Switch to pnpm to mitigate supply chain risks

.github/workflows/main.yml

@@ -8,6 +8,10 @@ on:
   # Allows to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+env:
+  # Unify cypress cache folder to avoid missing binaries on macOS/Windows
+  CYPRESS_CACHE_FOLDER: ~/.cypress-cache
+
 jobs:
   formatting:
     runs-on: ubuntu-latest
@@ -19,11 +23,11 @@ jobs:
 
       - uses: actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561 # v2
         with:
-          node-version: "20"
-
-      - run: npm install
+          node-version: "24"
+      - run: corepack enable
+      - run: pnpm install
 
-      - run: npx prettier --check .
+      - run: pnpm exec prettier --check .
 
   typechecks:
     runs-on: ubuntu-latest
@@ -35,11 +39,11 @@ jobs:
 
       - uses: actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561 # v2
         with:
-          node-version: "20"
+          node-version: "24"
+      - run: corepack enable
+      - run: pnpm install
 
-      - run: npm install
-
-      - run: npx tsc
+      - run: pnpm exec tsc
 
   e2e-chrome:
     runs-on: ubuntu-latest
@@ -49,6 +53,11 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561 # v2
+        with:
+          node-version: "24"
+      - run: corepack enable
+
       - uses: cypress-io/github-action@f790eee7a50d9505912f50c2095510be7de06aa7 # v6
         with:
           browser: chrome
@@ -61,6 +70,11 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561 # v2
+        with:
+          node-version: "24"
+      - run: corepack enable
+
       - uses: cypress-io/github-action@f790eee7a50d9505912f50c2095510be7de06aa7 # v6
         with:
           browser: firefox
@@ -73,6 +87,11 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561 # v2
+        with:
+          node-version: "24"
+      - run: corepack enable
+
       - uses: cypress-io/github-action@f790eee7a50d9505912f50c2095510be7de06aa7 # v6
         with:
           browser: edge
@@ -85,6 +104,11 @@ jobs:
         with:
           persist-credentials: false
 
+      - uses: actions/setup-node@1f8c6b94b26d0feae1e387ca63ccbdc44d27b561 # v2
+        with:
+          node-version: "24"
+      - run: corepack enable
+
       - uses: cypress-io/github-action@f790eee7a50d9505912f50c2095510be7de06aa7 # v6
         with:
           browser: webkit

.gitignore

@@ -1 +1,2 @@
 node_modules/*
+.corepack/*

.prettierignore

@@ -1 +1,2 @@
 node_modules
+pnpm-lock.yaml

README.md

@@ -130,11 +130,11 @@ The library is implemented in [withered](https://en.wikipedia.org/wiki/Gunpei_Yo
 
 There is ample JSDoc documentation so that the TypeScript compiler may be used for typechecking in strict mode:
 
-    npm test
+    pnpm test
 
 The code is formatted with slightly non-standard prettier:
 
-    npm run format
+    pnpm run format
 
 End-to-end tests are done using Cypress.
 

flake.nix

@@ -0,0 +1,30 @@
+{
+  description = "Node.js and pnpm via Corepack";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+  };
+
+  outputs = { self, nixpkgs }:
+    let
+      supportedSystems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+
+      forEachSupportedSystem = f: nixpkgs.lib.genAttrs supportedSystems (system: f {
+        pkgs = import nixpkgs { inherit system; };
+      });
+    in
+    {
+      devShells = forEachSupportedSystem ({ pkgs }: {
+        default = pkgs.mkShell {
+          packages = [
+            pkgs.nodejs_22
+            pkgs.corepack_22
+          ];
+
+          shellHook = ''
+            export COREPACK_HOME="$PWD/.corepack"
+          '';
+        };
+      });
+    };
+}