Skip to content

chore: Move the monorepo from Yarn 1 to pnpm 12 - #25354

Draft
JPeer264 wants to merge 4 commits into
sig/e2e-pnpm-12from
jp/move-to-pnpm
Draft

chore: Move the monorepo from Yarn 1 to pnpm 12#25354
JPeer264 wants to merge 4 commits into
sig/e2e-pnpm-12from
jp/move-to-pnpm

Conversation

@JPeer264

@JPeer264 JPeer264 commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

This moves the monorepo from Yarn 1 to pnpm 12.11.2 (packageManager): scripts, CI workflows, the release script and the contributor docs.

Review it commit by commit:

  1. A plain pnpm import of yarn.lock. Most of the added lines of the PR are here.
  2. The dependency changes against that import: the root workspace:* entries, h3 and unstorage for @sentry/nitro and @sentry/nuxt, the yarn.lock versions of the npm aliases (pnpm import resolves them again), and pnpm dedupe.
  3. The move from Yarn to pnpm. This commit does not change the lockfile.
  4. The bump to pnpm 12: the settings move to pnpm-workspace.yaml, the pnpm devDependency of ci(e2e): Run E2E tests with pnpm 12 #25334 is removed, and pnpm dedupe with pnpm 12 merges 10 versions (no new versions).

Other changes beyond the rename:

  • Scripts are called with pnpm run <script> and package binaries with pnpm exec <bin>. Volta's pnpm 9 rejects the options of pnpm test (for example --watch) before it switches to pnpm 12.
  • @sentry/server-runtime-injection vendors the same files as with Yarn. It declares supports-color 7.2.0, because pnpm installs another version next to debug, and it names vendored files by their path after the last node_modules/.
  • The Lambda layer build writes its overrides to a pnpm-workspace.yaml (pnpm 12 does not read resolutions), and it no longer writes through pnpm's hard links into packages/core/build.

Install layout decisions

nodeLinker: hoisted and autoInstallPeers: false give the same flat node_modules as Yarn 1. This is only for now, to make the switch from Yarn easier. The next PR moves to the isolated pnpm default, where every package must declare all its imports.

Workspace decisions

All workspace packages are root devDependencies (workspace:*), because some configs import workspace packages without declaring them. The next PR removes them. The workspaces list stays in package.json for Deno, and verify-packages-versions.js checks that it matches pnpm-workspace.yaml. New packages must go into both lists.

pnpm version decisions

This goes directly to pnpm 12, because a pnpm 9 root does not work with the pnpm 12 devDependency of #25334: nested pnpm calls in scripts get pnpm 12, which refuses the pnpm 9 install. Volta cannot run pnpm 12, so it keeps pnpm 9.15.9, and manage-package-manager-versions in .npmrc switches it to the packageManager version.

Known issues

  • The release and canary workflows did not run on this branch. Only a local simulation of the version bump ran.
  • Dependency Review (not a required check) fails, because it treats every package of the new lockfile as added. It reports advisories for yarn.lock versions that are dismissed in Dependabot. After the merge, it checks only lockfile changes again.

@semgrep-code-getsentry

semgrep-code-getsentry Bot commented Oct 14, 2026

Copy link
Copy Markdown

Semgrep found 2 ssc-9e16049c-d627-4ef3-9759-3139101c4fa9 findings:

🟡 Medium severity issue identified in your code:

Risk: Affected versions of @babel/helpers, @babel/runtime, @babel/runtime-corejs2, and @babel/runtime-corejs3 are vulnerable to Inefficient Regular Expression Complexity. Babel generates a polyfill (the wrapRegExp helper) for String.prototype.replace on regular expressions with named capturing groups that has quadratic (ReDoS) complexity when an untrusted replacement string containing the substring $< is processed. The vulnerable code is generated polyfill code rather than a symbol you call directly, so any project transpiling named capturing groups against affected browser targets is at risk. Upgrade to a patched version and recompile your code to remediate.

Fix: Upgrade this library to at least version 7.26.10 at sentry-javascript/pnpm-lock.yaml:3694.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-7806, GHSA-968p-4wvh-cqc8, CVE-2025-27789

Semgrep found 3 ssc-90df8fd1-2d4f-4e7b-a8aa-dfa15f51f5bf findings:

🟡 Medium severity issue identified in your code:

Risk: Affected versions of esbuild are vulnerable to Origin Validation Error. esbuild's development server responds to every request, including Server-Sent Events connections, with Access-Control-Allow-Origin: *. Any website a developer visits can therefore make cross-origin requests to the local dev server and read the responses, leaking bundled source code, source maps, and served file paths. Starting the dev server via serve() reaches the vulnerable code path.

Manual Review Advice: A vulnerability from this advisory is reachable if you run esbuild with the --serve flag to start the development server

Fix: Upgrade this library to at least version 0.25.0 at sentry-javascript/pnpm-lock.yaml:11523.

Reference(s): GHSA-67mh-4wv8-2f99

Semgrep found 1 ssc-14373fcb-6df6-4a88-a68b-95bf4fdd53ad finding:

🟡 Medium severity issue identified in your code:

Risk: Affected versions of jsondiffpatch are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). jsondiffpatch renders JSON object keys into HTML without escaping in its HTML formatter (HtmlFormatter / format). An attacker who controls the JSON being diffed can inject a malicious object key (e.g. a <script> tag) that executes in the context of the consuming web page (DOM-based XSS).

Manual Review Advice: A vulnerability from this advisory is reachable if you are uisng jsondiffpatch on the CLI

Fix: Upgrade this library to at least version 0.7.2 at sentry-javascript/pnpm-lock.yaml:13291.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-27629, GHSA-33vc-wfww-vjfv, CVE-2025-9910

Semgrep found 2 ssc-609dd635-87fa-44a8-af18-b6e58a147de0 findings:

🟡 Medium severity issue identified in your code:

Risk: Affected versions of svelte are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Svelte versions before 4.2.19 improperly escape HTML during server-side rendering (SSR): attribute values only escape & and " but not <. A user-controlled value placed in an element attribute inside a <noscript> element can break out of the attribute/noscript context and inject markup, resulting in cross-site scripting (XSS).

Manual Review Advice: A vulnerability from this advisory is reachable if you use Svelte server-side rendering with a component that places user-controlled data in an element attribute inside a <noscript> element

Fix: Upgrade this library to at least version 4.2.19 at sentry-javascript/pnpm-lock.yaml:17318.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2530, GHSA-8266-84wp-wv5c, CVE-2024-45047

Semgrep found 1 ssc-484bb776-a960-4899-8ddd-675885fe6a95 finding:

🟡 Medium severity issue identified in your code:

Risk: Affected versions of webpack-dev-server are vulnerable to Exposed Dangerous Method or Function. webpack-dev-server serves bundled assets without rejecting cross-origin classic script requests. Because such <script src> requests bypass the same-origin policy, a malicious website visited by a developer running the dev server can load the application bundle cross-origin and, via prototype pollution of the webpack runtime, extract the application source code.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using webpack dev server CLI setup

Fix: Upgrade this library to at least version 5.2.1 at sentry-javascript/pnpm-lock.yaml:18740.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16767, GHSA-4v9v-hfq4-rm2v, CVE-2025-30359

Semgrep found 1 ssc-013ecbde-4597-4af3-bcc3-06920828d5cc finding:

🟡 Medium severity issue identified in your code:

Risk: Affected versions of webpack-dev-server are vulnerable to Origin Validation Error. webpack-dev-server improperly validates the WebSocket connection Origin header, unconditionally accepting any IP-address-based Origin. A malicious website can perform a cross-site WebSocket hijack against a running dev server and exfiltrate the developer source code carried in Hot Module Reloading (HMR) messages. The insecure origin check is the package default and is reached on every WebSocket connection, so any project running an affected version is vulnerable.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using webpack dev server CLI setup and access untrusted web site with non-Chromium based browser

Fix: Upgrade this library to at least version 5.2.1 at sentry-javascript/pnpm-lock.yaml:18740.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16764, GHSA-9jgg-88mc-972h, CVE-2025-30360

Semgrep found 1 ssc-f748ff04-95cd-4e1a-8429-2525a723a048 finding:

🟡 Medium severity issue identified in your code:

Risk: Affected versions of webpack are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). webpack's AutoPublicPathRuntimeModule emits runtime code that derives the asset public path from document.currentScript. Because document.currentScript can be DOM-clobbered by an injected scriptless element (e.g. ), an attacker who can inject markup into the page can redirect dynamic chunk/asset loading to an attacker-controlled origin, resulting in cross-site scripting (XSS).

Manual Review Advice: A vulnerability from this advisory is reachable if you build with output.publicPath unset

Fix: Upgrade this library to at least version 5.94.0 at sentry-javascript/pnpm-lock.yaml:18792.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-2497, GHSA-4vvj-4cpr-p986, CVE-2024-43788

Semgrep found 2 ssc-e4c0f25b-1e41-443a-9b72-0fd356011bb1 findings:

🟠 High severity issue identified in your code:

Risk: Affected versions of sharp are vulnerable to Dependency on Vulnerable Third-Party Component / Use After Free. The prebuilt libvips binaries shipped with sharp bundle a vulnerable librsvg that has a use-after-free when decoding SVG images, which can lead to remote code execution when sharp processes an attacker-supplied SVG. Upgrade to sharp 0.35.5 or later, or block SVG decoding with sharp.block({ operation: ["VipsForeignLoadSvg"] }).

Manual Review Advice: A vulnerability from this advisory is reachable if you decode SVG input with sharp, which is enabled by default, and have not disabled it with sharp.block({ operation: ["VipsForeignLoadSvg"] })

Fix: Upgrade this library to at least version 0.35.5 at sentry-javascript/pnpm-lock.yaml:16802.

Reference(s): GHSA-wq5f-xc86-pv6w

Semgrep found 2 ssc-0c6b5f0e-7d1a-4e5b-9a43-2f8d6b1c7e94 findings:

🟠 High severity issue identified in your code:

Risk: Affected versions of webpack-dev-middleware are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). When publicPath has no trailing slash (e.g. /assets), a request such as /assets../secret passes the path traversal check before the prefix is stripped, letting an unauthenticated attacker read files outside the output directory served by webpack-dev-middleware. Upgrade, or add a trailing slash to publicPath.

Fix: Upgrade this library to at least version 7.4.6 at sentry-javascript/pnpm-lock.yaml:18734.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64850, GHSA-g84c-rxfj-3j2c, GHSA-wr3j-pwj9-hqq6, CVE-2026-76844

Semgrep found 2 ssc-6ff8e141-404b-4098-a03b-5f0ca3015c76 findings:

🟠 High severity issue identified in your code:

Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's compiler internationalization (i18n) pipeline does not reject static event-handler attributes that are marked for translation with the i18n-on* notation (for example <img src="foo.jpg" onerror="void 0" i18n-onerror />). Angular normally blocks binding to onclick, onerror and similar attributes via validateAttribute()/validateProperty(), but the i18n metadata collection path only rejected Trusted Types sinks, so the handler body is taken from the translation unit instead. A translation file can therefore replace a benign handler with arbitrary JavaScript that executes in the origin of the localized application, leading to session hijacking or actions performed on behalf of the authenticated user.

Manual Review Advice: A vulnerability from this advisory is reachable if you are using Angular's i18n pipeline and also set the matching static on<event> handler attribute on the same element

Fix: Upgrade this library to at least version 20.3.27 at sentry-javascript/pnpm-lock.yaml:2424.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-52369, GHSA-jj27-h5hq-8x99

Semgrep found 2 ssc-8ec0dd3e-cfd5-4a9b-9479-f5400432931f findings:

🟠 High severity issue identified in your code:

Risk: Affected versions of sharp are vulnerable to Dependency on Vulnerable Third-Party Component. sharp bundles a vulnerable version of the native libvips library, inheriting four memory-safety flaws: an integer overflow leading to a heap-based buffer overflow in the VIPS loader (vipsload, CVE-2026-33327), an integer overflow in the GIF loader (gifload, CVE-2026-33328) causing a denial of service on 32-bit hosts only, a heap-based buffer overflow in the TIFF loader (tiffload, CVE-2026-35591) when handling JPEG or JPEG2000-encoded tiles, and an out-of-bounds read in the EXIF directory decoder (CVE-2026-35590). An attacker who can supply a crafted image can crash the process or corrupt heap memory. Because sharp selects the libvips loader by sniffing the input bytes, no call site can be shown to be safe, and the EXIF flaw is reachable from the JPEG, TIFF, WebP, PNG and HEIF loaders as well. Upgrade to sharp 0.35.0 or later, which bundles libvips 8.18.3. Blocking the affected loaders with sharp.block({ operation: ["VipsForeignLoadNsgif", "VipsForeignLoadTiff", "VipsForeignLoadVips"] }) is only a partial stopgap and does not mitigate the EXIF out-of-bounds read (CVE-2026-35590), for which no workaround exists.

Fix: Upgrade this library to at least version 0.35.0 at sentry-javascript/pnpm-lock.yaml:16802.

Reference(s): GHSA-f88m-g3jw-g9cj

Semgrep found 1 ssc-c8b7a1f2-4d36-4f0a-9e2b-1a5c8d7e6f30 finding:

🟠 High severity issue identified in your code:

Risk: Affected versions of vite and vite-plus are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor / Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Vite's server.fs.deny blocklist—which protects sensitive files such as .env and certificate files from being served—can be bypassed on Windows using alternate path representations (NTFS Alternate Data Stream syntax like /.env::$DATA?raw, or 8.3 short filenames), allowing an attacker to read otherwise-denied files when the dev server is exposed to the network.

Manual Review Advice: A vulnerability from this advisory is reachable if you expose the Vite dev server or vite-plus to the network by configuring a non-loopback address using the --host CLI flag on Windows

Fix: Upgrade this library to at least version 6.4.3 at sentry-javascript/pnpm-lock.yaml:18370.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38303, GHSA-fx2h-pf6j-xcff, CVE-2026-53571

Semgrep found 1 ssc-1d4c2f6e-9b3a-4f0c-8d21-6e5a7c0b9f44 finding:

🟠 High severity issue identified in your code:

Risk: Affected versions of react-router and turbo-stream are vulnerable to Allocation of Resources Without Limits or Throttling. React Router Framework Mode uses turbo-stream to serialize loader/action data into Single Fetch responses. The underlying serialization algorithm becomes a bottleneck on certain data shapes, so an attacker who can influence the serialized data can cause excessive resource consumption and a Denial of Service.

Manual Review Advice: A vulnerability from this advisory is reachable if you use React Router Framework Mode with Single Fetch enabled (the default in v7 Framework Mode, or opt-in via future.unstable_singleFetch in Remix v2.9.0+) and not Declarative or Data mode

Fix: Upgrade this library to at least version 3.0.0 at sentry-javascript/pnpm-lock.yaml:17695.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33994, GHSA-rxv8-25v2-qmq8, CVE-2026-34077

Semgrep found 1 ssc-2427bad3-7619-448f-8f95-70806990606e finding:

🟠 High severity issue identified in your code:

Risk: Affected versions of @angular/compiler are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). A stored XSS vulnerability in the Angular Template Compiler arises because its internal security schema doesn't classify certain URL‐ holding attributes (e.g. xlink:href, math|href, annotation|href) or the attributeName binding on SVG animation elements (<animate>, <set>, etc.) as requiring strict URL sanitization. An attacker who can supply untrusted input to template bindings like [attr.xlink:href] or <animate [attributeName]="'href'" [values]="maliciousURL"> can inject a javascript: URL payload. When the element is activated (e.g. clicked) or the animation runs, the malicious script executes in the application's origin, enabling session hijacking, data exfiltration, or unauthorized actions.

Manual Review Advice: A vulnerability from this advisory is reachable if you allow SVG/MathML attributes (e.g., xlink:href, href) or to the attributeName field of SVG animation tags (, , etc.) in HTML templates

Fix: Upgrade this library to at least version 19.2.17 at sentry-javascript/pnpm-lock.yaml:2415.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-200118, GHSA-v4hv-rgfq-gp49, CVE-2025-66412

Semgrep found 6 ssc-17eda294-146f-4ed3-91f7-5ef1b349d687 findings:

🔴 Critical severity issue identified in your code:

Risk: Affected versions of @babel/traverse and babel-traverse are vulnerable to Incomplete List of Disallowed Inputs / Incorrect Comparison. Compiling untrusted code with Babel using plugins that invoke the internal path.evaluate() or path.evaluateTruthy() methods (for example @babel/plugin-transform-runtime, @babel/preset-env with useBuiltIns, or any polyfill‐provider plugin) allows a maliciously crafted AST to execute arbitrary code on the build machine during compilation.

Manual Review Advice: A vulnerability from this advisory is reachable if you use Babel to compile untrusted JavaScript

Fix: There are no safe versions of this library available for upgrade. Library included at sentry-javascript/pnpm-lock.yaml:9677.

Reference(s): https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2669, GHSA-67hx-6x53-jw92, CVE-2023-45133

@github-actions

github-actions Bot commented Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

size-limit report 📦

⚠️ Warning: Base artifact is not the latest one, because the latest workflow run is not done yet. This may lead to incorrect results. Try to re-run all tests to get up to date results.

Path Size % Change Change
@sentry/browser 29.83 kB - -
@sentry/browser - with treeshaking flags 27.96 kB - -
@sentry/browser - with treeshaking flags tracing without tracing 27.87 kB - -
@sentry/browser (incl. Tracing) 52.02 kB - -
@sentry/browser (incl. Tracing + Span Streaming) 52.02 kB - -
@sentry/browser (incl. Tracing, Profiling) 54.96 kB - -
@sentry/browser (incl. Tracing, Replay) 91.75 kB - -
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 80.62 kB - -
@sentry/browser (incl. Tracing, Replay with Canvas) 96.47 kB - -
@sentry/browser (incl. Tracing, Replay, Feedback) 109.43 kB - -
@sentry/browser (incl. Feedback) 47.35 kB - -
@sentry/browser (incl. sendFeedback) 34.89 kB - -
@sentry/browser (incl. FeedbackAsync) 40 kB - -
@sentry/browser (incl. Metrics) 30.85 kB - -
@sentry/browser (incl. Logs) 31.13 kB - -
@sentry/browser (incl. Metrics & Logs) 31.78 kB - -
@sentry/react 31.64 kB - -
@sentry/react (incl. Tracing) 54.34 kB - -
@sentry/vue 37.98 kB - -
@sentry/vue (incl. Tracing) 54.95 kB - -
@sentry/svelte 29.86 kB - -
@sentry/remix (Remix 3 client bundle) 57.02 kB - -
CDN Bundle 31.56 kB - -
CDN Bundle (incl. Tracing) 52.52 kB - -
CDN Bundle (incl. Logs, Metrics) 33.77 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) 54.46 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) 74.7 kB - -
CDN Bundle (incl. Tracing, Replay) 90.19 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 92.11 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) 96.34 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 98.28 kB - -
CDN Bundle - uncompressed 92.98 kB - -
CDN Bundle (incl. Tracing) - uncompressed 155.83 kB - -
CDN Bundle (incl. Logs, Metrics) - uncompressed 99.52 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 161.79 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 229.56 kB - -
CDN Bundle (incl. Tracing, Replay) - uncompressed 276 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 281.94 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 289.7 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 295.63 kB - -
@sentry/nextjs (client) 56.75 kB - -
@sentry/sveltekit (client) 52.41 kB - -
@sentry/core/server 41.12 kB - -
@sentry/core/browser 13.81 kB - -
@sentry/node 151.98 kB +0.01% +9 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection) 83.78 kB - -
@sentry/node - without tracing 94.54 kB +0.01% +3 B 🔺
@sentry/node - without channel injection 130.18 kB +0.01% +9 B 🔺
@sentry/aws-serverless 102.69 kB +0.01% +6 B 🔺
@sentry/cloudflare (withSentry) - minified 210.38 kB - -
@sentry/cloudflare (withSentry) 521.61 kB - -
@sentry/nextjs/cloudflare (withSentry) - minified 228.06 kB - -

View base workflow run

@JPeer264
JPeer264 force-pushed the jp/move-to-pnpm branch 2 times, most recently from c93a7bc to a15b984 Compare October 14, 2026 09:06
@s1gr1d s1gr1d mentioned this pull request Oct 14, 2026
Open
@JPeer264 @claude
chore: Import yarn.lock into pnpm-lock.yaml
7d46b21 
Create pnpm-lock.yaml with `pnpm import` (pnpm 9.15.9) from the current
yarn.lock, without other changes to the dependencies.

The import needs pnpm-workspace.yaml for the list of workspace packages,
the .npmrc settings that change the lockfile (`auto-install-peers=false`),
and the Yarn `resolutions` in the pnpm syntax (`pnpm.overrides`).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@JPeer264
JPeer264 changed the base branch from develop to sig/e2e-pnpm-12 October 14, 2026 12:44
@JPeer264 @claude
chore: Change the imported dependencies for pnpm
b3a9fdd 
Change pnpm-lock.yaml from the plain `pnpm import` of the previous commit
to the dependencies that the monorepo needs with pnpm:

- The root package.json lists every workspace package with `workspace:*`,
  so that pnpm links them into the root node_modules like Yarn did.
- @sentry/nitro and @sentry/nuxt declare `h3` and `unstorage`. They
  imported them without a declaration, and with pnpm these imports
  resolved to other versions.
- @sentry/server-runtime-injection declares `supports-color` 7.2.0, the
  version that it vendors for `debug` with Yarn. With pnpm, another
  version is next to `debug`.
- `yarn-deduplicate` is removed.
- The npm aliases `redis-4`, `ioredis-5` and `pino-next` keep their
  yarn.lock versions (4.6.14, 5.11.0 and 9.12.0). `pnpm import` resolved
  them again to the newest version in their range. `history@^4` resolves
  to 4.10.1 again, like in yarn.lock, and not to the 4.9.0 of an alias.
- `pnpm dedupe` merged a few versions, for example esbuild 0.28.2 into
  0.28.1, because CI checks that the lockfile is deduplicated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@JPeer264
JPeer264 force-pushed the jp/move-to-pnpm branch 3 times, most recently from b4d6b4b to 2f89853 Compare October 14, 2026 19:52
@JPeer264 JPeer264 changed the title chore: Move the monorepo from Yarn 1 to pnpm chore: Move the monorepo from Yarn 1 to pnpm 12 Oct 15, 2026
@JPeer264
JPeer264 added this pull request to stack #25387 October 15, 2026 08:47
@JPeer264 @claude
chore: Move the monorepo from Yarn 1 to pnpm
25470a8 
Replace Yarn 1 with pnpm 9.15.9 (pinned in Volta) for installs and scripts
in the monorepo, the CI workflows, the release scripts and the contributor
docs. yarn.lock and .yarnrc are removed.

- pnpm reads pnpm-workspace.yaml. The `workspaces` list in package.json
  stays for Deno and the repo scripts, and verify-packages-versions.js
  checks that both lists are the same.
- CI installs the root pnpm with the install-pnpm action. The E2E jobs use
  it for the apps too.
- The Lambda layer install uses a hoisted node_modules folder, and the SDK
  source replacement does not write through pnpm's hard links into
  packages/core/build.
- The NODE_OPTIONS line of .yarnrc is gone. Yarn 1 never applied it.
- Scripts are called with `pnpm run <script>` and package binaries with
  `pnpm exec <bin>`. The pnpm 9 `test` command does not pass options
  to the script like `yarn test` did, and `pnpm run` does not run
  binaries.
- node-integration-tests calls its sub-scripts with `pnpm run` instead of
  `run-s` and `run-p`. npm-run-all2 passes the `config` field of its
  package.json to pnpm as `--<name>:<key>=<value>` options, and pnpm
  rejects them.
- The bundler plugin fixtures and the local E2E runner install standalone
  projects with the pnpm defaults. They remove the `npm_config_*`
  variables that `pnpm run` passes from the root .npmrc, and the fixtures
  set `NPM_CONFIG_WORKSPACE_DIR`, so that pnpm does not read that file.
- @sentry/server-runtime-injection resolves `supports-color` from its own
  devDependencies, so it vendors the same version as with Yarn. Without
  this, `debug` finds the `supports-color` that pnpm installs next to it.
- @sentry/server-utils and @sentry/server-runtime-injection name each
  vendored file by its path after the last `node_modules/`, because pnpm
  installs some vendored dependencies in nested folders. The published
  file names stay the same.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@JPeer264 @claude
chore: Bump pnpm to 12.11.2
61ff53a 
Set `packageManager` to pnpm 12.11.2 and remove the pnpm devDependency
that the E2E tests and the bundler fixtures used. Volta keeps pnpm
9.15.9, because it cannot run pnpm 12, and
`manage-package-manager-versions` makes pnpm 9 switch to the
`packageManager` version. CI installs that version with the install-pnpm
action.

pnpm 11+ reads its settings only from pnpm-workspace.yaml, so the .npmrc
settings and the overrides move there. `allowBuilds` lists the
dependencies whose install scripts run, because pnpm 11+ fails the
install on scripts that are not listed.

- pnpm-lock.yaml gets the pnpm version in a new first document.
  `pnpm dedupe` with pnpm 12 merges 10 versions into versions that are
  already in the lockfile and changes peer suffixes. It adds no versions.
- pnpm 11.15+ resolves optional peers that only `peerDependenciesMeta`
  declares (for example the `supports-color` peer of `debug`) from the
  dependency graph, so the hoisted node_modules folder changes. For
  example, the root folder has no `@babel/preset-react`, so the rollup
  bundler fixtures declare it.
- The Lambda layer install writes its overrides to a pnpm-workspace.yaml,
  because pnpm 12 does not read `resolutions`. Without them, the layer
  gets the @sentry/* packages from npm.
- pnpm 12 does not pass its settings to scripts as `npm_config_*`
  variables, and the fixtures and the E2E apps have their own
  pnpm-workspace.yaml. So the bundler fixtures and the local E2E runner
  install them without the workarounds for the root settings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@JPeer264