npm sucks !

.github/workflows/docker.yml

@@ -11,6 +11,7 @@ on:
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
+  PYTHON_VERSION: '3.12'
 
 jobs:
   test:
@@ -19,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -40,53 +41,48 @@ jobs:
   e2e:
     if: "!startsWith(github.ref, 'refs/heads/feat/')"
     runs-on: ubuntu-latest
+    name: Test e2e with Node
+    strategy:
+      matrix:
+        node: [22, 24, 26]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Set up Python
+        uses: actions/checkout@v7
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
         uses: actions/setup-python@v5
         with:
-          python-version: "3.12"
+          python-version: "${{ env.PYTHON_VERSION }}"
           cache: pip
-
       - name: Install backend dependencies
         run: pip install '.[dev]'
-
-      - name: Set up Node
-        uses: actions/setup-node@v4
+      - name: Set up Node ${{ matrix.node }} with pnpm
+        uses: pnpm/setup@v3
         with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: frontend/package-lock.json
-
+          runtime: node@${{ matrix.node }}
+          cache: true
+          working-directory: frontend
       - name: Install frontend dependencies
-        run: npm ci --legacy-peer-deps
+        run: pnpm install --frozen-lockfile
         working-directory: frontend
-
       - name: Check message catalogs are up to date
         # A PR that adds or edits a <Trans>/t`` string must also commit the
-        # re-extracted src/locales/*/messages.po (npm run i18n:extract).
+        # re-extracted src/locales/*/messages.po (pnpm run i18n:extract).
         run: |
-          npm run i18n:extract
+          pnpm run i18n:extract
           git diff --exit-code -- src/locales \
-            || { echo "::error::Message catalogs are stale. Run 'npm run i18n:extract' in frontend/ and commit src/locales."; exit 1; }
-        working-directory: frontend
-
-      - name: Install Playwright browser
-        run: npx playwright install --with-deps chromium
+            || { echo "::error::Message catalogs are stale. Run 'pnpm run i18n:extract' in frontend/ and commit src/locales."; exit 1; }
         working-directory: frontend
-
       - name: Run E2E tests
-        run: npx playwright test
+        run: |
+          pnpm exec playwright install --with-deps chromium
+          pnpm exec playwright test
         working-directory: frontend
         env:
           E2E_PYTHON: python
           CI: "true"
-
       - name: Upload traces on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: playwright-traces
           path: frontend/test-results/
@@ -102,7 +98,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
@@ -157,7 +153,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3

CONTRIBUTING.md

@@ -21,7 +21,7 @@ cd tome
 python -m venv .venv
 source .venv/bin/activate
 pip install -e '.[dev]'
-cd frontend && npm install && cd ..
+cd frontend && pnpm install && cd ..
 
 # Run backend + frontend with hot reload
 ./dev.sh
@@ -67,7 +67,7 @@ Run the test suite and the frontend build:
 
 ```bash
 pytest tests/ -q             # full backend suite
-cd frontend && npm run build # typechecks + production build
+cd frontend && pnpm run build # typechecks + production build
 ```
 
 Both should be green. If you've added a feature, add tests. If you've

Dockerfile

@@ -1,10 +1,20 @@
 # Build frontend
-FROM node:22-alpine AS frontend-build
+FROM node:lts-alpine AS frontend-build
+
+SHELL ["/bin/ash", "-o", "pipefail", "-c"]
+ENV \
+    NODE_ENV=production \
+    PNPM_VERSION=12 \
+    PNPM_HOME="/root/.local/share/pnpm" \
+    PATH="/root/.local/share/pnpm/bin/:$PATH"
+
 WORKDIR /app/frontend
-COPY frontend/package*.json ./
-RUN npm ci --legacy-peer-deps
 COPY frontend/ ./
-RUN npm run build
+
+RUN wget -qO- https://get.pnpm.io/install.sh | ENV="$HOME/.shrc" SHELL="$(which sh)" sh - && \
+    pnpm install --frozen-lockfile && \
+    pnpm run build
+
 
 # Runtime
 FROM python:3.12-slim

dev.sh

@@ -39,7 +39,7 @@ echo "  ✓ Backend PID $BACKEND_PID → http://localhost:8080/api/docs"
 
 # Frontend (Vite HMR handles live reload)
 cd "$SCRIPT_DIR/frontend"
-npm run dev -- --port 5173 > /tmp/tome-vite.log 2>&1 < /dev/null &
+pnpm run dev -- --port 5173 > /tmp/tome-vite.log 2>&1 < /dev/null &
 FRONTEND_PID=$!
 disown $FRONTEND_PID
 echo "  ✓ Frontend PID $FRONTEND_PID → http://localhost:5173"

docs/translating.md

@@ -35,7 +35,7 @@ Rules of thumb:
 2. Add it to `locales` in `frontend/lingui.config.ts` and to `LOCALES` in
    `frontend/src/lib/i18n.ts` (the label is the language's own name, e.g.
    `Deutsch`, shown untranslated in the picker).
-3. Run `npm run i18n:extract` in `frontend/`. This creates
+3. Run `pnpm run i18n:extract` in `frontend/`. This creates
    `src/locales/<code>/messages.po` with every source string and empty
    `msgstr`s.
 4. Translate, then open a pull request. Please mention in the PR whether you
@@ -48,7 +48,7 @@ Rules of thumb:
 - Interpolate with template variables, never concatenate: `` t`${n} books selected` ``.
 - Plurals: `<Plural value={n} one="# book" other="# books" />`.
 - Label maps outside components: `` msg`Unread` `` descriptors, rendered with `i18n._()`.
-- After adding or changing strings run `npm run i18n:extract` and commit the
+- After adding or changing strings run `pnpm run i18n:extract` and commit the
   updated `src/locales/*/messages.po`. CI fails on stale catalogs.
-- `npm run lint` warns on user-facing strings that bypass Lingui
+- `pnpm run lint` warns on user-facing strings that bypass Lingui
   (`lingui/no-unlocalized-strings`).

frontend/e2e/start.sh

@@ -7,7 +7,7 @@
 set -euo pipefail
 
 cd "$(dirname "$0")/.."   # frontend/
-npm run build
+pnpm run build
 
 E2E_DIR="$(pwd)/e2e/.data"
 rm -rf "$E2E_DIR"

frontend/lingui.config.ts

@@ -1,7 +1,7 @@
 import { defineConfig } from '@lingui/cli'
 import { formatter } from '@lingui/format-po'
 
-// Source strings live inline in the components (English); `npm run i18n:extract`
+// Source strings live inline in the components (English); `pnpm run i18n:extract`
 // pulls them into src/locales/<locale>/messages.po. The Vite plugin compiles the
 // .po files on import, so no separate compile step is needed for dev or build.
 export default defineConfig({