Migrate package manager from Yarn Classic to pnpm - #129
Conversation
Replace Yarn 1.22 with pnpm 11. Build, lint and the custom static-serve builder all verified working end-to-end. Key changes: - Add pnpm-workspace.yaml; convert the local file:./builders package into a workspace:* package - Move resolutions -> overrides and relocate all pnpm settings (overrides, allowBuilds, shamefullyHoist, blockExoticSubdeps) into pnpm-workspace.yaml, since pnpm 11 no longer reads them from package.json/.npmrc - allowBuilds: approve build scripts for @tb/custom-builder, esbuild, @parcel/watcher, lmdb, msgpackr-extract, postinstall-prepare and zrender - blockExoticSubdeps: false to permit the git/url sub-deps pulled by thingsboard-ui-types (ngx-flowchart) and echarts (zrender) - Repoint echarts to a git ref and override zrender to a git ref: pnpm rejects GitHub /archive/*.tar.gz deps for lacking an integrity hash - shamefullyHoist: true so the patched ng-packagr SystemJS step can resolve transitive deps (e.g. @primeuix/styled) from a flat node_modules - Fix ng-packagr patch to load thingsboard modules-map via process.cwd() instead of a Yarn-hoisting-dependent relative path - Declare chokidar and express explicitly in builders (were phantom deps under Yarn's flat layout) - Replace .yarnrc network-timeout with .npmrc fetch-timeout - Update engines, angular.json packageManager, scripts and docs to pnpm - Remove yarn.lock and .yarnrc; add pnpm-lock.yaml
| "dependencies": { | ||
| "chart.js": "3.3.2", | ||
| "echarts": "https://github.com/thingsboard/echarts/archive/5.5.2-TB.tar.gz", | ||
| "echarts": "github:thingsboard/echarts#5.5.2-TB", |
There was a problem hiding this comment.
pnpm rejects GitHub /archive/*.tar.gz URLs because they lack a reproducible integrity hash — the tarball content can change without the URL changing. The github: shorthand points to a specific git ref, which pnpm can lock by commit SHA in pnpm-lock.yaml, giving both integrity and reproducibility
| '@types/express': 5.0.3 | ||
| # echarts fork depends on zrender via a GitHub archive tarball, which pnpm | ||
| # cannot verify (no integrity). Redirect to the equivalent git ref. | ||
| zrender: github:thingsboard/zrender#5.5.0-TB |
There was a problem hiding this comment.
Same root cause as (https://github.com/thingsboard/thingsboard-extensions/pull/129/changes#r3645649780) : echarts' own zrender dependency was declared as a GitHub tarball URL, which pnpm rejects. The override in pnpm-workspace.yaml forces pnpm to use the git-ref form instead. Without it, the install would fail because pnpm can't accept the exotic URL coming in transitively from the echarts package
| "@rollup/plugin-replace": "6.0.3", | ||
| "@rollup/plugin-terser": "1.0.0", | ||
| "@tb/custom-builder": "file:./builders", | ||
| "@tb/custom-builder": "workspace:*", |
There was a problem hiding this comment.
"@tb/custom-builder": "workspace:*" is the pnpm-native way to reference a local workspace package (declared in pnpm-workspace.yaml). The file:./builders form still works, but workspace: is the correct pnpm primitive.
The * here is not a semver wildcard — it does not mean "any version from the registry." It is part of the workspace: protocol and means "use whatever version this package is at in the local workspace." pnpm will refuse to resolve it from the registry entirely; if the package is missing from the workspace, the install fails hard.
For an internal package like @tb/custom-builder that is never published to npm, workspace:* vs workspace:^ vs workspace:~ are all equivalent — the difference only matters at publish time (pnpm rewrites workspace: to the exact pinned
version in the published package.json*), which never happens here.
If anything, workspace:* is safer than file:: pnpm actively enforces the workspace contract, whereas file: is a plain path reference with no such guarantee.
1 participant
Replace Yarn 1.22 with pnpm 11. Build, lint and the custom static-serve builder all verified working end-to-end.
Key changes: