build: migrate frontend tooling to pnpm + pin vite 8.0.3 (#666)

* build: migrate frontend tooling from yarn to pnpm

The Dockerfiles ran `yarn && yarn build`, which broke on node:24 (yarn no
longer on PATH; the corepack yarn shim made `npm i -g yarn` fail EEXIST),
while CI + Makefile used npm and only a yarn.lock was committed — an
inconsistent yarn/npm split. Standardize on pnpm, pinned via the
packageManager field + corepack.

- package.json: packageManager pnpm@11.6.0.
- pnpm-workspace.yaml: nodeLinker: hoisted (flat node_modules, npm/yarn-like, so
  directly-imported transitive deps like flatpickr resolve) + allow vue-demi's
  postinstall (it selects the Vue 3 entry). pnpm 11 reads these here, not .npmrc.
- Generate pnpm-lock.yaml (imported from yarn.lock); delete yarn.lock.
- Dockerfiles (dev/nginx/production): node:24 + `corepack enable && pnpm install --frozen-lockfile && pnpm build`.
- CI (check.yaml, docker.yaml): pnpm/action-setup + setup-node cache:pnpm; pnpm install --frozen-lockfile / pnpm build.
- Makefile, composer.json dev script, CLAUDE.md: npm/yarn -> pnpm.

pnpm build verified on a clean install (1425 modules, hoisted node_modules).

* fix(build): pin vite to 8.0.3 to fix rolldown chunk regression

vite 8.0.16 (pulled in by #653) bundles rolldown 1.0.3, which emits a
lazy chunk referencing an undefined Vue runtime-init function
(init_runtime_dom_esm_bundler), breaking the SPA at runtime. The build
succeeds so CI never caught it. Pin vite to 8.0.3 (the version 2.3.3
shipped, rolldown 1.0.0) which produces a correct bundle.

.github/workflows/check.yaml

@@ -100,16 +100,20 @@ jobs:
             - name: Install Composer dependencies
               uses: ramsey/composer-install@v2
 
+            - name: Install pnpm
+              uses: pnpm/action-setup@v4
+
             - name: Use Node.js 24
               uses: actions/setup-node@v4
               with:
                   node-version: 24
+                  cache: pnpm
 
             - name: Install
-              run: npm install
+              run: pnpm install --frozen-lockfile
 
             - name: Compile Front-end
-              run: npm run build
+              run: pnpm build
 
             - name: Apply tests ${{ matrix.php-version }}
               run: php artisan test

.github/workflows/docker.yaml

@@ -61,16 +61,20 @@ jobs:
       - name: Install Composer dependencies
         uses: ramsey/composer-install@v2
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Use Node.js 24
         uses: actions/setup-node@v4
         with:
           node-version: 24
+          cache: pnpm
 
       - name: Install
-        run: npm install
+        run: pnpm install --frozen-lockfile
 
       - name: Compile Front-end
-        run: npm run build
+        run: pnpm build
 
       - name: Apply tests ${{ matrix.php-version }}
         run: php artisan test
@@ -100,16 +104,20 @@ jobs:
         with:
           composer-options: --no-dev
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+
       - name: Use Node.js 24
         uses: actions/setup-node@v4
         with:
           node-version: 24
+          cache: pnpm
 
       - name: Install
-        run: npm install
+        run: pnpm install --frozen-lockfile
 
       - name: Compile Front-end
-        run: npm run build
+        run: pnpm build
 
       - name: Build Dist
         run: |

CLAUDE.md

@@ -11,8 +11,8 @@ InvoiceShelf is an open-source invoicing and expense tracking application built
 ### Development
 ```bash
 composer run dev          # Starts PHP server, queue listener, log tail, and Vite dev server concurrently
-npm run dev               # Vite dev server only
-npm run build             # Production frontend build
+pnpm dev                  # Vite dev server only
+pnpm build                # Production frontend build
 ```
 
 ### Testing

Makefile

@@ -7,8 +7,9 @@ composer:
 npm-build:
 	rm -r public/build 2> /dev/null || true
 	rm -r node_modules 2> /dev/null || true
-	npm install
-	npm run build
+	corepack enable
+	pnpm install --frozen-lockfile
+	pnpm build
 
 dist-gen: clean composer npm-build
 	@echo "packaging..."

composer.json

@@ -80,7 +80,7 @@
         ],
         "dev": [
             "Composer\\Config::disableProcessTimeout",
-            "npx concurrently -c \"#93c5fd,#c4b5fd,#fb7185,#fdba74\" \"php artisan serve\" \"php artisan queue:listen --tries=1\" \"php artisan pail --timeout=0\" \"npm run dev\" --names=server,queue,logs,vite"
+            "pnpm dlx concurrently -c \"#93c5fd,#c4b5fd,#fb7185,#fdba74\" \"php artisan serve\" \"php artisan queue:listen --tries=1\" \"php artisan pail --timeout=0\" \"pnpm dev\" --names=server,queue,logs,vite"
         ],
 	"ide-helper": [
             "@php artisan ide-helper:generate",

docker/development/Dockerfile

@@ -1,7 +1,8 @@
 FROM --platform=$BUILDPLATFORM node:24 AS static_builder
     WORKDIR /var/www/html
     COPY . /var/www/html
-    RUN yarn && yarn build
+    # corepack activates the pnpm version pinned in package.json's packageManager field.
+    RUN corepack enable && pnpm install --frozen-lockfile && pnpm build
 
 FROM serversideup/php:8.4-fpm-alpine AS base
     USER root

docker/development/nginx.Dockerfile

@@ -1,7 +1,8 @@
-FROM --platform=$BUILDPLATFORM node AS static_builder
+FROM --platform=$BUILDPLATFORM node:24 AS static_builder
     WORKDIR /var/www/html
     COPY . /var/www/html
-    RUN yarn && yarn build
+    # corepack activates the pnpm version pinned in package.json's packageManager field.
+    RUN corepack enable && pnpm install --frozen-lockfile && pnpm build
 
 FROM nginx AS production
     ENV PHP_FPM_HOST="php-fpm:9000"

docker/production/Dockerfile

@@ -1,7 +1,8 @@
 FROM --platform=$BUILDPLATFORM node:24 AS static_builder
     WORKDIR /var/www/html
     COPY . /var/www/html
-    RUN yarn && yarn build
+    # corepack activates the pnpm version pinned in package.json's packageManager field.
+    RUN corepack enable && pnpm install --frozen-lockfile && pnpm build
 
 FROM serversideup/php:8.4-fpm-nginx-alpine AS base
     USER root

package.json

@@ -4,6 +4,7 @@
     "node": ">=24"
   },
   "type": "module",
+  "packageManager": "pnpm@11.6.0",
   "scripts": {
     "dev": "vite",
     "watch": "vite build --watch",
@@ -51,7 +52,7 @@
     "pinia": "^3.0.0",
     "v-money3": "^3.24.1",
     "v-tooltip": "^4.0.0-beta.17",
-    "vite": "^8.0.0",
+    "vite": "8.0.3",
     "vue": "^3.5",
     "vue-flatpickr-component": "^12.0.0",
     "vue-i18n": "^11.0.1",

pnpm-workspace.yaml

@@ -0,0 +1,9 @@
+# Flat, hoisted node_modules (npm/yarn-like) so the migration is a drop-in and
+# transitive packages imported directly (e.g. flatpickr via vue-flatpickr-component)
+# keep resolving. pnpm 11 reads this here, not from .npmrc.
+nodeLinker: hoisted
+
+# Build-script allow-listing (replaces package.json "pnpm.onlyBuiltDependencies").
+# vue-demi needs its postinstall to select the Vue 3 entry; it is a trusted Vue-core shim.
+allowBuilds:
+  vue-demi: true