Switch package manager from yarn to pnpm

[Copilot]

Replaces yarn with pnpm across all tooling and configuration. Drops pnpm-lock.yaml from version control and removes the Gitpod config file.

Package manager migration

• package.json — packageManager updated to pnpm@10.32.1; proxy scripts (p, pg) updated to pnpm flag syntax
• yarn.lock → removed; pnpm-lock.yaml generated but added to .gitignore
• .yarnrc → replaced with .npmrc (registry config + shamefully-hoist=true to preserve transitive dep access for Hexo scripts)

CI / tooling

• .github/workflows/pages.yml — added pnpm/action-setup@v4, switched cache: yarn → cache: pnpm, bumped Node.js 14 → 20, replaced all yarn invocations with pnpm
• Dockerfile — yarn global add hexo-cli + yarn install → npm install -g pnpm hexo-cli + pnpm install
• .gitpod.yml — removed

Minor

• .gitignore — added pnpm-lock.yaml
• _config.yml — updated inline comment from yarn add → pnpm add

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
blog	Error		Mar 18, 2026 2:44pm

[qodo-code-review]

Review Summary by Qodo

Migrate to pnpm, update dependencies, and adopt ESLint flat config

✨ Enhancement 🧪 Tests

Walkthroughs

Description

• Migrate package manager from yarn to pnpm with updated configuration
• Update dependencies to latest versions including Hexo 8.1.1
• Migrate ESLint to flat config format with new eslint.config.js
• Remove unused files (hexo-newd.js, install.json) and clean up documentation
• Update CI/CD workflows and Docker configuration for pnpm compatibility

Diagram

flowchart LR
  A["Package Manager<br/>yarn → pnpm"] --> B["Configuration<br/>Updates"]
  C["Dependency<br/>Updates"] --> D["ESLint Flat<br/>Config"]
  E["File Cleanup<br/>Remove unused files"] --> F["CI/CD &<br/>Docker Updates"]
  B --> G["Updated Project"]
  D --> G
  F --> G

Loading

File Changes

1. eslint.config.js ✨ Enhancement +12/-0

Create ESLint flat config file

eslint.config.js

---

2. .eslintrc.json ⚙️ Configuration changes +0/-7

Remove legacy ESLint configuration

.eslintrc.json

---

3. eslint-config-hexo ✨ Enhancement +0/-0

Migrate to ESLint flat config format

eslint-config-hexo

---

View more (11)

4. package.json Dependencies +14/-15

Update dependencies and switch to pnpm

package.json

---

5. .npmrc ⚙️ Configuration changes +2/-0

Add npm registry and hoisting configuration

.npmrc

---

6. .yarnrc ⚙️ Configuration changes +0/-2

Remove yarn configuration file

.yarnrc

---

7. .github/workflows/pages.yml ⚙️ Configuration changes +7/-4

Update CI workflow for pnpm and Node.js 20

.github/workflows/pages.yml

---

8. Dockerfile ⚙️ Configuration changes +2/-2

Update Docker to use pnpm instead of yarn

Dockerfile

---

9. .gitpod.yml Miscellaneous +0/-8

Remove Gitpod configuration file

.gitpod.yml

---

10. _config.yml 📝 Documentation +1/-1

Update comment from yarn to pnpm

_config.yml

---

11. source/downloads/code/hexo-newd.js Miscellaneous +0/-16

Remove unused Hexo console command file

source/downloads/code/hexo-newd.js

---

12. source/downloads/code/install.json Miscellaneous +0/-119

Remove unused Windows package list file

source/downloads/code/install.json

---

13. source/_posts/cherry/winget.md 📝 Documentation +118/-1

Inline JSON content and remove file reference

source/_posts/cherry/winget.md

---

14. source/_posts/beechnut/theme-show-case.md 📝 Documentation +30/-24

Format markdown and remove unused code example

source/_posts/beechnut/theme-show-case.md

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📎 Requirement gaps (0) 📐 Spec deviations (0)

1. No committed pnpm lockfile 🐞 Bug ⛯ Reliability

Description

CI and Docker run pnpm install while pnpm-lock.yaml is excluded from the repo, so installs will
resolve potentially different dependency versions over time (due to ^ ranges), leading to
non-reproducible builds/deployments. This can cause “works yesterday, fails today” CI and production
site differences without any code changes.

Code

.github/workflows/pages.yml[R31-32]

+        pnpm add -g hexo-cli
+        pnpm install

Evidence

The workflow and Docker image both install dependencies via pnpm, but the lockfile is explicitly
ignored, and package.json uses caret ranges that will float to newer versions without a lockfile to
pin resolution.

.github/workflows/pages.yml[24-34]
Dockerfile[3-10]
.gitignore[4-9]
package.json[17-40]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`pnpm install` is executed in CI and Docker, but `pnpm-lock.yaml` is not present/committed (it is gitignored). With `^` dependency ranges, this makes dependency resolution drift over time and breaks build reproducibility.

## Issue Context
- CI (`pages.yml`) runs `pnpm install`.
- Docker build runs `pnpm install`.
- The repository ignores `pnpm-lock.yaml`.

## Fix Focus Areas
- .gitignore[4-9]
- .github/workflows/pages.yml[24-34]
- Dockerfile[3-10]
- package.json[17-40]

## Suggested fix
1. Remove `pnpm-lock.yaml` from `.gitignore` and add/commit the generated `pnpm-lock.yaml`.
2. In CI, change to `pnpm install --frozen-lockfile` (or pnpm’s equivalent strict mode) to ensure the lockfile is honored.
3. Consider doing the same in Docker builds (e.g., `pnpm install --frozen-lockfile`) for deterministic container builds.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Unpinned pnpm in Docker 🐞 Bug ⛯ Reliability

Description

The Dockerfile installs pnpm without pinning (npm install -g pnpm), which can diverge from the
repo’s declared packageManager version (pnpm@10.32.1) and cause sudden Docker build breakage
when pnpm releases change behavior. This makes Docker builds harder to reproduce and debug.

Code

Dockerfile[4]

+RUN npm install -g pnpm hexo-cli

Evidence

Docker uses whatever pnpm version is latest at build time, while the project declares a specific
pnpm version in package.json, creating a version skew risk.

Dockerfile[3-5]
package.json[35-40]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Docker installs an unpinned pnpm version, which may not match the version declared by the repository and can introduce nondeterministic build outcomes.

## Issue Context
The repo declares `"packageManager": "pnpm@10.32.1"` but Docker installs `pnpm` without a version.

## Fix Focus Areas
- Dockerfile[3-5]
- package.json[35-40]

## Suggested fix
- Change the Dockerfile to install a pinned pnpm version, e.g. `npm install -g pnpm@10.32.1 hexo-cli`.
- Or use Corepack in the image and let it provision the pnpm version declared in `package.json`.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ The new review experience is currently in Beta. Learn more

[qodo-code-review]

1. No committed pnpm lockfile 🐞 Bug ⛯ Reliability

CI and Docker run pnpm install while pnpm-lock.yaml is excluded from the repo, so installs will
resolve potentially different dependency versions over time (due to ^ ranges), leading to
non-reproducible builds/deployments. This can cause “works yesterday, fails today” CI and production
site differences without any code changes.

Agent Prompt

## Issue description
`pnpm install` is executed in CI and Docker, but `pnpm-lock.yaml` is not present/committed (it is gitignored). With `^` dependency ranges, this makes dependency resolution drift over time and breaks build reproducibility.

## Issue Context
- CI (`pages.yml`) runs `pnpm install`.
- Docker build runs `pnpm install`.
- The repository ignores `pnpm-lock.yaml`.

## Fix Focus Areas
- .gitignore[4-9]
- .github/workflows/pages.yml[24-34]
- Dockerfile[3-10]
- package.json[17-40]

## Suggested fix
1. Remove `pnpm-lock.yaml` from `.gitignore` and add/commit the generated `pnpm-lock.yaml`.
2. In CI, change to `pnpm install --frozen-lockfile` (or pnpm’s equivalent strict mode) to ensure the lockfile is honored.
3. Consider doing the same in Docker builds (e.g., `pnpm install --frozen-lockfile`) for deterministic container builds.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools