chore(repo): upgrade repo to pnpm@10 to prevent executing dep scripts on install (#2712)

ericallam · web-flow · commit 61b338bea789 · 2025-11-27T16:26:19.000Z
* chore: migrate pnpm lockfile to v9 format via pnpm@9

* Upgrade to pnpm 10.23.0

* update the dockerfile and added a few deps to bundle in remix app
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
@@ -31,7 +31,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 8.15.5
+          version: 10.23.0
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -39,7 +39,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 8.15.5
+          version: 10.23.0
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
diff --git a/.github/workflows/typecheck.yml b/.github/workflows/typecheck.yml
@@ -19,7 +19,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 8.15.5
+          version: 10.23.0
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
diff --git a/.github/workflows/unit-tests-internal.yml b/.github/workflows/unit-tests-internal.yml
@@ -53,7 +53,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 8.15.5
+          version: 10.23.0
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
@@ -111,7 +111,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 8.15.5
+          version: 10.23.0
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
diff --git a/.github/workflows/unit-tests-packages.yml b/.github/workflows/unit-tests-packages.yml
@@ -53,7 +53,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 8.15.5
+          version: 10.23.0
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
@@ -111,7 +111,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 8.15.5
+          version: 10.23.0
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
diff --git a/.github/workflows/unit-tests-webapp.yml b/.github/workflows/unit-tests-webapp.yml
@@ -53,7 +53,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 8.15.5
+          version: 10.23.0
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
@@ -119,7 +119,7 @@ jobs:
       - name: ⎔ Setup pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: 8.15.5
+          version: 10.23.0
 
       - name: ⎔ Setup node
         uses: buildjet/setup-node@v4
diff --git a/.npmrc b/.npmrc
diff --git a/AGENTS.md b/AGENTS.md
@@ -13,7 +13,7 @@ This repository is a pnpm monorepo managed with Turbo. It contains multiple apps
 See `ai/references/repo.md` for a more complete explanation of the workspaces.
 
 ## Development setup
-1. Install dependencies with `pnpm i` (pnpm `8.15.5` and Node.js `20.11.1` are required).
+1. Install dependencies with `pnpm i` (pnpm `10.23.0` and Node.js `20.11.1` are required).
 2. Copy `.env.example` to `.env` and generate a random 16 byte hex string for `ENCRYPTION_KEY` (`openssl rand -hex 16`). Update other secrets if needed.
 3. Start the local services with Docker:
    ```bash
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -15,7 +15,7 @@ branch are tagged into a release periodically.
 ### Prerequisites
 
 - [Node.js](https://nodejs.org/en) version 20.11.1
-- [pnpm package manager](https://pnpm.io/installation) version 8.15.5
+- [pnpm package manager](https://pnpm.io/installation) version 10.23.0
 - [Docker](https://www.docker.com/get-started/)
 - [protobuf](https://github.com/protocolbuffers/protobuf)
 
@@ -36,7 +36,7 @@ branch are tagged into a release periodically.
    ```
 3. Ensure you are on the correct version of Node.js (20.11.1). If you are using `nvm`, there is an `.nvmrc` file that will automatically select the correct version of Node.js when you navigate to the repository.
 
-4. Run `corepack enable` to use the correct version of pnpm (`8.15.5`) as specified in the root `package.json` file.
+4. Run `corepack enable` to use the correct version of pnpm (`10.23.0`) as specified in the root `package.json` file.
 
 5. Install the required packages using pnpm.
    ```
diff --git a/ai/references/repo.md b/ai/references/repo.md
@@ -1,6 +1,6 @@
 ## Repo Overview
 
-This is a pnpm 8.15.5 monorepo that uses turborepo @turbo.json. The following workspaces are relevant
+This is a pnpm 10.23.0 monorepo that uses turborepo @turbo.json. The following workspaces are relevant
 
 ## Apps
 
diff --git a/apps/webapp/remix.config.js b/apps/webapp/remix.config.js
@@ -22,6 +22,8 @@ module.exports = {
     "highlight.run",
     "random-words",
     "superjson",
+    "copy-anything",
+    "is-what",
     "prismjs/components/prism-json",
     "prismjs/components/prism-typescript",
     "redlock",
diff --git a/docker/Dockerfile b/docker/Dockerfile
@@ -8,7 +8,7 @@ FROM ${NODE_IMAGE} AS pruner
 WORKDIR /triggerdotdev
 
 COPY --chown=node:node . .
-RUN npx -q turbo@1.10.9 prune --scope=webapp --docker
+RUN npx -q turbo@2.5.4 prune --scope=webapp --docker
 RUN find . -name "node_modules" -type d -prune -exec rm -rf '{}' +
 
 # Base strategy to have layer caching
@@ -19,34 +19,34 @@ COPY --chown=node:node .gitignore .gitignore
 COPY --from=pruner --chown=node:node /triggerdotdev/out/json/ .
 COPY --from=pruner --chown=node:node /triggerdotdev/out/pnpm-lock.yaml ./pnpm-lock.yaml
 COPY --from=pruner --chown=node:node /triggerdotdev/out/pnpm-workspace.yaml ./pnpm-workspace.yaml
+COPY --chown=node:node patches ./patches
 
 ## Dev deps
 FROM base AS dev-deps
 WORKDIR /triggerdotdev
-# Corepack is used to install pnpm
-RUN corepack enable
-ENV NODE_ENV development
-RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm install --ignore-scripts --no-frozen-lockfile
+# Corepack is used to install pnpm with the exact version from packageManager
+RUN corepack enable && corepack prepare pnpm@10.23.0 --activate
+ENV NODE_ENV=development
+RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm install --no-frozen-lockfile
+# Generate Prisma client here where all deps are installed
+COPY --from=pruner --chown=node:node /triggerdotdev/internal-packages/database/prisma/schema.prisma /triggerdotdev/internal-packages/database/prisma/schema.prisma
+RUN pnpx prisma@6.14.0 generate --schema /triggerdotdev/internal-packages/database/prisma/schema.prisma
 
 ## Production deps
 FROM base AS production-deps
 WORKDIR /triggerdotdev
-# Corepack is used to install pnpm
-RUN corepack enable
-ENV NODE_ENV production
+# Corepack is used to install pnpm with the exact version from packageManager
+RUN corepack enable && corepack prepare pnpm@10.23.0 --activate
+ENV NODE_ENV=production
 RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpm install --prod --no-frozen-lockfile
-COPY --from=pruner --chown=node:node /triggerdotdev/internal-packages/database/prisma/schema.prisma /triggerdotdev/internal-packages/database/prisma/schema.prisma
-# RUN pnpm add @prisma/client@6.14.0 -w
-ENV NPM_CONFIG_IGNORE_WORKSPACE_ROOT_CHECK true
-RUN --mount=type=cache,id=pnpm,target=/root/.local/share/pnpm/store pnpx prisma@6.14.0 generate --schema /triggerdotdev/internal-packages/database/prisma/schema.prisma
 
 ## Builder (builds the webapp)
 FROM base AS builder
 # This is needed for the sentry-cli binary while building the webapp
 RUN apt-get update && apt-get install -y openssl dumb-init ca-certificates
 WORKDIR /triggerdotdev
-# Corepack is used to install pnpm
-RUN corepack enable
+# Corepack is used to install pnpm with the exact version from packageManager
+RUN corepack enable && corepack prepare pnpm@10.23.0 --activate
 
 ARG SENTRY_RELEASE
 ARG SENTRY_ORG
@@ -77,11 +77,13 @@ RUN --mount=type=secret,id=sentry_auth_token \
 FROM ${NODE_IMAGE} AS runner
 RUN apt-get update && apt-get install -y openssl netcat-openbsd ca-certificates
 WORKDIR /triggerdotdev
-ENV NODE_ENV production
+ENV NODE_ENV=production
 
 COPY --from=base /usr/bin/dumb-init /usr/bin/dumb-init
 COPY --from=pruner --chown=node:node /triggerdotdev/out/full/ .
 COPY --from=production-deps --chown=node:node /triggerdotdev .
+# Copy generated Prisma client from dev-deps
+COPY --from=dev-deps --chown=node:node /triggerdotdev/internal-packages/database/generated ./internal-packages/database/generated
 COPY --from=builder --chown=node:node /triggerdotdev/apps/webapp/build/server.js ./apps/webapp/build/server.js
 COPY --from=builder --chown=node:node /triggerdotdev/apps/webapp/build ./apps/webapp/build
 COPY --from=builder --chown=node:node /triggerdotdev/apps/webapp/public ./apps/webapp/public
@@ -104,11 +106,11 @@ ENV BUILD_APP_VERSION=${BUILD_APP_VERSION} \
 EXPOSE 3000
 
 # Add global pnpm shims and install pnpm during build (root user)
-RUN corepack enable && corepack prepare --activate
+RUN corepack enable && corepack prepare pnpm@10.23.0 --activate
 
 USER node
 
 # Ensure pnpm is installed during build and not silently downloaded at runtime (node user)
-RUN corepack prepare --activate
+RUN corepack prepare pnpm@10.23.0 --activate
 
-CMD ["./scripts/entrypoint.sh"]
+CMD ["./scripts/entrypoint.sh"]
diff --git a/package.json b/package.json
@@ -66,7 +66,7 @@
     "vite-tsconfig-paths": "^4.0.5",
     "vitest": "3.1.4"
   },
-  "packageManager": "pnpm@8.15.5",
+  "packageManager": "pnpm@10.23.0",
   "dependencies": {
     "@changesets/cli": "2.26.2",
     "@remix-run/changelog-github": "^0.0.5",
@@ -89,6 +89,23 @@
       "form-data@^3": "3.0.4",
       "form-data@^4": "4.0.4",
       "axios@1.9.0": ">=1.12.0"
-    }
+    },
+    "onlyBuiltDependencies": [
+      "@depot/cli",
+      "@fingerprintjs/fingerprintjs-pro-react",
+      "@prisma/client",
+      "@prisma/engines",
+      "@sentry/cli",
+      "@swc/core",
+      "better-sqlite3",
+      "cpu-features",
+      "esbuild",
+      "lefthook",
+      "prisma",
+      "protobufjs",
+      "sharp",
+      "ssh2",
+      "turbo"
+    ]
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
