chore: switch package manager from pnpm to yarn

[fengmk2]

Problem

Switch the package manager from pnpm to yarn (berry), using the node-modules linker.

Fix

• package.json: set packageManager to yarn@4.17.0; migrate the vite alias from pnpm overrides to yarn resolutions
• Add .yarnrc.yml with nodeLinker: node-modules and npmPreapprovedPackages (mirrors the former pnpm minimumReleaseAgeExclude, since yarn 4.17 otherwise quarantines the freshly published vite-plus packages via its 24h minimum-release-age gate)
• Remove pnpm-lock.yaml and pnpm-workspace.yaml, add yarn.lock
• .gitignore: ignore yarn berry artifacts (.yarn/*, .pnp.*)
• CodSpeed workflow: use setup-vp instead of pnpm
• CLAUDE.md: update command examples to the vp workflow

Vite+ (vp) auto-detects yarn from the packageManager field. release.yml keeps npm publish (npm OIDC trusted publishing, independent of the dev package manager).

Note: this branch also carries the earlier chore: remove vitest deps commits. It is an alternative to #833 (npm).

Verification

• vp install succeeds; vite resolves to @voidzero-dev/vite-plus-core@0.2.1; node_modules/ populated (node-modules linker, no PnP files)
• vp check passes (74 files), vp dedupe --check exits 0
• vp test run test/options.timeout.test.ts passes

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 093ac177-ba2c-41f6-92e8-b29e0acf431c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch switch-to-yarn

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vite@​0.2.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm node-forge is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/selfsigned@3.0.1 → npm/node-forge@1.4.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/node-forge@1.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/node-modules/urllib@834

commit: 3ece908

[gemini-code-assist]

Code Review

This pull request migrates the project's package manager from pnpm to Yarn Berry (v4.17.0). The changes include updating configuration files, adding Yarn-specific ignore rules to .gitignore, setting up .yarnrc.yml, updating command documentation in CLAUDE.md, and removing the pnpm lockfile. Feedback on the changes highlights a critical issue in .yarnrc.yml where glob patterns are incorrectly used under npmPreapprovedPackages; Yarn Berry does not support wildcards for this setting, which will prevent the specified packages from bypassing the release age gate.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

In Yarn Berry, npmPreapprovedPackages expects exact package names (parsed as package idents) and does not support glob patterns or wildcards like @voidzero-dev/* or @vitest/*. Because of this, these patterns will not match the actual packages, and Yarn will still quarantine them if they are freshly published.

To resolve this, you can either:

1. List the exact package names (e.g., @voidzero-dev/vite-plus-core).
2. Disable the minimum release age check entirely by setting npmMinReleaseAge: 0 in .yarnrc.yml if that is acceptable for this repository.

npmMinReleaseAge: 0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.24%. Comparing base (f47ccbb) to head (3ece908).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #834   +/-   ##
=======================================
  Coverage   94.24%   94.24%           
=======================================
  Files          10       10           
  Lines         747      747           
  Branches      235      235           
=======================================
  Hits          704      704           
  Misses         40       40           
  Partials        3        3           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.