chore: migrate from npm to pnpm

.gitattributes

@@ -1,5 +1,5 @@
 # Normalize line endings to LF for all text files,
-# so `npm run lint` / `npm run format` behave identically
+# so `pnpm lint` / `pnpm format` behave identically
 # on Windows (core.autocrlf) and Linux/CI.
 * text=auto eol=lf
 

.github/dependabot.yml

@@ -1,16 +1,22 @@
 version: 2
 updates:
+  # The `npm` ecosystem also covers pnpm.
   - package-ecosystem: npm
     directory: /
     schedule:
       interval: weekly
+    # pnpm refuses versions published less than a day ago (minimumReleaseAge).
+    cooldown:
+      default-days: 1
     groups:
       dev-dependencies:
         dependency-type: development
   - package-ecosystem: npm
     directory: /demo
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 1
     groups:
       demo-dependencies:
         patterns:

.github/workflows/ci.yml

@@ -11,15 +11,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      # Installs the pnpm version pinned by `packageManager` in package.json.
+      - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-          cache: npm
-      - run: npm ci
-      - run: npm run lint
-      - run: npm run typecheck
-      - run: npm run build
-      - run: npm run test:coverage
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm run lint
+      - run: pnpm run typecheck
+      - run: pnpm run build
+      - run: pnpm run test:coverage
       - uses: codecov/codecov-action@v5
         with:
           files: coverage/lcov.info
@@ -31,16 +33,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v4
         with:
           node-version: 22
-          cache: npm
-      # The demo aliases the package to ../src, so the root install has to
-      # exist for its dependencies to resolve.
-      - run: npm ci
-      - run: npm --prefix demo ci
-      - run: npm --prefix demo run typecheck
-      - run: npm --prefix demo run build
+          cache: pnpm
+      # The demo is a workspace package, so the root install covers it and the
+      # ../src it aliases.
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --dir demo run typecheck
+      - run: pnpm --dir demo run build
 
   test:
     name: Test (Node ${{ matrix.node }}, React ${{ matrix.react }})
@@ -52,10 +54,17 @@ jobs:
         react: [18, 19]
     steps:
       - uses: actions/checkout@v4
+      # pnpm 11 needs Node 22.13+. The standalone build bundles its own Node,
+      # so it also runs on the Node 20 entries while the tests themselves run
+      # on the matrix Node.
+      - uses: pnpm/action-setup@v6
+        with:
+          standalone: true
       - uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node }}
-          cache: npm
-      - run: npm ci
-      - run: npm install --no-save react@${{ matrix.react }} react-dom@${{ matrix.react }}
-      - run: npm test
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      # Swaps React in this job's checkout only; nothing is committed.
+      - run: pnpm add --save-dev --workspace-root react@${{ matrix.react }} react-dom@${{ matrix.react }}
+      - run: pnpm test

.gitignore

@@ -5,3 +5,9 @@ node_modules
 .history
 dist
 /coverage
+
+# pnpm is the only supported package manager; keep other tools' lockfiles out.
+package-lock.json
+yarn.lock
+bun.lock
+bun.lockb

.prettierignore

@@ -0,0 +1,2 @@
+# Generated by pnpm.
+pnpm-lock.yaml

CONTRIBUTING.md

@@ -2,27 +2,32 @@
 
 ## Prerequisites
 
-[Node.js](https://nodejs.org/) >= v20 must be installed. CI tests on Node 20, 22 and 24.
+- [Node.js](https://nodejs.org/) >= v22.13, which pnpm 11 requires. The published component still supports Node 20; CI tests on Node 20, 22 and 24.
+- [pnpm](https://pnpm.io/installation) 11. The exact version is pinned in the `packageManager` field of `package.json`.
 
 ## Installation
 
-- Running `npm install` in the component's root directory will install everything you need for development.
-- Running `npm install` in the `demo` directory will install everything you need to run the demo app locally.
+- Running `pnpm install` in the root directory installs everything you need for development, including the demo app in `demo/` (a pnpm workspace package).
+- npm, Yarn and Bun aren't supported. `npm install` and `npm run` stop with an `EBADDEVENGINES` error.
+
+### Dependency install scripts
+
+pnpm doesn't run a dependency's install scripts (`preinstall`, `install`, `postinstall`) unless the package is listed under `allowBuilds` in `pnpm-workspace.yaml`, and the install fails when a dependency brings in one that hasn't been reviewed. If that happens, check what the script does, then add the package with `true` (it needs the script) or `false` (it works without it) and a comment saying why.
 
 ## Demo Development Server
 
-- `npm run dev` from the `demo` directory runs the demo app at [http://localhost:5173](http://localhost:5173) with hot module reloading. The demo imports the component straight from `src/`, so it doubles as a development harness.
+- `pnpm dev` runs the demo app at [http://localhost:5173](http://localhost:5173) with hot module reloading. The demo imports the component straight from `src/`, so it doubles as a development harness.
 
 ## Running Tests
 
-- `npm test` runs the tests once.
-- `npm run test:coverage` runs the tests and produces a coverage report in `coverage/`.
-- `npm run test:watch` runs the tests on every change.
+- `pnpm test` runs the tests once.
+- `pnpm test:coverage` runs the tests and produces a coverage report in `coverage/`.
+- `pnpm test:watch` runs the tests on every change.
 
 ## Building
 
-- `npm run build` builds the component for publishing to npm.
-- `npm run build` in the `demo` directory builds the demo app.
+- `pnpm build` builds the component for publishing to npm.
+- `pnpm --dir demo build` builds the demo app.
 
 ## Conventions
 

README.md

@@ -200,12 +200,11 @@ Set `options.locale` (bundled: `en`, `es`, `fr`, `de`, `it`, `pt`, `nl`, `ja`, `
 
 ## Demo
 
-Try the live demo at [react-image-editor-example.vercel.app](https://react-image-editor-example.vercel.app/), or run it locally — a Vite-based demo lives in [`demo/`](demo):
+Try the live demo at [react-image-editor-example.vercel.app](https://react-image-editor-example.vercel.app/), or run it locally — a Vite-based demo lives in [`demo/`](demo). From the repository root, with [pnpm](https://pnpm.io/installation) installed:
 
 ```sh
-cd demo
-npm install
-npm run dev
+pnpm install
+pnpm dev
 ```
 
 ## License