build: migrate from bun to pnpm and upgrade semantic-release to v25 - #1321
Merged
chhoumann merged 4 commits intoJun 13, 2026
Merged
Conversation
semantic-release v25 requires Node `^22.14.0 || >=24.10.0`. The release job ran `bunx semantic-release`, and Bun 1.3.14 emulates Node 24.3.0, which fails that engine guard (bin/semantic-release.js). Switching the toolchain to pnpm runs every step under real Node, so the guard passes and v25 is unblocked. Toolchain: - semantic-release ^24 -> ^25.0.5; add packageManager pnpm@10.32.1. - Add pnpm.onlyBuiltDependencies (@codemirror/language, esbuild): pnpm 10 blocks build scripts by default, and the git-hosted @codemirror/language fork pulled by obsidian-dataview must be prepared at install time. - Generate + commit pnpm-lock.yaml and docs/pnpm-lock.yaml; delete bun.lock and docs/bun.lock; .gitignore now commits pnpm-lock.yaml and ignores foreign lockfiles (incl. bun.lock). docs/package.json gets packageManager too. CI / release: - oven-sh/setup-bun -> pnpm/action-setup (SHA-pinned) before setup-node. - check-latest: true on setup-node so a stale 24.x toolcache can't resolve below 24.10 and re-trip the engine guard. - All bun commands -> pnpm; `bunx semantic-release` -> `pnpm exec`. - Add pnpm store caching. Other: - dependabot: bun -> npm ecosystem (pnpm is handled under npm). - version-docs.mjs docs snapshot shells `pnpm run docusaurus`. - docs/vercel.json -> pnpm (non-frozen, robust to Vercel's pnpm major). - Update AGENTS.md/CONTRIBUTING.md/README.md/docs/README.md/PR template and .codex/environments/environment.toml. Verified locally (pnpm 10.32.1, Node 24.16): install (root + docs), build, build-with-lint, svelte-check, vitest (1812 pass / 31 skip), frozen-lockfile installs, and a semantic-release v25 dry-run loading all release plugins. Closes #1240
📝 WalkthroughWalkthroughReplace Bun/yarn invocations with pnpm across configs, CI workflows, release scripts, package manifests, docs, and developer guidance; bump selected devDependencies. ChangesBun to pnpm Migration with devDependency updates
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying quickadd with
|
| Latest commit: |
823b020
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://21df2910.quickadd.pages.dev |
| Branch Preview URL: | https://chhoumann-upgrade-semantic-r.quickadd.pages.dev |
Dependency Review SummaryThe full dependency review summary was too large to display here (3022KB, limit is 1024KB). Please download the artifact named "dependency-review-summary" to view the complete report. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 346b5cefe4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| ``` | ||
| $ USE_SSH=true yarn deploy | ||
| $ USE_SSH=true pnpm deploy |
There was a problem hiding this comment.
pnpm run for the deploy script
With this repo pinned to pnpm 10.x, these deployment examples do not run the Docusaurus deploy script: pnpm's 10.x docs say script shorthands only work for names that do not share an existing pnpm command, and deploy is an existing pnpm deploy workspace command. In docs/, that will fail or invoke the wrong command instead of publishing the site; both deployment examples should use pnpm run deploy so the package script receives USE_SSH/GIT_USER.
Useful? React with 👍 / 👎.
Dependency Review flagged docs serialize-javascript@6.0.2 (GHSA-5c6j-r48x-rmvq, high, RCE; fixed in 7.0.3). It is a pre-existing transitive dep of the Docusaurus webpack/terser toolchain (same version was in the old docs/bun.lock); the lockfile format change just resurfaced it. pnpm reads pnpm.overrides, not npm's top-level overrides field, so the existing docs override block stopped applying after the bun->pnpm switch. Move it under pnpm.overrides and add serialize-javascript ^7.0.3 (resolves to 7.0.5). Docs build verified.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 10: Several lines in package.json use space indentation instead of the
repo's required tabs; update the affected JSON entries (notably the
"build-with-lint" script and the other modified JSON properties) to use tab
characters for indentation, ensure LF line endings per .editorconfig, and re-run
the formatter/lint for JSON to verify the changes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a4d4ba59-b1b0-460a-8da1-21c58f5416be
⛔ Files ignored due to path filters (4)
bun.lockis excluded by!**/*.lockdocs/bun.lockis excluded by!**/*.lockdocs/pnpm-lock.yamlis excluded by!**/pnpm-lock.yamlpnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (14)
.codex/environments/environment.toml.github/PULL_REQUEST_TEMPLATE.md.github/dependabot.yml.github/workflows/ci.yml.github/workflows/release.yml.gitignoreAGENTS.mdCONTRIBUTING.mdREADME.mddocs/README.mddocs/package.jsondocs/vercel.jsonpackage.jsonscripts/release/version-docs.mjs
| "lint": "eslint .", | ||
| "build": "tsc -noEmit -skipLibCheck && node esbuild.config.mjs production", | ||
| "build-with-lint": "tsc -noEmit -skipLibCheck && bun lint && node esbuild.config.mjs production", | ||
| "build-with-lint": "tsc -noEmit -skipLibCheck && pnpm lint && node esbuild.config.mjs production", |
There was a problem hiding this comment.
Use tab indentation in changed JSON lines.
Line 10, Line 39, Line 63, and Lines 69-74 are space-indented; this repo’s JSON guideline requires tabs.
As per coding guidelines, **/*.{ts,tsx,js,mjs,json} must use tab indentation and LF line endings as configured in .editorconfig.
Also applies to: 39-39, 63-63, 69-74
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 10, Several lines in package.json use space indentation
instead of the repo's required tabs; update the affected JSON entries (notably
the "build-with-lint" script and the other modified JSON properties) to use tab
characters for indentation, ensure LF line endings per .editorconfig, and re-run
the formatter/lint for JSON to verify the changes.
Source: Coding guidelines
Dependency Review flagged root esbuild@0.28.0 (GHSA-gv7w-rqvm-qjhr, high). Pre-existing (same version was in the old bun.lock); resurfaced by the lockfile format change. The advisory is Deno-module-only (missing binary integrity check when NPM_CONFIG_REGISTRY is attacker-controlled); the Node/npm path this project uses already does SHA-256 binaryIntegrityCheck(), so it never affected us. Bump to the patched 0.28.1 anyway to remove the flagged version. 0.28.1 is a clean patch (security + minifier/bundling correctness fixes, no breaking changes, OIDC trusted-published). Build + 1812 tests pass; main.js unchanged. The local safe-chain min-release-age gate suppressed 0.28.1 (published 2 days ago); committed the lockfile via --safe-chain-skip-minimum-package-age for this reviewed security patch. CI installs frozen, so no min-age interaction there.
Resolve the remaining (pre-existing) high-severity advisories surfaced by the whole-tree re-scan via dependency hygiene rather than allow-listing. - Remove cz-conventional-changelog + the config.commitizen block. It was vestigial: no script, no docs, and commits are PR-title-driven (semantic- release reads the squash-merge title). Dropping it removes the entire commitizen tree, eliminating lodash@4.17.21 (GHSA-r5fr-rjxr-66jc) and tmp (GHSA-ph9p-34f9-6g65). The patched lodash@4.18.1 via @semantic-release/git is unaffected. - obsidian-dataview (already on latest 0.5.68) pulls obsidian-calendar-ui -> svelte 3.35 (GHSA-gw32-9rmw-qwww). QuickAdd only uses dataview's getAPI accessor; calendar-ui is never invoked or bundled. No newer dataview exists, so scope a pnpm override to put calendar-ui on the patched svelte 3.59.2. Our own svelte 5 is untouched. Root high-severity audit is now clean; build/lint/check/test all pass.
Contributor
|
🎉 This PR is included in version 2.14.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates QuickAdd's package manager/toolchain from bun to pnpm and upgrades
semantic-releaseto v25.semantic-release v25 requires Node
^22.14.0 || >=24.10.0. The release job ranbunx semantic-release, and Bun 1.3.14 emulates Node 24.3.0, which fails that engine guard (bin/semantic-release.js) — so v25 couldn't run underbunx. Running every step under real Node via pnpm satisfies the guard and unblocks v25.Closes #1240.
Changes
Toolchain
semantic-release^24.2.9→^25.0.5; addedpackageManager: pnpm@10.32.1.pnpm.onlyBuiltDependencies(@codemirror/language,esbuild). pnpm 10 blocks build scripts by default; the git-hosted@codemirror/languagefork pulled byobsidian-dataviewmust be prepared at install time (install hard-fails otherwise). It's externalized inesbuild.config.mjs, so it never enters our bundle.pnpm-lock.yamlanddocs/pnpm-lock.yaml; deletedbun.lock+docs/bun.lock..gitignorenow commitspnpm-lock.yamland ignores foreign lockfiles (incl.bun.lock).docs/package.jsongetspackageManagertoo.CI / release (
ci.yml,release.yml)oven-sh/setup-bun→pnpm/action-setup@v6.0.8(SHA-pinned) beforesetup-node.check-latest: trueonsetup-nodeso a stale24.xtoolcache can't resolve below 24.10 and re-trip the engine guard.bun …→pnpm …;bunx semantic-release→pnpm exec semantic-release. Added pnpm store caching.Other
dependabot.yml:bun→npmecosystem (pnpm is handled undernpm).version-docs.mjsdocs snapshot shellspnpm run docusaurus.docs/vercel.json→ pnpm (non-frozen install, robust to whichever pnpm major the docs host resolves).AGENTS.md,CONTRIBUTING.md,README.md,docs/README.md, PR template, and.codex/environments/environment.toml.Dependency Review / security cleanup
The bun→pnpm lockfile-format change makes Dependency Review re-scan the entire tree (it can't diff
bun.lockagainstpnpm-lock.yaml), which surfaced several pre-existing high-severity advisories that already lived inbun.lockonmaster. Resolved them via real dependency hygiene (no allow-listing / suppression):pnpm.overrides. Also moved the docs override block from npm's top-leveloverridestopnpm.overrides, since pnpm doesn't read the former — the existingwebpackbaroverride had silently stopped applying after the switch.cz-conventional-changelog/commitizen dev tool (no script, no docs; commits are PR-title-driven), which was their only source. Patchedlodash@4.18.1via@semantic-release/gitis unaffected.obsidian-dataview → obsidian-calendar-ui. We only use dataview'sgetAPIaccessor (calendar-ui is never invoked or bundled), and dataview is already on the latest 0.5.68, so a scopedpnpm.overrideputs calendar-ui on the patched svelte 3.59.2; our own svelte 5 is untouched.Root high-severity
pnpm auditis now clean.Testing / validation
Verified locally (pnpm 10.32.1, Node 24.16) and green in CI on ubuntu:
pnpm install(root + docs) and--frozen-lockfile(both); cold-runner install builds the codemirror git dep and resolves the linux esbuild binary.build,build-with-lint,check(846 files, 0 errors),test(1812 pass / 31 skip); docusaurus docs build.semantic-release@25.0.5engine guard passes under real Node; dry-run loads all release plugins — bundled@semantic-release/npm(thenpmPublish:falseversion-bumper),@semantic-release/exec, the localdocs-versioning-plugin.cjs,@semantic-release/git,@semantic-release/github— then correctly skips on the non-masterbranch.This PR is
build:so it does not itself cut a release; the nextfeat/fix/perfwill, now running under v25.Notes for review
.codex/environments/environment.tomlis marked "AUTOGENERATED — DO NOT EDIT". I changedbun install→pnpm installanyway, because leaving it would break the Codex cloud env and create a competingbun.lock. Worth confirming whatever regenerates it now emits pnpm.vercel.json); it auto-detects pnpm from the committed lockfile and passed in CI. Thevercel.jsonedit is harmless but likely unused by CF.