SableClient · 7w1 · Mar 11, 2026 · Mar 11, 2026 · Mar 11, 2026 · Mar 11, 2026
diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
@@ -5,24 +5,27 @@ inputs:
   install-command:
     description: Command used to install dependencies.
     required: false
-    default: npm ci
+    default: pnpm install --frozen-lockfile --ignore-scripts
   build:
     description: Whether to build the app after installing dependencies.
     required: false
     default: 'false'
   build-command:
     description: Command used when build is enabled.
     required: false
-    default: npm run build
+    default: pnpm run build
 
 runs:
   using: composite
   steps:
+    - name: Setup pnpm
+      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+
     - name: Setup node
       uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
       with:
         node-version-file: '.node-version'
-        cache: 'npm'
+        cache: 'pnpm'
 
     - name: Install dependencies
       shell: bash

diff --git a/.github/workflows/cloudflare-web-preview.yml b/.github/workflows/cloudflare-web-preview.yml
@@ -110,7 +110,7 @@ jobs:
           echo "preview_url=${preview_url}" >> "$GITHUB_OUTPUT"
 
       - name: Publish summary and PR comment
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           MARKER: '<!-- cloudflare-worker-preview -->'
           PREVIEW_URL: ${{ steps.preview.outputs.preview_url }}

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
@@ -69,14 +69,14 @@ jobs:
       - name: Setup app
         uses: ./.github/actions/setup
         with:
-          install-command: npm ci --ignore-scripts
+          install-command: pnpm install --frozen-lockfile --ignore-scripts
 
       - name: Build site
         env:
           VITE_BUILD_HASH: ${{ steps.vars.outputs.short_sha }}
           VITE_IS_RELEASE_TAG: ${{ steps.release_tag.outputs.is_release }}
         run: |
-          NODE_OPTIONS=--max_old_space_size=4096 npm run build
+          NODE_OPTIONS=--max_old_space_size=4096 pnpm run build
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0

diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml
@@ -32,7 +32,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Enrich changelog with PR attribution
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

diff --git a/.github/workflows/quality-checks.yml b/.github/workflows/quality-checks.yml
@@ -21,7 +21,7 @@ jobs:
         uses: ./.github/actions/setup
 
       - name: Check formatting
-        run: npm run fmt:check
+        run: pnpm run fmt:check
 
   lint:
     name: Lint
@@ -38,7 +38,7 @@ jobs:
         uses: ./.github/actions/setup
 
       - name: Run ESLint
-        run: npm run lint
+        run: pnpm run lint
 
   typecheck:
     name: Typecheck
@@ -55,7 +55,7 @@ jobs:
         uses: ./.github/actions/setup
 
       - name: Run TypeScript typecheck
-        run: npm run typecheck -- --pretty false
+        run: pnpm run typecheck --pretty false
 
   knip:
     name: Knip
@@ -70,8 +70,6 @@ jobs:
 
       - name: Setup app
         uses: ./.github/actions/setup
-        with:
-          install-command: npm ci --ignore-scripts
 
       - name: Run Knip
-        run: npm run knip
+        run: pnpm run knip
diff --git a/.github/workflows/require-changeset.yml b/.github/workflows/require-changeset.yml
@@ -49,7 +49,7 @@ jobs:
           fi
 
       - name: Manage changeset comment
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           SKIP: ${{ steps.labels.outputs.skip }}
           CHANGESET_FOUND: ${{ steps.check.outputs.found }}
@@ -86,7 +86,7 @@ jobs:
 
             **How to add a changeset:**
 
-            1. Run \`npm run document-change\` (interactive) and commit the generated file, or
+            1. Run \`pnpm run document-change\` (interactive) and commit the generated file, or
             2. Manually create \`.changeset/<descriptive-name>.md\`:
 
             \`\`\`md

diff --git a/.npmrc b/.npmrc
diff --git a/.prettierignore b/.prettierignore
@@ -1,7 +1,7 @@
 dist
 node_modules
 package.json
-package-lock.json
+pnpm-lock.yaml
 LICENSE
 README.md
 CHANGELOG.md

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -39,10 +39,10 @@ Also, we use [ESLint](https://eslint.org/) for clean and stylistically consisten
 
 **Pull requests are not merged unless all quality checks are passing.** At minimum, `format`, `lint`, `typecheck`, and `knip` must all be green before a pull request can be merged. Run these locally before opening or updating a pull request:
 
-- `npm run fmt:check`
-- `npm run lint`
-- `npm run typecheck`
-- `npm run knip`
+- `pnpm run fmt:check`
+- `pnpm run lint`
+- `pnpm run typecheck`
+- `pnpm run knip`
 
 ## Restrictions on Generative AI Usage
 
@@ -62,7 +62,7 @@ We use [Knope](https://knope.tech/) with the Knope GitHub Bot to manage change d
 
 If you have used [Changesets](https://github.com/changesets/changesets) before, Knope should feel very similar. The main difference is scope: Changesets is typically used for JavaScript repositories because it relies on `package.json`, while Knope is multi-language.
 
-If you prefer, you can install the Knope CLI yourself using the [official installation guide](https://knope.tech/installation/). This repo also exposes the CLI through npm scripts, so you can run `npm run knope -- <subcommand>` (for example: `npm run knope -- document-change`). Otherwise, this repo installs Knope for you via `postinstall`, so running `npm i` is enough.
+If you prefer, you can install the Knope CLI yourself using the [official installation guide](https://knope.tech/installation/). This repo also exposes the CLI through pnpm scripts, so you can run `pnpm run knope -- <subcommand>` (for example: `pnpm run knope -- document-change`). Otherwise, this repo installs Knope for you via `postinstall`, so running `pnpm i` is enough.
 
 ### Documenting a change
 
@@ -72,8 +72,8 @@ For user-facing pull requests, add one before requesting review.
 
 CLI paths:
 
-- `npm run document-change`
-- `npm run knope -- document-change`
+- `pnpm run document-change`
+- `pnpm run knope -- document-change`
 - `knope document-change` (if Knope is installed locally)
 
 All commands open an interactive prompt; fill in the package, change type, and short summary, then commit the generated change file in your PR.
@@ -112,11 +112,11 @@ Releases are driven by Knope Bot (`[bot.releases].enabled = true`):
 
 Maintainers can preview behavior without changing files:
 
-- `npm run knope -- release --dry-run`
+- `pnpm run knope -- release --dry-run`
 
 You can also validate the local Knope config with:
 
-- `npm run knope -- --validate`
+- `pnpm run knope -- --validate`
 
 **For any query or design discussion, join our [Matrix room](https://matrix.to/#/#sable:sable.moe).**
 

diff --git a/Dockerfile b/Dockerfile
@@ -1,18 +1,24 @@
+## Base
+FROM --platform=$BUILDPLATFORM node:24.13.1-alpine AS base
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+RUN corepack enable
+
 ## Builder
-FROM --platform=$BUILDPLATFORM node:24.13.1-alpine AS builder
+FROM base AS builder
 
 WORKDIR /src
 
 ARG VITE_BUILD_HASH
 ARG VITE_IS_RELEASE_TAG=false
 ENV VITE_BUILD_HASH=$VITE_BUILD_HASH
 ENV VITE_IS_RELEASE_TAG=$VITE_IS_RELEASE_TAG
-
-COPY .npmrc package.json package-lock.json /src/
-RUN npm ci --ignore-scripts
+COPY pnpm-lock.yaml /src/
+RUN pnpm fetch
 COPY . /src/
+RUN pnpm install --offline --frozen-lockfile --ignore-scripts
 ENV NODE_OPTIONS=--max_old_space_size=4096
-RUN npm run build
+RUN pnpm run build
 
 ## Dist
 FROM scratch AS site-dist

diff --git a/README.md b/README.md
@@ -54,8 +54,8 @@ services:
 To build and serve Sable yourself with nginx, clone this repo and build it:
 
 ```sh
-npm ci # Installs all dependencies
-npm run build # Compiles the app into the dist/ directory
+pnpm i # Installs all dependencies
+pnpm run build # Compiles the app into the dist/ directory
 ```
 
 After that, you can copy the dist/ directory to your server and serve it.
@@ -71,15 +71,18 @@ After that, you can copy the dist/ directory to your server and serve it.
 
 Execute the following commands to start a development server:
 ```sh
-npm ci # Installs all dependencies
-npm run dev # Serve a development version
+fnm use --corepack-enabled # Activates the Node version and enables corepack
+# If you not using fnm, install corepack manually: npm install --global corepack@latest
+corepack install # Installs the pnpm version specified in package.json
+pnpm i # Installs all dependencies
+pnpm run dev # Serve a development version
 ```
 
 To build the app:
 ```sh
-npm run build # Compiles the app into the dist/ directory
+pnpm run build # Compiles the app into the dist/ directory
 ```
 
 ## Deployment and infrastructure
 Deployment workflows and infrastructure details live in
-[`infra/README.md`](infra/README.md).
+[`infra/README.md`](infra/README.md).
diff --git a/infra/README.md b/infra/README.md
@@ -6,7 +6,7 @@ production deployment, and the production custom domain.
 Prerequisites:
 
 - OpenTofu `1.11.x` installed locally
-- Node.js/npm installed locally so you can build `dist/` before Worker uploads
+- Node.js/pnpm installed locally so you can build `dist/` before Worker uploads
 - A Cloudflare account with the target zone already onboarded to Cloudflare
 - A GitLab project to store the OpenTofu state
 - A GitLab access token that can read and write that project's OpenTofu state
@@ -52,17 +52,17 @@ Local setup:
 1. Copy `terraform.tfvars.example` to `terraform.tfvars` and fill in shared values.
 2. Copy `gitlab.http.tfbackend.example` to `gitlab.http.tfbackend` and fill in the
    GitLab project ID, state name, and username.
-3. Run `npm ci` from the repo root.
+3. Run `pnpm install` from the repo root.
 4. Export the GitLab access token as the backend password.
 5. Export the Cloudflare API token for OpenTofu.
-6. Run `npm run build` before `tofu plan` or `tofu apply`, because
+6. Run `pnpm run build` before `tofu plan` or `tofu apply`, because
    `cloudflare_worker_version` uploads the built `dist/` assets.
 7. Initialize the backend.
 
 Local OpenTofu production flow from the repo root:
 
 ```bash
-npm run build
+pnpm run build
 export TF_HTTP_PASSWORD="<your-gitlab-access-token>"
 export CLOUDFLARE_API_TOKEN="<your-cloudflare-api-token>"
 tofu -chdir=infra/web init -reconfigure -backend-config="../gitlab.http.tfbackend"

diff --git a/knip.json b/knip.json
@@ -5,7 +5,11 @@
     "interface": true,
     "type": true
   },
-  "ignoreDependencies": ["buffer", "@element-hq/element-call-embedded", "workbox-precaching"],
+  "ignoreDependencies": [
+    "buffer",
+    "@element-hq/element-call-embedded",
+    "@matrix-org/matrix-sdk-crypto-wasm"
+  ],
   "ignoreBinaries": ["knope"],
   "rules": {
     "exports": "off",

diff --git a/knope.toml b/knope.toml
@@ -1,5 +1,5 @@
 [package]
-versioned_files = ["package.json", "package-lock.json"]
+versioned_files = ["package.json"]
 changelog = "CHANGELOG.md"
 extra_changelog_sections = [
     { name = "Documentation", types = ["docs"] },