chore: migrate to pnpm, bump Node matrix to 22/24/26, fix audit vulns

.github/workflows/e2e.yml

@@ -14,24 +14,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [18, 20, 22]
+        node-version: [22, 24, 26]
         os: [ubuntu-latest]
         include:
           - perform-attestation: true
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/cache@v4
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-node-
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
-      - run: npm install
-      - run: npm run lint
-      - run: npm run test:e2e
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run lint
+      - run: pnpm run test:e2e
         env:
           EV_APP_UUID: ${{ secrets.EV_APP_UUID_V5 }}
           EV_API_KEY: ${{ secrets.EV_API_KEY_V5 }}

.github/workflows/release.yml

@@ -13,12 +13,15 @@ jobs:
         uses: actions/checkout@v4
       - name: Get tags
         run: git fetch --tags origin
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
       - name: Setup Node.js environment
         uses: actions/setup-node@v4
         with:
           node-version: '24'
+          cache: 'pnpm'
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
       - name: Create Release Pull Request
         id: changesets
         uses: changesets/action@v1
@@ -31,7 +34,7 @@ jobs:
         id: check_release
         if: steps.changesets.outputs.hasChangesets == 'false'
         run: |
-          npx changeset tag && git push origin --tags
+          pnpm exec changeset tag && git push origin --tags
           COMMIT_TAG=$(git tag --points-at HEAD)
           if [ -n "$COMMIT_TAG" ]; then
             echo "A tag is attached to HEAD. Creating a new release..."
@@ -65,12 +68,15 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
       - name: Setup Node.js environment
         uses: actions/setup-node@v4
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
+          cache: 'pnpm'
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
       - name: Publish to npm
-        run: npm publish
+        run: pnpm publish --no-git-checks

.github/workflows/test.yml

@@ -12,27 +12,25 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [18, 20, 22]
+        node-version: [22, 24, 26]
         os: [ubuntu-latest]
         include:
           - perform-attestation: true
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/cache@v4
-        with:
-          path: ~/.npm
-          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-node-
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
-      - run: npm install
-      - run: npm run lint
-      - run: npm run test:coverage
+          cache: 'pnpm'
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run lint
+      - run: pnpm run test:coverage
       - run: |
           sudo apt-get update ; sudo apt-get install -y libfaketime
-          LD_PRELOAD=/usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1 npm run test:filter attestGA
+          # Run mocha directly rather than via `pnpm run`: pnpm hangs when
+          # launched under libfaketime, so only the test process is wrapped.
+          LD_PRELOAD=/usr/lib/x86_64-linux-gnu/faketime/libfaketime.so.1 ./node_modules/.bin/mocha 'tests/**/*.test.js' --grep attestGA
         env:
           FAKETIME: '2023-09-22 11:24:32'
         if: ${{ matrix.perform-attestation }}

.husky/pre-commit

@@ -1,4 +1,4 @@
 #!/bin/sh
 . "$(dirname "$0")/_/husky.sh"
 
-npx lint-staged
+pnpm exec lint-staged

CONTRIBUTING.md

@@ -8,16 +8,18 @@ Bug reports and pull requests are welcome on GitHub at https://github.com/everva
 
 To make life easier, this module features a code formatter/linter.
 
+This repo uses [pnpm](https://pnpm.io/) as its package manager. If you have [Nix](https://nixos.org/) installed, `nix develop` will drop you into a shell with the correct Node.js and pnpm versions. Otherwise, install pnpm via [Corepack](https://pnpm.io/installation#using-corepack) (`corepack enable pnpm`), which will pick up the pinned version from the `packageManager` field in `package.json`.
+
 You will first need to install all of the dependencies with
 
 ```shell
-npm install
+pnpm install
 ```
 
 after that is done, there are git hooks which need to be installed using [husky](https://github.com/typicode/husky), which can be done through
 
 ```shell
-npm run prepare
+pnpm run prepare
 ```
 
 We use one hook: `pre-commit`.
@@ -28,13 +30,13 @@ The `pre-commit` hook ensures that code is formatted correctly. We use [prettier
 
 It should be possible to configure your editor to run prettier on save, which should make your life easier - have a look at [editor support](https://prettier.io/docs/en/editors.html).
 
-There is a test that is run whenever a pull request is made (`npm run lint`), so please ensure that your code is formatted correctly before committing!
+There is a test that is run whenever a pull request is made (`pnpm run lint`), so please ensure that your code is formatted correctly before committing!
 
 ## Commit Formatting & Releases
 
 We use [changesets](https://github.com/changesets/changesets) to version manage in this repo.
 
-When creating a pr that needs to be rolled into a version release, do `npx changeset`, select the level of the version bump required and describe the changes for the change logs. DO NOT select major for releasing breaking changes without team approval.
+When creating a pr that needs to be rolled into a version release, do `pnpm exec changeset`, select the level of the version bump required and describe the changes for the change logs. DO NOT select major for releasing breaking changes without team approval.
 
 To release:
 

flake.nix

@@ -0,0 +1,27 @@
+{
+  description = "Development environment for the Evervault Node.js SDK";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+  outputs =
+    { self, nixpkgs }:
+    let
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+      forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
+    in
+    {
+      devShells = forAllSystems (pkgs: {
+        default = pkgs.mkShell {
+          packages = [
+            pkgs.nodejs_22
+            pkgs.pnpm
+          ];
+        };
+      });
+    };
+}