Add pnpm support

[dr460nf1r3]

Thanks for contributing to the buildpack. To speed up the process of reviewing your pull request please provide us with:

• A short explanation of the proposed change: add the long overdue pnpm support

• An explanation of the use cases your change solves: adds support for a package manager which speeds up the build times by being much more efficient than npm or yarn 1. Since this is a massive improvement for time spend in CI (e.g. for lifecycle tests), it may decrease expenses for the same purpose. When switching a particular MTA app to use pnpm, it effectively cut build times in half for this one use case tested. This was requested here as well, and closed without reason: pnpm support #398

• I have viewed signed and have submitted the Contributor License Agreement

• I have made this pull request to the master branch

• I have added an integration test

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: dr460nf1r3 / name: Nico Jensch (148992c, 26af97d, 5fbb2d4, 8684983, f2f55a5)

[Copilot]

Pull request overview

Adds pnpm as a supported package manager in the Node.js buildpack, including dependency installation, caching behavior, and integration coverage.

Changes:

• Detect pnpm usage via pnpm-lock.yaml / pnpm-workspace.yaml and support engines.pnpm in package.json.
• Install pnpm (via npm) and run dependency builds using a new pnpm build path and cache directory (.pnpm-store).
• Add unit + integration tests and pnpm fixtures (simple app + workspace app) to validate behavior.

Reviewed changes

Copilot reviewed 26 out of 35 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/nodejs/supply/supply_test.go	Extends supplier unit tests for pnpm detection, engines parsing, pnpm install, caching, and build flow.
src/nodejs/supply/supply.go	Adds pnpm wiring to supplier (detection, install, build selection, dependency listing, cache handling).
src/nodejs/supply/mocks_test.go	Adds a PNPM mock to support new supplier tests.
src/nodejs/supply/cli/main.go	Wires the new pnpm implementation into the supply CLI.
src/nodejs/pnpm/pnpm.go	Introduces pnpm build implementation (pnpm config set store-dir, pnpm install).
src/nodejs/pnpm/pnpm_test.go	Adds unit tests for pnpm build behavior (store-dir, prod mode, offline vendored store).
src/nodejs/pnpm/pnpm_suite_test.go	Adds ginkgo suite for pnpm package tests.
src/nodejs/pnpm/mocks_test.go	Adds gomock for pnpm Command interface used by tests.
src/nodejs/package_json/package_json.go	Adds engines.pnpm parsing + logging.
src/nodejs/integration/init_test.go	Registers PNPM integration suite.
src/nodejs/integration/pnpm_test.go	Adds integration tests for pnpm “simple” and “workspaces” fixture deployments.
fixtures/pnpm/simple/package.json	Adds a pnpm-based fixture app (simple).
fixtures/pnpm/simple/pnpm-lock.yaml	Adds lockfile for simple pnpm fixture.
fixtures/pnpm/simple/server.js	Adds server for simple pnpm fixture.
fixtures/pnpm/workspaces/package.json	Adds a pnpm workspace fixture root package.json.
fixtures/pnpm/workspaces/pnpm-lock.yaml	Adds lockfile for pnpm workspace fixture.
fixtures/pnpm/workspaces/pnpm-workspace.yaml	Adds pnpm workspace definition.
fixtures/pnpm/workspaces/packages/sample-lib/package.json	Adds sample workspace library package metadata.
fixtures/pnpm/workspaces/packages/sample-lib/index.js	Adds sample workspace library code.
fixtures/pnpm/workspaces/packages/sample-app/package.json	Adds sample workspace app package metadata.
fixtures/pnpm/workspaces/packages/sample-app/index.js	Adds sample workspace app server code.
fixtures/pnpm/workspaces/packages/pkg-a/package.json	Adds workspace package A metadata.
fixtures/pnpm/workspaces/packages/pkg-a/server.js	Adds workspace package A server.
fixtures/pnpm/workspaces/packages/pkg-b/package.json	Adds workspace package B metadata.
fixtures/pnpm/workspaces/packages/pkg-b/index.js	Adds workspace package B code.
fixtures/pnpm/unmet/package.json	Adds pnpm unmet-deps fixture package.json.
fixtures/pnpm/unmet/pnpm-lock.yaml	Adds pnpm unmet-deps fixture lockfile.
fixtures/pnpm/dev_deps/package.json	Adds pnpm dev-deps fixture package.json.
fixtures/pnpm/dev_deps/pnpm-lock.yaml	Adds pnpm dev-deps fixture lockfile.
.gitignore	Ignores node_modules in the repo.

Files not reviewed (4)

• fixtures/pnpm/dev_deps/pnpm-lock.yaml: Language not supported
• fixtures/pnpm/simple/pnpm-lock.yaml: Language not supported
• fixtures/pnpm/unmet/pnpm-lock.yaml: Language not supported
• fixtures/pnpm/workspaces/pnpm-lock.yaml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dr460nf1r3]

Integration tests all pass now. I have no idea how to add the pnpm binary to the manifest properly, so it currently pulls from GitHub.

[Vo1dSh4d0w]

LGTM

[bvincent]

Thanks @dr460nf1r3 for this PR! Do you have any plans to review and merge pnpm support @Gerg @ForestEckhardt @arjun024 @robdimsdale?

Given pnpm is now the most downloaded package manager after npm, it would be great to see this land 🙏

[mperumalswamy]

Great to look that pnpm is finally coming as support. Any timeline when this would be landed?

[maximilianstoehrdmde]

+1, we need to switch to pnpm (or yarn > 1.x) for security reasons

[tommaroh]

Given recent security issues in NPM landscape, this is quite urgent for many of us. What still needs to happen to get this merged in?

[mperumalswamy]

@tnikolova82

[ivanovac]

@dr460nf1r3
Thank you for the contribution and for flagging the urgency — we understand the motivation, especially given the security landscape around npm. However, merging this PR requires work across multiple repositories, not just this one.

On the PR itself: there are several issues that need to be addressed before merge:

• cflinuxfs5 is missing from the manifest, while cflinuxfs3 is deprecated and scheduled for removal
• the pnpm binary is referenced directly from GitHub instead of being hosted in the CF buildpacks S3 bucket (which breaks offline/air-gapped deployments)
• InstallPNPM() has fragile fallback logic tied to that non-standard distribution format
• the Manifest interface was extended without updating mocks
• unit tests for the new code.

More importantly, the buildpack alone is not sufficient. The binary-builder library needs a new PnpmRecipe so pnpm artifacts can be compiled and packaged consistently, and the buildpacks-ci dependency build pipeline needs a pnpm entry in config.ym so new pnpm versions are automatically detected, built, uploaded to S3, and PRs are opened against this buildpack — exactly how yarn and all other dependencies are managed today. Without this pipeline work, every pnpm version bump would require manual intervention, which is unsustainable.

The path to merge is: adding the pnpm recipe to binary-builder, adding the pipeline entry to buildpacks-ci, fixing the issues in this PR to align with the standard distribution model the pipeline produces.

As you may or may not have noticed, there is a shortage of contributors willing to deep dive into the CF buildpacks community. The current contributors are working on community priorities, which may lead to delays in some features — pnpm support being one of them.