",
+    "inquirer": "^14.0.2"
   },
   "peerDependencies": {
     "eslint": "^9",
@@ -50,7 +52,8 @@
   "devDependencies": {
     "@types/pixelmatch": "^5.2.6",
     "@types/pngjs": "^6.0.5",
-    "fantasticon": "^3.0.0",
-    "svgo": "^3.3.2"
+    "fantasticon": "^4.1.0",
+    "svgo": "^4.0.1",
+    "@types/yargs": "^17.0.35"
   }
 }
diff --git a/packages/ui-themes/package.json b/packages/ui-themes/package.json
@@ -28,6 +28,7 @@
     "vitest": "^3.2.2"
   },
   "dependencies": {
+    "@babel/runtime": "^7.29.2",
     "@instructure/shared-types": "workspace:*",
     "@tokens-studio/types": "^0.5.2"
   },
diff --git a/packages/uid/package.json b/packages/uid/package.json
@@ -22,7 +22,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@babel/runtime": "^7.27.6"
+    "@babel/runtime": "^7.29.2"
   },
   "devDependencies": {
     "@instructure/ui-babel-preset": "workspace:*",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
