https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36682
--- Comment #6 from Paul Derscheid <[email protected]> --- Created attachment 202145 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=202145&action=edit Bug 36682: Replace Yarn with pnpm Koha currently uses Yarn Classic, installed in ktd from Yarn's external Debian repository. Modern Yarn removes commands and options used by Koha and ktd and would require a broader migration of the existing build environment. Replace Yarn with pnpm 10.34.5. pnpm supports frozen installations and read-only lockfile validation directly, while providing deterministic dependency resolution, a content-addressed package store, and stricter dependency isolation. Preserve the existing dependency resolutions as pnpm overrides so the RM-generated pnpm lockfile retains the required security constraints. Explicitly allow the dependency build scripts required by Koha. Declare pnpm 10.34.5 as the supported package-manager version. Use pnpm's default isolated linker. ktd continues installing dependencies under /kohadevbox/node_modules, outside the bind-mounted Koha checkout. No checkout-local node_modules or hoisted compatibility configuration is required. Update the resource build, formatting tools, documentation, templates, mock templates, and installation mapping to use pnpm. The lockfile transition is deliberately deferred to the RM. Supported containers must: - use Node.js 18.12 or newer; - install pnpm 10.34.5 globally through npm; - remove the Yarn repository and Yarn Classic package; - install gulp-cli globally through npm; - copy package.json and pnpm-lock.yaml to /kohadevbox; - run `pnpm install --frozen-lockfile` from /kohadevbox; - retain the existing Cypress cache handling. Test plan: 1. Start ktd before applying the patches: ktd up -d 2. Install pnpm in the running container: ktd --root --shell --run \ 'npm install --global [email protected]' 3. Apply both patches. 4. Generate the pnpm lockfile from the existing Yarn lockfile: cd /kohadevbox/koha pnpm import pnpm install --lockfile-only 5. Enter a root ktd shell and recreate the shared dependency tree: ktd --root --shell cp /kohadevbox/koha/package.json \ /kohadevbox/koha/pnpm-lock.yaml \ /kohadevbox/ cd /kohadevbox rm -rf node_modules pnpm install --frozen-lockfile 6. Confirm the required dependency build scripts complete successfully. 7. Enter ktd as the normal user: ktd --shell cd /kohadevbox/koha 8. Confirm the expected pnpm version and dependency layout: pnpm --version test ! -e node_modules test -d /kohadevbox/node_modules/.pnpm The version should be 10.34.5 and both test commands should succeed. 9. Verify the lockfile test: prove xt/verify-pnpm-lock.t 10. Build the production assets: pnpm build:prod 11. Verify the development tools: pnpm --silent exec prettier --version pnpm cypress verify 12. Confirm the lockfile test, production build, Prettier, and Cypress checks succeed. Existing asset-size and dependency deprecation warnings are expected. @RM: pnpm-lock.yaml is deliberately not included in this patch and yarn.lock is deliberately not removed. Install the pinned pnpm version globally inside ktd: ktd --root --shell --run \ 'npm install --global [email protected]' After applying both patches, generate the replacement lockfile from the root of the Koha checkout: pnpm import pnpm install --lockfile-only prove xt/verify-pnpm-lock.t Include the lockfile transition when pushing the series: git add pnpm-lock.yaml git rm yarn.lock The corresponding koha-testing-docker change and updated images must be available before this is pushed. -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
