build: migrate to pnpm + workspace: protocol by goastler · Pull Request #2682 · prosopo/captcha

goastler · 2026-06-12T20:56:47Z

Summary

Migrate the captcha monorepo from npm workspaces to pnpm, converting all internal dependencies to the workspace:* protocol.

Changes

workspace:* protocol: converted 289 internal @prosopo/* deps across 61 manifests to workspace:*. Registry @prosopo/* deps (not workspace members) are left as version specs.
Package manager: packageManager npm@11.0.0 → pnpm@11.6.0; engines require pnpm >=11.
Lockfile: package-lock.json → committed pnpm-lock.yaml.
pnpm-workspace.yaml: workspace globs (moved out of package.json), the former npm overrides, allowBuilds for native packages (biome, esbuild, sharp, bcrypt, lmdb, cypress, nx, ssh2, protobufjs, …), and linkWorkspacePackages: true.
Scripts/CI: npm -w / npm run / npm ci → pnpm equivalents in package scripts, shell scripts and workflows; CI adds pnpm/action-setup before actions/setup-node, swaps the pinned global npm install for corepack enable, and uses cache: pnpm.

The fingerprintjs exception

packages/fingerprintjs is a standalone repo consumed as a submodule. Its only internal dep, @prosopo/config, is kept as a registry version (3.3.1) so the package still installs on its own (workspace:* has no registry fallback). linkWorkspacePackages: true ensures it still resolves to the local dev/config inside this workspace. The submodule pointer is intentionally not bumped here.

Verification

pnpm install green (all workspace links resolve; native build scripts run).
Spot-checked links: provider → local @prosopo/common, fingerprintjs → local dev/config.
pnpm --filter @prosopo/util run build green.

🤖 Generated with Claude Code

- Convert all internal @prosopo/* deps to workspace:* (289 across 61 manifests) - Switch packageManager from npm@11 to pnpm@11.6.0; engines require pnpm - Replace package-lock.json with pnpm-lock.yaml - Move workspaces globs + overrides into pnpm-workspace.yaml; add allowBuilds - linkWorkspacePackages: true so packages/fingerprintjs (standalone submodule, keeps a registry @prosopo/config) still links the local dev/config here - Rewrite npm -w / npm run / npm ci -> pnpm in scripts, shell scripts, workflows - CI: add pnpm/action-setup before setup-node, corepack enable, cache: pnpm

- depcheck: npx --workspaces -> pnpm -r exec - i: npm i -> pnpm i - audit:fix: pnpm audit --fix (drop invalid 'fix --force') - release.yml: pnpm publish -w -> pnpm --filter publish (in pnpm, -w = workspace-root)

# Conflicts: # demos/client-bundle-example/package.json # demos/client-example-server/package.json # demos/cypress-shared/package.json # demos/provider-mock/package.json # dev/flux/package.json # dev/gh-actions/package.json # dev/lint/package.json # dev/prosoponator-bot/package.json # dev/scripts/package.json # dev/ts-brand/package.json # dev/vite-plugin-watch-workspace/package.json # dev/workspace/package.json # integration/frameworks/angular/angular-procaptcha-integration-demo/package.json # integration/frameworks/angular/angular-procaptcha-wrapper/package.json # integration/frameworks/react/react-procaptcha-integration-demo/package.json # integration/frameworks/react/react-procaptcha-wrapper/package.json # integration/frameworks/svelte/svelte-procaptcha-integration-demo/package.json # integration/frameworks/svelte/svelte-procaptcha-wrapper/package.json # integration/frameworks/vue/vue-procaptcha-integration-demo/package.json # integration/frameworks/vue/vue-procaptcha-wrapper/package.json # integration/procaptcha-integration-build-config/package.json # package-lock.json # package.json # packages/account/package.json # packages/api-express-router/package.json # packages/api-route/package.json # packages/api/package.json # packages/cli/package.json # packages/common/package.json # packages/database/package.json # packages/datasets-fs/package.json # packages/datasets/package.json # packages/detector/package.json # packages/dotenv/package.json # packages/env/package.json # packages/file-server/package.json # packages/fingerprint/package.json # packages/http-blackhole/package.json # packages/ipinfo/package.json # packages/keyring/package.json # packages/load-balancer/package.json # packages/locale/package.json # packages/logger/package.json # packages/procaptcha-bundle/package.json # packages/procaptcha-common/package.json # packages/procaptcha-frictionless/package.json # packages/procaptcha-pow/package.json # packages/procaptcha-puzzle/package.json # packages/procaptcha-react/package.json # packages/procaptcha-wrapper/package.json # packages/procaptcha/package.json # packages/provider/package.json # packages/redis-client/package.json # packages/server/package.json # packages/testpkg2/package.json # packages/types-database/package.json # packages/types-env/package.json # packages/types/package.json # packages/user-access-policy/package.json # packages/util-crypto/package.json # packages/util/package.json # packages/widget-skeleton/package.json

Copilot

Pull request overview

Migrates the monorepo from npm workspaces to pnpm, switching internal @prosopo/* dependencies to the workspace:* protocol and updating scripts/CI to use pnpm semantics and caching.

Changes:

Introduces pnpm-workspace.yaml and updates the root packageManager/engines to pnpm.
Converts many workspace package manifests to use workspace:* for internal dependencies.
Updates package scripts and GitHub Actions workflows to run via pnpm and use pnpm caching.

Reviewed changes

Copilot reviewed 83 out of 85 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
release.sh	Release helper updated to use pnpm for workspace version lookup.
pnpm-workspace.yaml	Adds pnpm workspace globs and workspace-level settings.
package.json	Switches package manager to pnpm; updates root scripts for pnpm usage.
dev/scripts/src/scripts/jsServer.sh	Updates build/bundle commands for procaptcha bundle to pnpm.
packages/widget-skeleton/package.json	Switches build script runner to pnpm; internal deps to `workspace:*`.
packages/util/package.json	Switches build script runner to pnpm; internal deps to `workspace:*`.
packages/util-crypto/package.json	Switches build script runner to pnpm; internal deps to `workspace:*`.
packages/user-access-policy/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/types/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/types-env/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/types-database/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/testpkg2/package.json	Switches build script runner to pnpm; internal deps to `workspace:*`.
packages/server/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/redis-client/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/provider/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/procaptcha/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/procaptcha-wrapper/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/procaptcha-react/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/procaptcha-puzzle/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/procaptcha-pow/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/procaptcha-frictionless/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/procaptcha-common/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/procaptcha-bundle/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/logger/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/locale/package.json	Switches build script runner to pnpm; internal deps to `workspace:*`.
packages/load-balancer/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/keyring/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/ipinfo/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/http-blackhole/package.json	Switches build script runner to pnpm; internal deps to `workspace:*`.
packages/fingerprint/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/file-server/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/env/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/dotenv/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/detector/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/datasets/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/datasets-fs/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/database/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/common/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/cli/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/api/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/api-route/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/api-express-router/package.json	Switches scripts/deps to pnpm + `workspace:*`.
packages/account/package.json	Switches scripts/deps to pnpm + `workspace:*`.
integration/procaptcha-integration-build-config/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
integration/frameworks/vue/vue-procaptcha-wrapper/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
integration/frameworks/vue/vue-procaptcha-integration-demo/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
integration/frameworks/svelte/svelte-procaptcha-wrapper/package.json	Switches build/dev scripts and deps to pnpm + `workspace:*`.
integration/frameworks/svelte/svelte-procaptcha-integration-demo/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
integration/frameworks/react/react-procaptcha-wrapper/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
integration/frameworks/react/react-procaptcha-integration-demo/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
integration/frameworks/angular/angular-procaptcha-wrapper/package.json	Switches dev script runner/deps to pnpm + `workspace:*`.
integration/frameworks/angular/angular-procaptcha-integration-demo/package.json	Switches dev script runner/deps to pnpm + `workspace:*`.
docker/images/vector/package.json	Updates docker build/publish scripts to use pnpm.
docker/images/provider/package.json	Updates docker build/publish scripts to use pnpm.
docker/images/provider-mock/package.json	Updates docker build/publish scripts to use pnpm.
docker/images/client-example-server/package.json	Updates docker build/publish scripts to use pnpm.
docker/images/caddy/package.json	Updates docker build/publish scripts to use pnpm.
dev/workspace/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
dev/vite-plugin-watch-workspace/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
dev/ts-brand/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
dev/scripts/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
dev/prosoponator-bot/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
dev/lint/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
dev/gh-actions/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
dev/flux/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
dev/config/package.json	Switches build script runner to pnpm.
demos/provider-mock/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
demos/cypress-shared/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
demos/client-example-server/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
demos/client-bundle-example/package.json	Switches build script runner/deps to pnpm + `workspace:*`.
.github/workflows/typecheck.yml	Adds pnpm setup and pnpm caching.
.github/workflows/tests.yml	Adds pnpm setup and pnpm caching; updates commands to pnpm.
.github/workflows/tag_release.yml	Adds pnpm setup and pnpm caching.
.github/workflows/release.yml	Adds pnpm setup and pnpm caching; updates install/build/publish commands.
.github/workflows/publish_release.yml	Adds pnpm setup and pnpm caching; updates build/publish commands.
.github/workflows/provider_image.yml	Adds pnpm setup and pnpm caching.
.github/workflows/lint.yml	Adds pnpm setup and pnpm caching; updates lint command to pnpm.
.github/workflows/dependabot-changeset.yml	Adds pnpm setup; updates lockfile refresh step.
.github/workflows/cypress.yml	Adds pnpm setup and pnpm caching; updates commands to pnpm.
.github/workflows/cypress-baselines.yml	Adds pnpm setup and pnpm caching; updates commands to pnpm.
.github/workflows/create_release_pr.yml	Adds pnpm setup and pnpm caching; updates install/build commands to pnpm.
.github/workflows/changesets.yml	Adds pnpm setup and pnpm caching; updates changesets command to pnpm.
.github/workflows/cache.yml	Adds pnpm setup and pnpm caching; replaces npm cache clean with pnpm store prune; updates clean command to pnpm.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- replace npm-only flags/commands flagged in review with pnpm equivalents (--include=dev dropped, --package-lock-only/--workspaces -> --lockfile-only) - use 'pnpm --filter <pkg> run <script>' instead of npm-style 'pnpm run ... -w <pkg>' - 'pnpm add -g' instead of 'pnpm install -g'; pnpm/pnpm dlx instead of npm/npx in release.sh - update dependabot-changeset header comment to reference pnpm-lock.yaml

goastler · 2026-06-23T16:56:58Z

Addressed all 11 Copilot review comments in 8513cdc (npm-only flags/commands swapped for pnpm equivalents; --filter instead of -w; lockfile refresh via --lockfile-only; release.sh fully on pnpm). All threads resolved.

Two blockers remain that need your call, @goastler:

check job is failing — it calls the shared prosopo/captcha/.github/actions/npm@gha composite action, which still runs npm i -g npm@11.6.2 + npm ci --include=dev. That action lives on the gha branch, not in this PR's tree, so the migration is incomplete until the gha branch composite actions (npm / restore_npm_cache) are ported to pnpm too. Do you want that done as part of this PR (coordinated push to gha) or as a follow-up?
Merge conflicts with main (mergeable: CONFLICTING) — needs a rebase/merge of main, most likely pnpm-lock.yaml / manifest conflicts.

Also noted but left unchanged (not flagged, semantics differ under pnpm and untested here): npm pkg set/get and npx -w usages remaining in release.yml. Happy to convert those too if wanted.

goastler added 4 commits June 12, 2026 21:56

build: fix pnpm script equivalents

9d5963f

- depcheck: npx --workspaces -> pnpm -r exec - i: npm i -> pnpm i - audit:fix: pnpm audit --fix (drop invalid 'fix --force') - release.yml: pnpm publish -w -> pnpm --filter publish (in pnpm, -w = workspace-root)

build: regenerate pnpm-lock.yaml after merging main

d42c9e5

goastler marked this pull request as ready for review June 23, 2026 11:27

Copilot AI review requested due to automatic review settings June 23, 2026 11:27

goastler requested review from HughParry and forgetso as code owners June 23, 2026 11:27

Copilot started reviewing on behalf of goastler June 23, 2026 11:28 View session

Copilot AI reviewed Jun 23, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build: migrate to pnpm + workspace: protocol#2682

build: migrate to pnpm + workspace: protocol#2682
goastler wants to merge 5 commits into
mainfrom
feat/pnpm-migration

goastler commented Jun 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

goastler commented Jun 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

goastler commented Jun 12, 2026

Summary

Changes

The fingerprintjs exception

Verification

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

goastler commented Jun 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants