feat: add pnpm workspace catalog for centralised dependency management by ryoppippi · Pull Request #196 · StackOneHQ/mcp-connectors

ryoppippi · 2025-11-21T11:59:25Z

Summary

This PR introduces pnpm's workspace catalog feature to centralise dependency version management across the monorepo, following the pattern used by modern pnpm projects like tsdown and disco.

Changes

1. Catalog Configuration (`pnpm-workspace.yaml`)

Added three catalog categories:
- dev: Development dependencies (biome, tsdown, vitest, type definitions)
- peer: Peer dependencies and UI utilities (faker, chalk, ora, treeify)
- prod: Production dependencies (MCP SDK, connectors, zod)
Enabled catalogMode: strict for enforcement
Added trustPolicy: no-downgrade with exception for chokidar@4.0.3

2. Package Migrations

Root package: All devDependencies now use catalog:dev
mcp-connectors: All dependencies use catalog:prod
mcp-test: Mixed usage - catalog:prod for core deps, catalog:peer for UI libs
server: Dependencies use catalog:prod, devDependencies use catalog:dev

3. Version Alignments

Unified zod to v3.25 across all packages (previously mixed v3/v4)
Standardised @modelcontextprotocol/sdk to v1.18.0
Updated mcp-test tool registration API to match SDK v1.18

4. Additional Improvements

Simplified mcp-connectors package exports configuration
Updated MCP SDK tool registration from server.tool() to server.registerTool()

Benefits

Centralised version management: Single source of truth for dependency versions
Consistency: Ensures all packages use aligned versions
Easier updates: Update versions in one place rather than multiple package.json files
Supply chain security: Trust policy prevents unintended dependency downgrades

Test Plan

pnpm install succeeds without errors
pnpm typecheck passes for all packages
pnpm build succeeds for mcp-connectors package
All commits are independently revertable

Breaking Changes

None. The catalog system is transparent to package consumers.

Copilot

Pull Request Overview

This PR migrates the monorepo from Bun to pnpm as the primary package manager. The migration updates workspace configuration, lockfiles, package scripts, and CI/CD workflows to use pnpm instead of Bun, while preserving Bun as a supported runtime via devEngines.

Key Changes:

Replaces Bun workspaces with pnpm workspaces configuration
Updates all package scripts to use pnpm commands
Migrates CI/CD workflows from setup-bun to pnpm/action-setup
Adds devEngines configuration to support both Node.js and Bun runtimes

Reviewed Changes

Copilot reviewed 12 out of 14 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pnpm-workspace.yaml	New pnpm workspace configuration with minimumReleaseAge set to 1 day
pnpm-lock.yaml	New pnpm lockfile replacing bun.lockb
package.json	Updated package manager, scripts, and devEngines configuration
packages/mcp-connectors/package.json	Added devEngines configuration
packages/mcp-connectors/tsdown.config.ts	Changed devExports from 'bun' to true
apps/server/package.json	Added devEngines configuration
apps/mcp-test/package.json	Added devEngines configuration
bunfig.toml	Removed Bun configuration file
.github/workflows/*.yml	Updated all workflows to use pnpm

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Introduce pnpm catalog feature to centralise dependency version management across the monorepo. This follows the pattern used by tsdown and other modern pnpm workspaces. Catalogs are organised into three categories: - dev: development dependencies (biome, tsdown, vitest, etc.) - peer: peer dependencies and UI utilities (faker, chalk, ora, etc.) - prod: production dependencies (MCP SDK, connectors, zod, etc.) Added trustPolicy configuration to prevent dependency downgrades, with an exception for chokidar@4.0.3 which lacks provenance attestation but is required by tsdown. This change can be reverted independently - packages will fall back to their explicitly versioned dependencies.

Change package exports from conditional format to direct source export. This simplifies the configuration by always pointing to the source TypeScript file, removing the bun-specific conditional. Also add empty devDependencies field for consistency with other packages in the monorepo. This change can be reverted independently without affecting the catalog migration or other functionality.

Replace hardcoded dependency versions with catalog references across all package.json files in the monorepo. This centralises version management and ensures consistency. Changes by package: - root: All devDependencies now use catalog:dev - mcp-connectors: All dependencies use catalog:prod - mcp-test: devDependencies use catalog:dev, dependencies split between catalog:prod (SDK, zod) and catalog:peer (UI libs) - server: Dependencies use catalog:prod, devDependencies use catalog:dev Notable version alignments: - Unified zod to v3.25 across all packages (down from v4.1.5 in mcp-test) to maintain compatibility with openai package - Standardised @modelcontextprotocol/sdk to v1.18.0 - Aligned all type definitions to latest versions This change can be reverted independently by restoring the original hardcoded version strings.

cubic-dev-ai

1 issue found across 14 files

Prompt for AI agents (all 1 issues)


Understand the root cause of the following 1 issues and fix them.


<file name=".github/workflows/dry-publish.yml">

<violation number="1" location=".github/workflows/dry-publish.yml:23">
`pkg-pr-new` is no longer invoked via a dlx-style runner, so the workflow will fail unless the package is added to dependencies. Use `pnpm dlx` (the equivalent of `bunx`) to download and run the tool on demand.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

cubic-dev-ai · 2025-11-21T12:17:45Z


      - name: 🚀 Dry Run Publish Package
-        run: bunx pkg-pr-new publish './packages/*'
+        run: pnpm exec pkg-pr-new publish './packages/*'


pkg-pr-new is no longer invoked via a dlx-style runner, so the workflow will fail unless the package is added to dependencies. Use pnpm dlx (the equivalent of bunx) to download and run the tool on demand.

Prompt for AI agents

Address the following comment on .github/workflows/dry-publish.yml at line 23: <comment>`pkg-pr-new` is no longer invoked via a dlx-style runner, so the workflow will fail unless the package is added to dependencies. Use `pnpm dlx` (the equivalent of `bunx`) to download and run the tool on demand.</comment> <file context> @@ -8,16 +8,16 @@ jobs: - name: 🚀 Dry Run Publish Package - run: bunx pkg-pr-new publish './packages/*' + run: pnpm exec pkg-pr-new publish './packages/*' </file context>

Suggested change

run: pnpm exec pkg-pr-new publish './packages/*'

run: pnpm dlx pkg-pr-new publish './packages/*'

✅ Addressed in 92c82b9

pkg-pr-new · 2025-11-21T12:20:09Z

Open in StackBlitz

npm i https://pkg.pr.new/StackOneHQ/mcp-connectors/@stackone/mcp-test@196

npm i https://pkg.pr.new/StackOneHQ/mcp-connectors/@stackone/mcp-connectors@196

commit: 67da9df

pkg-pr-new · 2025-11-21T12:20:10Z

Open in StackBlitz

npm i https://pkg.pr.new/StackOneHQ/mcp-connectors/@stackone/mcp-connectors@196

commit: 92c82b9

Update generate_test_data tool registration to use the new registerTool method and schema format introduced in MCP SDK v1.18. Changes: - Replace server.tool() with server.registerTool() - Migrate from plain object schema to structured format with title, description, and inputSchema fields - Use Zod schema directly in inputSchema instead of JSON Schema format This resolves type errors that occurred after upgrading to MCP SDK v1.18 and aligns with the new API conventions. This change can be reverted independently by restoring the old server.tool() API call format.

Update pnpm-lock.yaml to reflect the dependency changes from migrating to catalog-based version management. Key changes: - Resolved catalog references to concrete versions - Updated zod from v4.1.5 to v3.25 in mcp-test package - Aligned @modelcontextprotocol/sdk to v1.18.0 across packages - Updated various development dependencies to catalog versions This lockfile update is the result of the catalog configuration and package.json changes in the previous commits.

Update README.md to reflect the migration from Bun to pnpm: - Replace Bun installation instructions with pnpm - Update all command examples from 'bun' to 'pnpm' - Change monorepo description from "Bun and Turbo" to "pnpm workspaces" - Update connector count from 35+ to 50+ to match current state These documentation changes ensure developers can correctly set up and use the project after the package manager migration.

Configure pnpm to only rebuild specific native dependencies that require compilation, rather than rebuilding all dependencies. This optimises installation performance by limiting rebuilds to packages with native code: - @biomejs/biome: Rust-based linter/formatter - esbuild: Go-based bundler - msw: Contains native modules - protobufjs: Protocol buffer implementation Also removed inline comment from minimumReleaseAge for consistency with other configuration entries, and added blank line before trustPolicyExclude for better visual separation. This change can be reverted independently without affecting the catalog functionality.

This reverts commit 14cfa77.

🤖 I have created a release *beep* *boop* --- <details><summary>mcp-connectors: 0.0.24</summary> ## [0.0.24](mcp-connectors-v0.0.23...mcp-connectors-v0.0.24) (2025-11-21) ### Features * add pnpm workspace catalog for centralised dependency management ([#196](#196)) ([c46601a](c46601a)) * add Zod credentials schemas to all connector metadata ([#188](#188)) ([741cea9](741cea9)) ### Bug Fixes * build ([d677c4e](d677c4e)) </details> <details><summary>mcp-test: 0.0.8</summary> ## [0.0.8](mcp-test-v0.0.7...mcp-test-v0.0.8) (2025-11-21) ### Features * add pnpm workspace catalog for centralised dependency management ([#196](#196)) ([c46601a](c46601a)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Revert the following commits to restore the codebase to the state at commit 994240f: - cf25fb5: chore: release main (#195) - c46601a: feat: add pnpm workspace catalog for centralised dependency management (#196) - 00f5510: ci: run build at dry-publish - 741cea9: feat: add Zod credentials schemas to all connector metadata (#188) - d677c4e: fix: build - 648dc7d: chore: migrate from Turbo to Bun workspace commands (#192) - 231c571: chore: build (#191) - 99b3dc6: chore: fix build (#190) - 3722522: ci: add pkg-pr-new integration for preview package releases (#189) - 8923ccb: chore: release main (#186) - c260667: docs: update connector count from 35+ to 50+ - 502d38f: chore: trigger release-please - 0e840cc: ci: update actions (#185) - 345a282: ci: use 'bun ci' instead of 'bun install --frozen-lockfile' in GitHub workflows (#183) - 91e4834: feat: add connector metadata exports (#182) - 351dfb2: chore: release main (#179) - b404a0b: fix: remove mcp-config-types package from GitHub workflows and documentation (#178) - 2a31911: feat: remove @stackone/mcp-config-types and migrate to native MCP SDK (#175) This revert restores: - Turbo workspace configuration (turbo.json) - @stackone/mcp-config-types package - Previous connector implementations before Zod schema migration - Previous CI workflow configurations - Bun lockfile (bun.lock) and configuration (bunfig.toml) - Removes pnpm workspace catalog and lockfiles - Removes pkg-pr-new integration The revert is necessary to restore the project to a known stable state before the above changes were introduced.

## Summary This PR reverts the codebase to commit 994240f. ## Commits Reverted This revert undoes the following 18 commits: - cf25fb5: chore: release main (#195) - c46601a: feat: add pnpm workspace catalog for centralised dependency management (#196) - 00f5510: ci: run build at dry-publish - 741cea9: feat: add Zod credentials schemas to all connector metadata (#188) - d677c4e: fix: build - 648dc7d: chore: migrate from Turbo to Bun workspace commands (#192) - 231c571: chore: build (#191) - 99b3dc6: chore: fix build (#190) - 3722522: ci: add pkg-pr-new integration for preview package releases (#189) - 8923ccb: chore: release main (#186) - c260667: docs: update connector count from 35+ to 50+ - 502d38f: chore: trigger release-please - 0e840cc: ci: update actions (#185) - 345a282: ci: use 'bun ci' instead of 'bun install --frozen-lockfile' in GitHub workflows (#183) - 91e4834: feat: add connector metadata exports (#182) - 351dfb2: chore: release main (#179) - b404a0b: fix: remove mcp-config-types package from GitHub workflows and documentation (#178) - 2a31911: feat: remove @stackone/mcp-config-types and migrate to native MCP SDK (#175) ## Changes Restored This revert restores: - ✅ Turbo workspace configuration (turbo.json) - ✅ @stackone/mcp-config-types package - ✅ Previous connector implementations before Zod schema migration - ✅ Previous CI workflow configurations - ✅ Bun lockfile (bun.lock) and configuration (bunfig.toml) ## Changes Removed - ❌ pnpm workspace catalog and lockfiles - ❌ pkg-pr-new integration - ❌ Zod credentials schemas - ❌ Recent build system migrations ## Rationale This revert is necessary to restore the project to a known stable state before the above changes were introduced. ## Test Plan - [ ] Verify the codebase matches commit 994240f - [ ] Run build to ensure project compiles successfully - [ ] Run tests to ensure all tests pass - [ ] Verify CI workflows execute correctly  --- ## Summary by cubic Reverted the repo to a previous stable state to restore the config-types based connector architecture and Bun workflows. This undoes the pnpm catalog, Zod credential schema migration, and preview publish setup to stabilize builds and tests. - **Refactors** - Reintroduces @stackone/mcp-config-types (types, server builder, config helper) and updates server to use it. - Converts connectors back to mcpConnectorConfig; removes recent metadata/credential-schema changes. - Updates docs/tests to import types from @stackone/mcp-config-types; replaces internal test helpers; trims CI-related changes in packages. - **Migration** - Use Bun for local/CI: bun i, bun run build, bun test. - Import MCP types from @stackone/mcp-config-types in consumers. - No action needed for Zod credential schemas; previous connector tool APIs are restored. Written for commit d71d9e2. Summary will update automatically on new commits.

🤖 I have created a release *beep* *boop* --- <details><summary>mcp-connectors: 0.0.22</summary> ## [0.0.22](mcp-connectors-v0.0.21...mcp-connectors-v0.0.22) (2025-11-21) ### Features * add connector metadata exports ([#182](#182)) ([91e4834](91e4834)) * add pnpm workspace catalog for centralised dependency management ([#196](#196)) ([c46601a](c46601a)) * add Zod credentials schemas to all connector metadata ([#188](#188)) ([741cea9](741cea9)) * remove @stackone/mcp-config-types and migrate to native MCP SDK ([#175](#175)) ([2a31911](2a31911)) ### Bug Fixes * build ([d677c4e](d677c4e)) * remove mcp-config-types package from GitHub workflows and documentation ([#178](#178)) ([b404a0b](b404a0b)) ### Reverts * to 994240f ([#197](#197)) ([2d6208f](2d6208f)) </details> <details><summary>mcp-config-types: 0.0.13</summary> ## [0.0.13](mcp-config-types-v0.0.12...mcp-config-types-v0.0.13) (2025-11-21) ### Features * remove @stackone/mcp-config-types and migrate to native MCP SDK ([#175](#175)) ([2a31911](2a31911)) ### Reverts * to 994240f ([#197](#197)) ([2d6208f](2d6208f)) </details> <details><summary>mcp-test: 0.0.8</summary> ## [0.0.8](mcp-test-v0.0.7...mcp-test-v0.0.8) (2025-11-21) ### Features * add pnpm workspace catalog for centralised dependency management ([#196](#196)) ([c46601a](c46601a)) ### Reverts * to 994240f ([#197](#197)) ([2d6208f](2d6208f)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).  --- ## Summary by cubic Release updates across MCP packages: connector metadata exports, Zod-based credential schemas, and a pnpm workspace catalog. Also migrates off @stackone/mcp-config-types to the native MCP SDK. - **New Features** - Export connector metadata. - Add Zod credential schemas to all connectors. - Add pnpm workspace catalog for centralized dependency management. - **Migration** - Replace imports from @stackone/mcp-config-types with native MCP SDK equivalents. - Use the exported Zod schemas for credential validation where needed. Written for commit 479df3e. Summary will update automatically on new commits.  Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

🤖 I have created a release *beep* *boop* --- <details><summary>mcp-connectors: 0.0.23</summary> ## [0.0.23](mcp-connectors-v0.0.22...mcp-connectors-v0.0.23) (2025-11-21) ### Features * add connector metadata exports ([#182](#182)) ([91e4834](91e4834)) * add pnpm workspace catalog for centralised dependency management ([#196](#196)) ([c46601a](c46601a)) * add Zod credentials schemas to all connector metadata ([#188](#188)) ([741cea9](741cea9)) ### Bug Fixes * build ([d677c4e](d677c4e)) ### Reverts * to 994240f ([#197](#197)) ([2d6208f](2d6208f)) </details> <details><summary>mcp-test: 0.0.9</summary> ## [0.0.9](mcp-test-v0.0.8...mcp-test-v0.0.9) (2025-11-21) ### Reverts * to 994240f ([#197](#197)) ([2d6208f](2d6208f)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).  --- ## Summary by cubic Release mcp-connectors 0.0.23 and mcp-test 0.0.9. This adds connector metadata exports, Zod credential schemas, and a workspace catalog, plus a build fix and a stabilizing revert. - **New Features** - Export connector metadata for external use. - Add Zod credential schemas to all connector metadata. - Introduce a pnpm workspace catalog for centralized dependency management. - **Bug Fixes** - Fix build in mcp-connectors. - Revert a prior change in mcp-test to restore stability. Written for commit 3e09d00. Summary will update automatically on new commits.  Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

🤖 I have created a release *beep* *boop* --- <details><summary>mcp-connectors: 0.0.24</summary> ## [0.0.24](mcp-connectors-v0.0.23...mcp-connectors-v0.0.24) (2025-11-21) ### Features * add pnpm workspace catalog for centralised dependency management ([#196](#196)) ([c46601a](c46601a)) * add Zod credentials schemas to all connector metadata ([#188](#188)) ([741cea9](741cea9)) ### Bug Fixes * build ([d677c4e](d677c4e)) * version ([#201](#201)) ([590a47d](590a47d)) ### Reverts * to 994240f ([#197](#197)) ([2d6208f](2d6208f)) </details> <details><summary>mcp-test: 0.0.10</summary> ## [0.0.10](mcp-test-v0.0.9...mcp-test-v0.0.10) (2025-11-21) ### Bug Fixes * version ([#201](#201)) ([590a47d](590a47d)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: migrate to pnpm

c4131c2

Copilot AI review requested due to automatic review settings November 21, 2025 11:59

Copilot started reviewing on behalf of ryoppippi November 21, 2025 11:59 View session

Copilot finished reviewing on behalf of ryoppippi November 21, 2025 12:00

Copilot AI reviewed Nov 21, 2025

View reviewed changes

ryoppippi added 3 commits November 21, 2025 12:14

ryoppippi changed the title ~~chore: migrate to pnpm~~ feat: add pnpm workspace catalog for centralised dependency management Nov 21, 2025

cubic-dev-ai Bot reviewed Nov 21, 2025

View reviewed changes

ryoppippi force-pushed the migrate-to-pnpm branch from 4ba5a29 to 58284ad Compare November 21, 2025 12:18

ryoppippi force-pushed the migrate-to-pnpm branch from 92c82b9 to 1c1819c Compare November 21, 2025 12:20

ryoppippi added 4 commits November 21, 2025 12:21

ci: use pnpm dlx

9cd90e5

ryoppippi force-pushed the migrate-to-pnpm branch from 8525ce6 to 9cd90e5 Compare November 21, 2025 12:21

ci: pnpm for pkg-pr-new

04a10bd

ryoppippi force-pushed the migrate-to-pnpm branch from d3b2b88 to 04a10bd Compare November 21, 2025 12:23

ryoppippi force-pushed the migrate-to-pnpm branch from bcdbcc9 to 66f16df Compare November 21, 2025 12:30

ryoppippi added 2 commits November 21, 2025 12:30

ci: publish dry run app

ccf73c5

ci: publish dry run compact

14cfa77

ryoppippi force-pushed the migrate-to-pnpm branch from 66f16df to 14cfa77 Compare November 21, 2025 12:30

ryoppippi added 4 commits November 21, 2025 12:31

Revert "ci: publish dry run compact"

7562e2e

This reverts commit 14cfa77.

chore: update package.json

ba0ff0d

chore: format

84a8816

chore: clean-pkg-json for apps

f1479fa

ci: pnpm 10.23

67da9df

ryoppippi merged commit c46601a into main Nov 21, 2025
7 checks passed

ryoppippi deleted the migrate-to-pnpm branch November 21, 2025 12:40

github-actions Bot mentioned this pull request Nov 21, 2025

chore: release main #195

Merged

ryoppippi mentioned this pull request Nov 21, 2025

revert: to 994240fe #197

Merged

4 tasks

github-actions Bot mentioned this pull request Nov 21, 2025

chore: release main #198

Merged

github-actions Bot mentioned this pull request Nov 21, 2025

chore: release main #199

Merged

github-actions Bot mentioned this pull request Nov 21, 2025

chore: release main #200

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add pnpm workspace catalog for centralised dependency management#196

feat: add pnpm workspace catalog for centralised dependency management#196
ryoppippi merged 17 commits into
mainfrom
migrate-to-pnpm

ryoppippi commented Nov 21, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot Nov 21, 2025 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Nov 21, 2025 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Nov 21, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	run: pnpm exec pkg-pr-new publish './packages/*'
	run: pnpm dlx pkg-pr-new publish './packages/*'

Conversation

ryoppippi commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

1. Catalog Configuration (pnpm-workspace.yaml)

2. Package Migrations

3. Version Alignments

4. Additional Improvements

Benefits

Test Plan

Breaking Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pkg-pr-new Bot commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Nov 21, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ryoppippi commented Nov 21, 2025 •

edited

Loading

1. Catalog Configuration (`pnpm-workspace.yaml`)

cubic-dev-ai Bot Nov 21, 2025 •

edited

Loading

pkg-pr-new Bot commented Nov 21, 2025 •

edited

Loading