Switch to pnpm

.github/workflows/dockertests.yml

@@ -38,8 +38,9 @@ jobs:
           ./contrib/free_disk_space.sh
       - name: npm install, build and test
         run: |
-          npm install
-          npm test
+          corepack enable
+          corepack pnpm install
+          corepack pnpm test
           mkdir -p bomresults repotests
         env:
           CI: true
@@ -93,8 +94,9 @@ jobs:
           ./contrib/free_disk_space.sh
       - name: npm install, build and test
         run: |
-          npm install
-          npm test
+          corepack enable
+          corepack pnpm install
+          corepack pnpm test
           mkdir -p bomresults repotests
         env:
           CI: true
@@ -138,7 +140,8 @@ jobs:
           ./contrib/free_disk_space.sh
       - name: npm install, build and test
         run: |
-          npm install
+          corepack enable
+          corepack pnpm install
           mkdir -p bomresults
         env:
           CI: true
@@ -176,7 +179,8 @@ jobs:
           java-version: ${{ matrix.java-version }}
       - name: npm install, build
         run: |
-          npm install
+          corepack enable
+          corepack pnpm install
           mkdir bomresults
         env:
           CI: true

.github/workflows/java-reachables-test.yml

@@ -27,8 +27,8 @@ jobs:
           node-version: ${{ matrix.node-version }}
       - name: npm install, build
         run: |
-          npm install
-          npm run build --if-present
+          corepack enable
+          corepack pnpm install
           mkdir -p repotests
           mkdir -p bomresults
       - uses: actions/checkout@v4

.github/workflows/lint.yml

@@ -18,7 +18,8 @@ jobs:
           node-version-file: .nvmrc
       - name: Check Linting
         run: |
-          npm install
-          npm run lint:check
+          corepack enable
+          corepack pnpm install
+          corepack pnpm run lint:check
         env:
           CI: true

.github/workflows/nodejs.yml

@@ -32,9 +32,9 @@ jobs:
           python-version: 3.11
       - name: npm install, build and test
         run: |
-          npm install
-          npm run build --if-present
-          npm test
+          corepack enable
+          corepack pnpm install
+          corepack pnpm test
         env:
           CI: true
       - name: check sbom for vulns

.github/workflows/npm-release.yml

@@ -33,19 +33,22 @@ jobs:
     - name: Release npm package
       if: startsWith(github.ref, 'refs/tags/')
       run: |
+        corepack enable
+        corepack pnpm install
         npm config set //npm.pkg.github.com/:_authToken=$GITHUB_TOKEN
         npm config set //registry.npmjs.org/:_authToken=$NODE_AUTH_TOKEN
         echo "cyclonedx:registry=https://npm.pkg.github.com" > ~/.npmrc
-        npm publish --access=public --@cyclonedx:registry='https://npm.pkg.github.com'
+        corepack pnpm publish --access=public --@cyclonedx:registry='https://npm.pkg.github.com'
         echo "cyclonedx:registry=https://registry.npmjs.org" > ~/.npmrc
-        npm publish --provenance --access=public --@cyclonedx:registry='https://registry.npmjs.org'
+        corepack pnpm publish --provenance --access=public --@cyclonedx:registry='https://registry.npmjs.org'
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
     - name: jsr publish
       if: startsWith(github.ref, 'refs/tags/')
       run: |
-        npm install
+        corepack enable
+        corepack pnpm install
         npx jsr publish --allow-dirty
       continue-on-error: true
       env:
@@ -109,7 +112,8 @@ jobs:
       continue-on-error: true
     - name: Attach cdx sbom
       run: |
-        npm install
+        corepack enable
+        corepack pnpm install
         node bin/cdxgen.js -t docker -o bom.json ghcr.io/cyclonedx/cdxgen:latest
         oras attach --artifact-type sbom/cyclonedx ghcr.io/cyclonedx/cdxgen:latest ./bom.json:application/json
         oras discover -o tree ghcr.io/cyclonedx/cdxgen:latest

.github/workflows/python-atom-tests.yml

@@ -24,8 +24,8 @@ jobs:
           java-version: '21'
       - name: npm install, build and test
         run: |
-          npm install
-          npm run build --if-present
+          corepack enable
+          corepack pnpm install
           mkdir -p repotests
           mkdir -p bomresults
         env:

.github/workflows/repotests.yml

@@ -46,9 +46,9 @@ jobs:
         run: choco install -y bazel
       - name: npm install, build and test
         run: |
-          npm install
-          npm run build --if-present
-          npm test
+          corepack enable
+          corepack pnpm install
+          corepack pnpm test
           mkdir -p repotests
           mkdir -p bomresults
           mkdir -p denoresults

.github/workflows/snapshot-tests.yml

@@ -32,15 +32,16 @@ jobs:
 
       -  name: Atom, cdxgen, sdkman, custom-json-diff installs
          run: |
-           cdxgen_version=$(npm pack | tail -1)
-           npm install -g "$cdxgen_version"
+           corepack enable
+           cdxgen_version=$(corepack pnpm pack | tail -1)
+           corepack pnpm install -g "$cdxgen_version"
            python -m pip install --upgrade pip
            python -m pip install pytest
            git clone https://github.com/appthreat/cdxgen-samples.git /home/runner/work/samples
            git clone https://github.com/appthreat/custom-json-diff.git /home/runner/work/custom-json-diff
            cd /home/runner/work/custom-json-diff
            python -m pip install .
-           npm install -g @appthreat/atom
+           corepack pnpm install -g @appthreat/atom
            curl -s "https://get.sdkman.io" | bash
            source "/home/runner/.sdkman/bin/sdkman-init.sh"
 

README.md

@@ -510,12 +510,14 @@ Please check out our [contribute to CycloneDX/cdxgen documentation][github-contr
 Before raising a PR, please run the following commands.
 
 ```bash
+corepack enable
+corepack pnpm install
 # Generate types using jsdoc syntax
-npm run gen-types
+corepack pnpm run gen-types
 # Run biomejs formatter and linter with auto fix
-npm run lint
+corepack pnpm run lint
 # Run jest tests
-npm test
+corepack pnpm test
 ```
 
 <!-- LINK LABELS -->

ci/Dockerfile

@@ -133,7 +133,7 @@ RUN set -e; \
     && gem --version \
     && bundler --version
 COPY . /opt/cdxgen
-RUN cd /opt/cdxgen && npm install --omit=dev \
+RUN cd /opt/cdxgen && corepack enable && corepack pnpm install --prod \
     && mkdir -p /opt/cdxgen-node-cache \
     && chown -R cyclonedx:cyclonedx /opt/cdxgen /opt/cdxgen-node-cache \
     && chmod a-w -R /opt \

ci/Dockerfile-bun

@@ -4,7 +4,7 @@ LABEL maintainer="cyclonedx" \
       org.opencontainers.image.authors="Prabhu Subramanian <prabhu@appthreat.com>" \
       org.opencontainers.image.source="https://github.com/cyclonedx/cdxgen" \
       org.opencontainers.image.url="https://github.com/cyclonedx/cdxgen" \
-      org.opencontainers.image.version="10.5.x" \
+      org.opencontainers.image.version="10.6.x" \
       org.opencontainers.image.vendor="cyclonedx" \
       org.opencontainers.image.licenses="Apache-2.0" \
       org.opencontainers.image.title="cdxgen" \

ci/Dockerfile-deno

@@ -4,7 +4,7 @@ LABEL maintainer="cyclonedx" \
       org.opencontainers.image.authors="Prabhu Subramanian <prabhu@appthreat.com>" \
       org.opencontainers.image.source="https://github.com/cyclonedx/cdxgen" \
       org.opencontainers.image.url="https://github.com/cyclonedx/cdxgen" \
-      org.opencontainers.image.version="10.5.x" \
+      org.opencontainers.image.version="10.6.x" \
       org.opencontainers.image.vendor="cyclonedx" \
       org.opencontainers.image.licenses="Apache-2.0" \
       org.opencontainers.image.title="cdxgen" \

ci/Dockerfile-ppc64

@@ -102,7 +102,7 @@ RUN set -e; \
     && gem --version \
     && bundler --version
 COPY . /opt/cdxgen
-RUN cd /opt/cdxgen && npm install --omit=dev \
+RUN cd /opt/cdxgen && corepack enable && corepack pnpm install --prod \
     && chown -R cyclonedx:cyclonedx /opt/cdxgen \
     && chmod a-w -R /opt \
     && rm -rf /root/.cache /var/cache/yum /root/.cargo \

deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "10.5.2",
+  "version": "10.6.0",
   "exports": "./index.js",
   "compilerOptions": {
     "allowJs": true,

jsr.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "10.5.2",
+  "version": "10.6.0",
   "exports": "./index.js",
   "include": ["*.js", "bin/**", "data/**", "types/**"],
   "exclude": ["test/", "docs/", "contrib/", "ci/", "tools_config/"]