Migrate v10.x dependency management to pnpm

.github/workflows/build-test.yml

@@ -26,17 +26,22 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ inputs.ref || '' }}
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        with:
+          run_install: false
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: 'package.json'
-      - run: npm ci
+          cache: 'pnpm'
+          cache-dependency-path: pnpm-lock.yaml
+      - run: pnpm install --frozen-lockfile
       - name: test
         env:
           CI: true
           COVERAGE: true
           FLAKEY: false
-        # Not using `npm test` since it rebuilds source which npm ci has already done
-        run: npm run lint && npm run test:unit
+        # Not using `pnpm test` since it rebuilds source which install has already done
+        run: pnpm run lint && pnpm run test:unit
       - name: Coveralls GitHub Action
         uses: coverallsapp/github-action@643bc377ffa44ace6394b2b5d0d3950076de9f63 # v2.3.0
         timeout-minutes: 2
@@ -46,7 +51,7 @@ jobs:
       - name: Package
         # Use --ignore-scripts here to avoid re-building again before pack
         run: |
-          npm pack --ignore-scripts
+          pnpm pack --config.ignore-scripts=true
           mv preact-*.tgz preact.tgz
       - name: Upload npm package
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

.github/workflows/release.yml

@@ -61,8 +61,10 @@ jobs:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
 
-      - name: Update npm
-        run: npm install -g npm@11.15.0
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        with:
+          version: 11.3.0
+          run_install: false
 
       - name: Validate package
         run: |
@@ -114,4 +116,4 @@ jobs:
           fi
 
       - name: Publish to npm
-        run: npm stage publish preact.tgz --provenance --access public --tag "${{ steps.dist-tag.outputs.tag }}"
+        run: pnpm stage publish preact.tgz --provenance --access public --tag "${{ steps.dist-tag.outputs.tag }}"

.github/workflows/run-bench.yml

@@ -4,7 +4,7 @@ name: Benchmark Worker
 #
 # This workflow expects calling workflows to have uploaded an artifact named
 # "bench-environment" that contains any built artifacts required to run the
-# benchmark. This typically is the dist/ folder that running `npm run build`
+# benchmark. This typically is the dist/ folder that running `pnpm run build`
 # produces and/or a tarball of a previous build to bench the local build against
 
 on:
@@ -34,29 +34,17 @@ jobs:
       - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
-      - uses: actions/setup-node@v4
-        with:
-          node-version-file: 'package.json'
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
-
-      # Setup pnpm
       - name: Install pnpm
         uses: pnpm/action-setup@v3
         with:
           version: 8
+          package_json_file: benchmarks/package.json
           run_install: false
-      - name: Get pnpm store directory
-        id: pnpm-cache
-        run: |
-          echo "pnpm_cache_dir=$(pnpm store path)" >> $GITHUB_OUTPUT
-      - uses: actions/cache@v4
-        name: Setup pnpm cache
+      - uses: actions/setup-node@v4
         with:
-          path: ${{ steps.pnpm-cache.outputs.pnpm_cache_dir }}
-          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-store-
+          node-version-file: 'benchmarks/package.json'
+          cache: 'pnpm'
+          cache-dependency-path: benchmarks/pnpm-lock.yaml
 
       # Install benchmark dependencies
       - uses: actions/download-artifact@v4

.github/workflows/size.yml

@@ -8,14 +8,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+        with:
+          run_install: false
       - uses: actions/setup-node@v4
         with:
           node-version-file: 'package.json'
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: 'pnpm'
+          cache-dependency-path: pnpm-lock.yaml
       - uses: preactjs/compressed-size-action@v2
         with:
           repo-token: '${{ secrets.GITHUB_TOKEN }}'
           # Our `prepare` script already builds the app post-install,
           # building it again would be redundant
-          build-script: 'npm run --if-present noop'
+          build-script: '--if-present noop'

.gitignore

@@ -1,6 +1,7 @@
 .DS_Store
 node_modules
 npm-debug.log
+package-lock.json
 dist
 */package-lock.json
 yarn.lock

.husky/pre-commit

@@ -1 +1 @@
-npx nano-staged
+pnpm exec nano-staged

CONTRIBUTING.md

@@ -8,7 +8,7 @@ This steps will help you to set up your development environment. That includes a
 
 1. Clone the git repository: `git clone git@github.com:preactjs/preact.git`
 2. Go into the cloned folder: `cd preact/`
-3. Install all dependencies: `npm install`
+3. Install all dependencies: `pnpm install`
 
 ## The Repo Structure
 
@@ -95,7 +95,7 @@ The short summary is:
 
 ## Commonly used scripts for contributions
 
-Scripts can be executed via `npm run [script]` or `yarn [script]` respectively.
+Scripts can be executed via `pnpm run [script]`.
 
 - `build` - compiles all packages ready for publishing to npm
 - `build:core` - builds just Preact itself
@@ -133,7 +133,7 @@ it.only('should test something', () => {
 
 ## Benchmarks
 
-We have a benchmark suite that we use to measure the performance of Preact. Our benchmark suite lives in our [preactjs/benchmarks repository](https://github.com/preactjs/benchmarks), but is included here as Git submodule. To run the benchmarks, first ensure [PNPM](https://pnpm.io/installation) is installed on your system and initialize and setup the submodule (it uses `pnpm` as a package manager):
+We have a benchmark suite that we use to measure the performance of Preact. Our benchmark suite lives in our [preactjs/benchmarks repository](https://github.com/preactjs/benchmarks), but is included here as Git submodule. To run the benchmarks, first ensure [pnpm](https://pnpm.io/installation) is installed on your system and initialize and setup the submodule:
 
 ```bash
 pnpm -v # Make sure pnpm is installed
@@ -213,13 +213,13 @@ Before using the automated npm publishing flow, make sure npm trusted publishing
 > **ATTENTION:** Make sure that you've cleared the project correctly
 > when switching from a 10.x branch.
 
-0. Run `rm -rf dist node_modules && npm i` to make sure to have the correct dependencies.
+0. Run `rm -rf dist node_modules && pnpm install` to make sure to have the correct dependencies.
 1. [Write the release notes](#writing-release-notes) and keep them as a draft in GitHub
    1. I'd recommend writing them in an offline editor because each edit to a draft will change the URL in GitHub.
 2. Make a PR where **only** the version number is incremented in `package.json` (note: We follow `SemVer` conventions)
 3. Wait until the PR is approved and merged.
 4. Switch back to the `main` branch and pull the merged PR
-5. Run `npm run build && npm publish`
+5. Run `pnpm run build && npm publish`
    1. Make sure you have 2FA enabled in npm, otherwise the above command will fail.
    2. If you're doing a pre-release add `--tag next` to the `npm publish` command to publish it under a different tag (default is `latest`)
 6. Publish the release notes and create the correct git tag.