build(deps): Migrate from npm to pnpm and bump deps

.github/workflows/build-ui.yml

@@ -22,47 +22,57 @@ jobs:
         runs-on: ubuntu-22.04
         steps:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+            # Installs the pnpm version pinned in package.json's packageManager.
+            - name: Use pnpm
+              uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+              with:
+                  package_json_file: webapp/package.json
             - name: Use Node.js
               uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
               with:
                   node-version: "${{ env.NODE_VERSION }}"
-                  cache: "npm"
-                  cache-dependency-path: webapp/package-lock.json
+                  cache: "pnpm"
+                  cache-dependency-path: webapp/pnpm-lock.yaml
             - name: Install dependencies
               working-directory: ./webapp
-              run: npm ci
+              run: pnpm install --frozen-lockfile
             - name: Build
               working-directory: ./webapp
-              run: npm run build
+              run: pnpm run build
             - name: Unit tests (vitest)
               working-directory: ./webapp
-              run: npm run test:run
+              run: pnpm run test:run
             - name: Lint
               working-directory: ./webapp
-              run: npm run lint
+              run: pnpm run lint
             - name: Check formatting with Prettier
               working-directory: ./webapp
-              run: npm run format:check
+              run: pnpm run format:check
 
     e2e-ui:
         runs-on: ubuntu-22.04
         steps:
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+            # Installs the pnpm version pinned in package.json's packageManager.
+            - name: Use pnpm
+              uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+              with:
+                  package_json_file: webapp/package.json
             - name: Use Node.js
               uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
               with:
                   node-version: "${{ env.NODE_VERSION }}"
-                  cache: "npm"
-                  cache-dependency-path: webapp/package-lock.json
+                  cache: "pnpm"
+                  cache-dependency-path: webapp/pnpm-lock.yaml
             - name: Install dependencies
               working-directory: ./webapp
-              run: npm ci
+              run: pnpm install --frozen-lockfile
             - name: Install Playwright browsers
               working-directory: ./webapp
-              run: npx playwright install --with-deps chromium
+              run: pnpm exec playwright install --with-deps chromium
             - name: Run Playwright tests (mock mode, no backend)
               working-directory: ./webapp
-              run: npm run test:e2e
+              run: pnpm run test:e2e
             - name: Upload Playwright report
               if: failure()
               uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4

docs/how-to/agent-instructions.md

@@ -50,7 +50,7 @@ Here's what you need to know to navigate and contribute effectively.
 ### Prerequisites
 - Python 3.7+ (preferably 3.11+)
 - uv (Python project manager): `curl -LsSf https://astral.sh/uv/install.sh | sh`
-- Node.js & pnpm (for webapp): `npm install -g pnpm` or `curl -fsSL https://get.pnpm.io/install.sh | sh -`
+- Node.js 24+ and pnpm (for webapp): `corepack enable` installs the pinned pnpm
 - Docker (for API development)
 
 ### Quick Start

docs/how-to/contributing.md

@@ -640,6 +640,22 @@ CODECARBON_API_URL="https://api.codecarbon.io"
 PORT="8000"
 ```
 
+<!-- TOC --><a name="webapp"></a>
+#### Webapp
+
+The React webapp is deployed by `.github/workflows/deploy.yml`, as a Node.js
+application built from the `webapp/` folder with pnpm. The pnpm version comes
+from the `packageManager` field of `webapp/package.json`.
+
+Config on CleverCloud:
+
+```sh
+APP_FOLDER="webapp"
+CC_NODE_VERSION="24"
+CC_NODE_BUILD_TOOL="pnpm"
+CC_BUILD_COMMAND="corepack pnpm install --frozen-lockfile && corepack pnpm run build"
+```
+
 
 ## Questions or Need Help?
 

webapp/.env.development

@@ -1,4 +1,4 @@
-# Local dev defaults. Loaded automatically by Vite on `npm run dev`.
+# Local dev defaults. Loaded automatically by Vite on `pnpm dev`.
 # Override per-developer with `.env.development.local` (gitignored).
 
 # Empty VITE_API_URL → the mock fetch interceptor catches every

webapp/.gitignore

@@ -41,3 +41,4 @@ next-env.d.ts
 
 # Enviroenment variables
 .env
+package-lock.json

webapp/AGENTS.md

@@ -35,7 +35,10 @@ than assuming either way.
 
 React 19 + Vite + TypeScript, Tailwind v4, Radix primitives, SWR for fetching,
 Zod for response schemas, `sonner` for toasts, `react-router-dom` v7. `pnpm` is
-the package manager, Node 24 in CI. `@/` resolves to `src/`.
+the package manager on Node 24, for the supply-chain settings in
+`pnpm-workspace.yaml`. CI and the deployment install with
+`pnpm install --frozen-lockfile`, so commit `pnpm-lock.yaml` and never a
+`package-lock.json`; never install with npm. `@/` resolves to `src/`.
 
 ## Layout
 
@@ -189,10 +192,12 @@ decision, not the syntax.
 ## Commands
 
 ```bash
+pnpm install        # install, updating pnpm-lock.yaml if package.json changed
 pnpm dev            # dev server on http://localhost:3000
 pnpm test:run       # unit tests once (pnpm test watches)
 pnpm test:e2e       # Playwright
 pnpm lint           # eslint
 pnpm format         # prettier --write (4-space indent, from .prettierrc)
-npx tsc --noEmit    # typecheck
+pnpm exec tsc --noEmit  # typecheck
+pnpm build          # what the deployment runs, after a frozen install
 ```

webapp/Dockerfile

@@ -1,12 +1,11 @@
 FROM node:24-alpine@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS build
-ENV PNPM_HOME="/pnpm"
-ENV PATH="$PNPM_HOME/bin:$PATH"
+# Corepack installs the pnpm version pinned in package.json's packageManager.
 RUN corepack enable
 WORKDIR /app
-COPY package.json pnpm-lock.yaml ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 RUN pnpm install --frozen-lockfile
 COPY . .
-RUN pnpm build
+RUN pnpm run build
 
 FROM nginx:1.27-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10
 COPY --from=build /app/dist /usr/share/nginx/html

webapp/README.md

@@ -6,8 +6,9 @@ Welcome to the Code Carbon Project! This README will guide you through the proce
 
 Before you begin, ensure you have the following installed on your system:
 
--   Node.js (version 14 or later)
--   pnpm (better alternative to npm)
+-   Node.js 24 or later
+-   pnpm — run `corepack enable` (bundled with Node 24) to get the exact version
+    pinned in `package.json`, or see https://pnpm.io/installation
 -   Git
 
 ## Getting Started
@@ -55,5 +56,17 @@ In the project directory, you can run:
 
 -   `pnpm dev`: Runs the app in development mode
 -   `pnpm build`: Builds the app for production
--   `pnpm start`: Runs the built app in production mode
+-   `pnpm preview`: Serves the production build locally
 -   `pnpm lint`: Runs the linter to check for code style issues
+-   `pnpm test:run`: Runs the unit tests once
+
+## Dependencies
+
+We use pnpm rather than npm for its supply-chain safeguards, set in
+`pnpm-workspace.yaml`: dependencies may not run install scripts unless
+allow-listed, and versions published less than 7 days ago are not installed.
+
+`pnpm-lock.yaml` is the only lockfile — commit it with every dependency change
+and never add a `package-lock.json`. CI and the production build (Clever Cloud,
+see the contributing guide) both install with
+`pnpm install --frozen-lockfile`, which fails if the lockfile is out of date.