migrate to pnpm and fix CVE for ip transitive dependency

.codesandbox/tasks.json

@@ -3,13 +3,13 @@
   "setupTasks": [
     {
       "name": "Installing Dependencies",
-      "command": "npm install"
+      "command": "pnpm install"
     }
   ],
   "tasks": {
     "dev": {
       "name": "Build Web5 SDK",
-      "command": "npm run build",
+      "command": "pnpm build",
       "runAtStart": true,
       "restartOn": {
         "files": [
@@ -19,7 +19,7 @@
     },
     "tests": {
       "name": "Run tests",
-      "command": "npm run test:node --ws"
+      "command": "pnpm --recursive --stream test:node"
     }
   }
 }

.github/workflows/alpha-npm.yml

@@ -27,22 +27,26 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
 
+      - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d
+        with:
+          version: 8
+
       - name: Set up Node.js
         uses: actions/setup-node@5ef044f9d09786428e6e895be6be17937becee3a #v4.0.0
         with:
           node-version: 18
           registry-url: https://registry.npmjs.org/
-          cache: "npm"
+          cache: "pnpm"
 
       # Note - this is not required but it gives a clean failure prior to attempting a release if
       # the GH workflow runner is not authenticated with NPMjs.com
       - name: Verify NPM token is authenticated with NPMjs.com
         env:
           NODE_AUTH_TOKEN: ${{secrets.npm_token}}
-        run: npm whoami
+        run: pnpm whoami
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Generate alpha prerelease and bump package.json @web5/* versions
         env:
@@ -55,15 +59,15 @@ jobs:
         shell: bash
 
       - name: Build all workspace packages
-        run: npm run build
+        run: pnpm --recursive --stream build
 
       - name: Publish selected @web5/* packages
         env:
           NODE_AUTH_TOKEN: ${{secrets.npm_token}}
         run: |
           for package in $PACKAGES; do
             cd packages/$package
-            npm publish --tag alpha --no-git-tag-version --access public --provenance
+            pnpm publish --tag alpha --no-git-tag-version --access public --provenance
             cd ../..
           done
         shell: bash

.github/workflows/docs-ci.yml

@@ -18,18 +18,22 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
 
+      - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d
+        with:
+          version: 8
+
       - name: Set up Node.js
         uses: actions/setup-node@5ef044f9d09786428e6e895be6be17937becee3a #v4.0.0
         with:
           node-version: 18
           registry-url: https://registry.npmjs.org/
-          cache: "npm"
+          cache: "pnpm"
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Build all workspace packages
-        run: npm run build
+        run: pnpm --recursive --stream build
 
       - name: TBDocs Reporter
         id: tbdocs-reporter-protocol

.github/workflows/docs-publish.yml

@@ -27,19 +27,23 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
 
+      - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d
+        with:
+          version: 8
+
       - name: Set up Node.js
         uses: actions/setup-node@5ef044f9d09786428e6e895be6be17937becee3a #v4.0.0
         with:
           node-version: 18
           registry-url: https://registry.npmjs.org/
-          cache: 'npm'
+          cache: 'pnpm'
 
       - name: Install dependencies
         run: |
-          npm ci
+          pnpm install --frozen-lockfile
 
       - name: Build all workspace packages
-        run: npm run build
+        run: pnpm --recursive --stream build
 
       - name: TBDocs Reporter
         id: tbdocs-reporter-protocol

.github/workflows/release-npm.yml

@@ -40,21 +40,25 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
 
+      - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d
+        with:
+          version: 8
+
       - name: Set up Node.js
         uses: actions/setup-node@5ef044f9d09786428e6e895be6be17937becee3a #v4.0.0
         with:
           node-version: 18
           registry-url: https://registry.npmjs.org/
-          cache: "npm"
+          cache: "pnpm"
 
       - name: Install semver utility
-        run: npm install -g [email protected]
+        run: pnpm install -g [email protected]
 
       # Note - this is not required but it gives a clean failure prior to attempting a release if the GH workflow runner is not authenticated with NPMjs.com
       - name: Verify NPM token is authenticated with NPMjs.com
         env:
           NODE_AUTH_TOKEN: ${{secrets.npm_token}}
-        run: npm whoami
+        run: pnpm whoami
 
       - name: Check if GitHub repo package version is latest
         env:
@@ -84,17 +88,17 @@ jobs:
 
       - name: Install dependencies
         if: env.IS_LATEST == 'true'
-        run: npm ci
+        run: pnpm ci
 
       - name: Build all workspace packages
         if: env.IS_LATEST == 'true'
-        run: npm run build
+        run: pnpm build
 
       - name: Publish @web5/${{ matrix.package }}@${{ env.REPO_VERSION }}
         if: env.IS_LATEST == 'true'
         env:
           NODE_AUTH_TOKEN: ${{secrets.npm_token}}
         run: |
           cd packages/${{ matrix.package }}
-          npm publish --access public --provenance
+          pnpm publish --access public --provenance
         shell: bash

.github/workflows/tests-ci.yml

@@ -18,14 +18,18 @@ jobs:
       - name: Checkout source
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
 
+      - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d
+        with:
+          version: 8
+
       - name: Set up Node.js
         uses: actions/setup-node@5ef044f9d09786428e6e895be6be17937becee3a #v4.0.0
         with:
           node-version: 18
-          cache: "npm"
+          cache: "pnpm"
 
       - name: Report known vulnerabilities
-        run: npm audit
+        run: pnpm audit
 
   test-with-node:
     runs-on: ubuntu-latest
@@ -34,30 +38,34 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
         with:
           submodules: true
+
+      - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d
+        with:
+          version: 8
 
       - name: Set up Node.js
         uses: actions/setup-node@5ef044f9d09786428e6e895be6be17937becee3a #v4.0.0
         with:
           node-version: 18
           registry-url: https://registry.npmjs.org/
-          cache: "npm"
+          cache: "pnpm"
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Build all workspace packages
-        run: npm run build:esm --ws && npm run build:cjs --ws
+        run: pnpm --recursive --stream build:esm && pnpm --recursive --stream build:cjs
 
       - name: Run linter for all packages
-        run: npm run lint --ws
+        run: pnpm --recursive --stream lint
 
       - name: Run dwn-server (background)
         run: |
-          node node_modules/@web5/dwn-server/dist/esm/src/main.js &
+          pnpm exec node node_modules/@web5/dwn-server/dist/esm/src/main.js &
           echo "DWN_SERVER_BACKGROUND_PROCESS=$!" >> $GITHUB_ENV
 
       - name: Run tests for all packages
-        run: npm run test:node --ws -- --color --reporter mocha-junit-reporter --reporter-options mochaFile=./results.xml
+        run: pnpm --recursive --stream test:node -- --color --reporter mocha-junit-reporter --reporter-options mochaFile=./results.xml
         env:
           TEST_DWN_URL: http://localhost:3000
 
@@ -107,31 +115,35 @@ jobs:
       matrix:
         include:
           - group: "A"
-            packages: "--workspace packages/agent"
+            packages: "--filter agent"
           - group: "B"
-            packages: "--workspace packages/credentials --workspace packages/crypto --workspace packages/dids --workspace packages/proxy-agent --workspace packages/identity-agent --workspace packages/user-agent"
+            packages: "--filter credentials --filter crypto --filter dids --filter proxy-agent --filter identity-agent --filter user-agent"
           - group: "C"
-            packages: "--workspace packages/api --workspace packages/common"
+            packages: "--filter api --filter common"
     steps:
       - name: Checkout source
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
         with:
           submodules: true
+
+      - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d
+        with:
+          version: 8
 
       - name: Set up Node.js
         uses: actions/setup-node@5ef044f9d09786428e6e895be6be17937becee3a #v4.0.0
         with:
           node-version: 18
           registry-url: https://registry.npmjs.org/
-          cache: "npm"
+          cache: "pnpm"
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Get Playwright Version (for cache)
         id: get-playwright-version
         run: |
-          PLAYWRIGHT_VERSION=$(npm ls @playwright/test --workspace=./packages/api | grep '@playwright/test' | awk 'NR==1{print $2}')
+          PLAYWRIGHT_VERSION=$(pnpm --filter agent ls @playwright/test | grep '@playwright/test' | awk 'NR==1{print $2}')
           echo "Playwright Version: $PLAYWRIGHT_VERSION"
           echo "PLAYWRIGHT_VERSION=$PLAYWRIGHT_VERSION" >> $GITHUB_ENV
 
@@ -144,21 +156,21 @@ jobs:
 
       - name: Install Playwright Browsers (if no cache)
         if: steps.cache-playwright-restore.outputs.cache-hit != 'true'
-        run: npx playwright install --with-deps
+        run: pnpm --filter api exec playwright install --with-deps
 
       - name: Build esm
-        run: npm run build:esm --ws
+        run: pnpm --recursive --stream build:esm
 
       - name: Build browser for matrix ${{ matrix.group }}
-        run: npm run build:browser ${{ matrix.packages }}
+        run: pnpm ${{ matrix.packages }} build:browser
 
       - name: Run dwn-server (background)
         run: |
           node node_modules/@web5/dwn-server/dist/esm/src/main.js &
           echo "DWN_SERVER_BACKGROUND_PROCESS=$!" >> $GITHUB_ENV
 
       - name: Run tests for matrix ${{ matrix.group }}
-        run: npm run test:browser ${{ matrix.packages }}
+        run: pnpm ${{ matrix.packages }} --sequential test:browser
 
       - name: Terminate dwn-server
         run: kill $DWN_SERVER_BACKGROUND_PROCESS || true

.vscode/settings.json

@@ -1,3 +1,3 @@
 {
-  "npm.packageManager": "npm"
+  "npm.packageManager": "pnpm"
 }

CONTRIBUTING.md

@@ -53,18 +53,18 @@ Build and Test cycles are run on every commit to every branch using [GitHub Acti
 | Requirement | Tested Version | Installation Instructions                                                                      |
 | ----------- | -------------- | ---------------------------------------------------------------------------------------------- |
 | Node.js     | 18.16.0        | [Introduction to Node.js](https://nodejs.dev/en/learn/)                                        |
-| NPM         | 9.6.3          | [NPM Package Manager](https://nodejs.dev/en/learn/an-introduction-to-the-npm-package-manager/) |
+| PNPM         | 8.15.3          | [PNPM Package Manager](https://pnpm.io/installation) |
 
 ### TypeScript
 
 This project is written in TypeScript, a strongly typed programming language that builds on JavaScript.
 
-You may verify your `node` and `npm` installation via the terminal:
+You may verify your `node` and `pnpm` installation via the terminal:
 
 ```
 $ node --version
 v18.16.0
-$ npm --version
+$ pnpm --version
 9.6.3
 ```
 
@@ -108,11 +108,11 @@ to your valuable work:
 
 ### Running Tests
 
-- Running the `npm run test:node --ws` command from the root of the project will run all tests using node.
+- Running the `pnpm --recursive test:node` command from the root of the project will run all tests using node.
   - This is run via CI whenever a pull request is opened, or a commit is pushed to a branch that has an open PR
-- Running the `npm run test:browser --ws` command from the root of the project will run the tests in a browser environment
+- Running the `pnpm --recursive test:browser` command from the root of the project will run the tests in a browser environment
   - Please make sure there are no failing tests before switching your PR to ready for review! We hope to have this automated via a github action very soon.
-- You can also run `npm run test:node -w=packages/DIR` or `npm run test:browser -w=packages/DIR` from the root of the project to run tests for a single package. For example, to run the tests only for the `web5` package run `npm run test:node -w=packages/web5`.
+- You can also run `pnpm --filter=PACKAGE test:node` or `pnpm --filter=PACKAGE test:browser` from the root of the project to run tests for a single package. For example, to run the tests only for the `web5` package run `pnpm --filter=web5 test:node`.
 
 ### Test Coverage Expectations
 
@@ -146,7 +146,7 @@ To see if the docs are being generated properly without errors, and to preview t
 # to see if there are any doc errors
 open .tbdocs/docs-report.md
 
-# to serve the generated docs locally using a static server (e.g. `npm i -g http-server`)
+# to serve the generated docs locally using a static server (e.g. `pnpm install -g http-server`)
 http-server .tbdocs/docs
 ```
 
@@ -192,7 +192,7 @@ After one or more PRs have been approved and merged by project maintainers, a Gi
 version tag. The act of creating the GitHub release triggers automated publication of the package to the
 [NPM Registry](https://npmjs.com) which will be tagged as _latest_.
 
-The next time someone runs `npm install @web5/<package_name>` the newly published release will be installed.
+The next time someone runs `pnpm install @web5/<package_name>` the newly published release will be installed.
 
 #### Alpha Releases
 
@@ -218,5 +218,5 @@ the [NPM Registry](https://npmjs.com) within a few minutes.
 > **Note**
 > Alpha version will never be tagged as _latest_.
 
-To install an `alpha` tagged release use either the `npm install @web5/<package>@alpha` or
-`npm install @web5/<package>@x.y.z-alpha-YYYYMMDD-commithash` syntax.
+To install an `alpha` tagged release use either the `pnpm install @web5/<package>@alpha` or
+`pnpm install @web5/<package>@x.y.z-alpha-YYYYMMDD-commithash` syntax.