chore: switch package management to pnpm

[styfle]

Summary

• replace Yarn package manager metadata and lockfile with pnpm 10.33.0
• add pnpm workspace config with minimumReleaseAge: 2880
• update CI/cache and fixture helper commands to use pnpm
• install pnpm in CI before actions/setup-node configures pnpm caching
• declare resolve, rimraf, @types/node, and nan explicitly for pnpm's strict dependency layout
• approve install scripts only for failing native test dependencies (canvas, nan, sharp)
• patch unfetch@5.0.0 exports to point at files included in the package tarball

Testing

• pnpm install
• pnpm install --frozen-lockfile
• node dist/ncc/cli.js run test/fixtures/ts-interop/interop.ts
• pnpm jest test/integration.test.js --runInBand -t "isomorphic-unfetch|canvas|sharp"
• pnpm build-test-binary && pnpm build && pnpm test

  

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​types/​node@​22.5.5 ⏵ 25.9.0	+1		+1	+1
	npm/​args@​5.0.3
	npm/​rimraf@​6.1.3
	npm/​pug@​3.0.3 ⏵ 3.0.4
	npm/​concurrently@​4.1.2
	npm/​rxjs@​7.8.1 ⏵ 7.8.2
	npm/​socket.io@​4.8.0 ⏵ 4.8.3	+1
	npm/​oracledb@​6.6.0 ⏵ 6.10.0	+1		+4
	npm/​@​vercel/​ncc@​0.38.4
	npm/​axios@​0.21.4 ⏵ 1.16.1	-13	+50	+1
	npm/​tsconfig-paths-webpack-plugin@​4.1.0 ⏵ 4.2.0
	npm/​sequelize@​6.37.3 ⏵ 6.37.8		+16	+5
	npm/​ioredis@​5.4.1 ⏵ 5.10.1			+1	-1
	npm/​resolve@​1.22.8 ⏵ 1.22.12			+1
	npm/​nan@​2.20.0 ⏵ 2.27.0
	npm/​typescript@​6.0.3 ⏵ 5.9.3
	npm/​pg@​8.13.0 ⏵ 8.21.0			+2	+6
	npm/​@​sentry/​node@​7.119.0 ⏵ 7.120.4	+11			+1
	npm/​express@​4.21.0 ⏵ 4.22.2	+1
	npm/​canvas@​3.2.1 ⏵ 3.2.3
	npm/​koa@​3.0.3 ⏵ 3.2.0	+1	+16
	npm/​terser@​5.33.0 ⏵ 5.47.1	+6
	npm/​mongoose@​8.9.5 ⏵ 8.24.0		+16
	npm/​vm2@​3.10.3 ⏵ 3.11.5	+12	+75	+1	+2
	npm/​graphql@​15.9.0 ⏵ 15.10.2	+1			-1
	npm/​@​aws-sdk/​client-s3@​3.787.0 ⏵ 3.1049.0	+2		+1
	github/​pnpm/​action-setup@​f40ffcd9367d9f12939873eb1018b921a783ffaa
	npm/​@​slack/​web-api@​6.12.1 ⏵ 6.13.0	+1		+1	+2

View full report