chore: migrate from yarn to pnpm and tighten dependabot policy

- Switch package manager to pnpm 10.33.4: regenerate the lockfile, update
  package.json scripts, justfile, release.mjs, README, and CLAUDE.md.
- Use the hoisted node-modules layout via .npmrc to preserve the resolution
  behavior the project relied on under yarn's nodeLinker: node-modules.
- Replace yarn with pnpm in the nix flake's dev shell.
- Update CI workflows to use pnpm/action-setup and pnpm install
  --frozen-lockfile.
- Run dependabot weekly instead of daily and require a 7-day cooldown on
  any update.

.github/dependabot.yml

@@ -3,7 +3,12 @@ updates:
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+      semver-major-days: 7
+      semver-minor-days: 7
+      semver-patch-days: 7
     groups:
       all-dependencies:
         patterns:
@@ -13,6 +18,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     groups:
       all-actions:
         patterns:

.github/workflows/build.yml

@@ -14,18 +14,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
           node-version: "24.x"
+          cache: "pnpm"
       - name: Build plugin
         run: |
-          yarn install --immutable
-          yarn build
+          pnpm install --frozen-lockfile
+          pnpm build
       - name: Fail if build modified files
         run: |
           if [ -n "$(git status --porcelain)" ]; then
-            echo "Build modified files. Commit the output of 'yarn build'."
+            echo "Build modified files. Commit the output of 'pnpm build'."
             git status --porcelain
             exit 1
           fi

.github/workflows/publish.yml

@@ -14,18 +14,21 @@ jobs:
       artifact-metadata: write
     steps:
       - uses: actions/checkout@v6
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
       - name: Use Node.js
         uses: actions/setup-node@v6
         with:
           node-version: "24.x"
+          cache: "pnpm"
       - name: Build plugin
         run: |
-          yarn install --immutable
-          yarn build
+          pnpm install --frozen-lockfile
+          pnpm build
       - name: Fail if build modified files
         run: |
           if [ -n "$(git status --porcelain)" ]; then
-            echo "Build modified files. Commit the output of 'yarn build'."
+            echo "Build modified files. Commit the output of 'pnpm build'."
             git status --porcelain
             exit 1
           fi

.gitignore

@@ -7,10 +7,6 @@
 
 # npm
 node_modules
-/.yarn/cache
-/.yarn/unplugged
-/.yarn/build-state.yml
-/.yarn/install-state.gz
 
 # Don't include the compiled main.js and styles.css in the repo.
 # They should be uploaded to GitHub releases instead.

.npmrc

@@ -1 +1,2 @@
-tag-version-prefix=""
+tag-version-prefix=""
+node-linker=hoisted

.yarnrc

@@ -1,2 +0,0 @@
-version-tag-prefix ""
-yarn-path ".yarn/releases/yarn-4.12.0.cjs"

.yarnrc.yml

@@ -1,2 +0,0 @@
-nodeLinker: node-modules
-yarnPath: .yarn/releases/yarn-4.12.0.cjs

CLAUDE.md

@@ -29,22 +29,22 @@ If you're using the Nix development environment (via `nix develop` or direnv), u
 - `just release` - Full release (version, push, tags)
 - `just tag-release` - Tag release (after release command)
 
-### Yarn Commands (Alternative)
+### pnpm Commands (Alternative)
 
 ## Build Commands
 
-- `yarn dev` - Development build
-- `yarn dev:watch` - Development build with watch mode
-- `yarn prod` - Production build without tests or type checking
-- `yarn typecheck` — TypeScript typecheck
-- `yarn format` - Format code with Prettier
-- `yarn lint` - Check code style with ESLint
-- `yarn test` - Run Jest tests
-- `yarn test:dev` - Run development build and then tests
-- `yarn test:watch` - Run development build and then tests in watch mode
-- `yarn build` - Production build (includes tests, typecheck and formatting)
-- `yarn build:css` - Minify CSS with CSSO (from src/styles.src.css to styles.css)
-- `yarn version` - Bump version in manifest.json and versions.json
+- `pnpm dev` - Development build
+- `pnpm dev:watch` - Development build with watch mode
+- `pnpm prod` - Production build without tests or type checking
+- `pnpm typecheck` — TypeScript typecheck
+- `pnpm format` - Format code with Prettier
+- `pnpm lint` - Check code style with ESLint
+- `pnpm test` - Run Jest tests
+- `pnpm test:dev` - Run development build and then tests
+- `pnpm test:watch` - Run development build and then tests in watch mode
+- `pnpm build` - Production build (includes tests, typecheck and formatting)
+- `pnpm build:css` - Minify CSS with CSSO (from src/styles.src.css to styles.css)
+- `pnpm version` - Bump version in manifest.json and versions.json
 
 ## Tools
 
@@ -52,7 +52,7 @@ If you're using the Nix development environment (via `nix develop` or direnv), u
 
 ## General guidelines
 
-- IMPORTANT: After finishing your task, make sure to run `just build` (if using Nix/Just) or `yarn build` and fix any introduced issues.
+- IMPORTANT: After finishing your task, make sure to run `just build` (if using Nix/Just) or `pnpm build` and fix any introduced issues.
 - IMPORTANT: Commit any source file changes from the build (e.g., formatting). Do not commit generated files (`main.js`, `styles.css`) - they are gitignored and uploaded to GitHub releases instead.
 - IMPORTANT: On finishing your task, make sure the README.md file is up to date with regards to the new features, usage, and development.
 - IMPORTANT: Always try to extract testable logic that can be independent of Obsidian plugins to separate classes or functions and write unit tests for it.
@@ -62,9 +62,9 @@ If you're using the Nix development environment (via `nix develop` or direnv), u
 
 - Strict null checks required (strictNullChecks: true)
 - No implicit any values (noImplicitAny: true)
-- Run type check with `yarn typecheck`
+- Run type check with `pnpm typecheck`
 - ESLint is configured with typescript-eslint plugin
-- Testing is done with Jest (`yarn test:dev`); make sure to always run the build before running the tests (`yarn test:dev` already takes care of that)
+- Testing is done with Jest (`pnpm test:dev`); make sure to always run the build before running the tests (`pnpm test:dev` already takes care of that)
 - All tests are in the `__tests__` directory
 - Test files should end with `.test.ts`
 
@@ -81,8 +81,8 @@ If you're using the Nix development environment (via `nix develop` or direnv), u
 - Use consistent indentation (tabs) and spacing
 - Class methods order: lifecycle methods first, then functionality
 - Any text in UI elements should use "Sentence case" instead of "Title Case"
-- Avoid committing changes in `yarn.lock` if you didn't change the `package.json` file, reset the `yarn.lock` file instead
-- Avoid committing package-lock.json, since we use yarn; if this file is created as a result of your actions, remove it
+- Avoid committing changes in `pnpm-lock.yaml` if you didn't change the `package.json` file, reset the `pnpm-lock.yaml` file instead
+- Avoid committing `package-lock.json` or `yarn.lock`, since we use pnpm; if either is created as a result of your actions, remove it
 - **Create separate files for new classes**: As a rule, add new classes as separate files unless they are tightly coupled to existing code
 
 ## CSS Best Practices

README.md

@@ -177,61 +177,61 @@ just lint
 just lint-css
 ```
 
-### Using Yarn Directly
+### Using pnpm Directly
 
 Run the development build with change watch:
 
 ```shell
-yarn dev:watch
+pnpm dev:watch
 ```
 
 Run the TypeScript type check:
 
 ```shell
-yarn typecheck
+pnpm typecheck
 ```
 
 Run the linter:
 
 ```shell
-yarn lint
+pnpm lint
 ```
 
 Run the CSS linter:
 
 ```shell
-yarn lint:css
+pnpm lint:css
 ```
 
 Run the tests:
 
 ```shell
-yarn test
+pnpm test
 ```
 
 Run the tests in watch mode:
 
 ```shell
-yarn test:watch
+pnpm test:watch
 ```
 
 Generate a coverage report:
 
 ```shell
-yarn coverage
+pnpm coverage
 ```
 
 Run the production build (includes tests, type checking, and formatting):
 
 ```shell
-yarn build
+pnpm build
 ```
 
 Bump the version in `package.json` and `manifest.json`, push the `main` branch,
 and publish a new tag:
 
 ```shell
-yarn release -- <strategy|version>
+pnpm release -- <strategy|version>
 ```
 
 ## My other plugins

eslint.config.mjs

@@ -7,7 +7,6 @@ export default [
 	{
 		ignores: [
 			"**/node_modules/",
-			"**/.yarn/",
 			"**/main.js",
 			"src/__mocks__/**",
 			"eslint.config.mjs",

flake.nix

@@ -16,12 +16,12 @@
           buildInputs = with pkgs; [
             # Node.js and package manager
             nodejs_24
-            yarn
+            pnpm_10
 
             # Development tools
             just
             typescript
-            
+
             # Build tools
             esbuild
 
@@ -32,7 +32,7 @@
           shellHook = ''
             echo "🚀 Obsidian YouTrack Fetcher development environment"
             echo "📦 Node.js $(node --version)"
-            echo "🧶 Yarn $(yarn --version)"
+            echo "📦 pnpm $(pnpm --version)"
             echo "⚡ TypeScript $(tsc --version)"
             echo ""
             echo "Available commands:"

justfile

@@ -13,69 +13,69 @@ clean:
 
 # Install dependencies
 install:
-    yarn install
+    pnpm install
 
 # Full production build (typecheck, lint, format, build, test)
 build:
-    yarn build
+    pnpm build
 
 # Development build
 dev:
-    yarn dev
+    pnpm dev
 
 # Development build with watch mode
 watch:
-    yarn dev:watch
+    pnpm dev:watch
 
 # Production build without tests
 prod:
-    yarn prod
+    pnpm prod
 
 # Run TypeScript type checking
 typecheck:
-    yarn typecheck
+    pnpm typecheck
 
 # Run tests
 test:
-    yarn test
+    pnpm test
 
 # Run tests in development mode
 test-dev:
-    yarn test:dev
+    pnpm test:dev
 
 # Run tests in watch mode
 test-watch:
-    yarn test:watch
+    pnpm test:watch
 
 # Run tests with coverage
 coverage:
-    yarn coverage
+    pnpm coverage
 
 # Run ESLint
 lint:
-    yarn lint
+    pnpm lint
 
 # Run Stylelint on CSS sources
 lint-css:
-    yarn lint:css
+    pnpm lint:css
 
 # Format code with Prettier
 format:
-    yarn format
+    pnpm format
 
 # Build CSS from source
 build-css:
-    yarn build:css
+    pnpm build:css
 
 # Bump version
 version VERSION:
-    yarn version --immediate {{VERSION}}
-    yarn run version
+    npm version --no-git-tag-version {{VERSION}}
+    pnpm run version
 
 # Full release (version, push, tags)
 release VERSION:
-    yarn release {{VERSION}}
+    pnpm release {{VERSION}}
 
 # Tag release (after release command)
 tag-release:
-    yarn tag-release
+    pnpm tag-release

package.json

@@ -10,12 +10,12 @@
 		"typecheck": "tsc -noEmit -skipLibCheck",
 		"format": "prettier --write .",
 		"test": "jest",
-		"test:dev": "yarn dev && jest",
-		"test:watch": "yarn dev && jest --watch",
-		"coverage": "yarn dev && jest --coverage",
+		"test:dev": "pnpm dev && jest",
+		"test:watch": "pnpm dev && jest --watch",
+		"coverage": "pnpm dev && jest --coverage",
 		"lint": "eslint .",
 		"lint:css": "stylelint \"src/**/*.css\"",
-		"build": "yarn typecheck && yarn lint && yarn lint:css && yarn format && yarn prod && yarn test",
+		"build": "pnpm typecheck && pnpm lint && pnpm lint:css && pnpm format && pnpm prod && pnpm test",
 		"version": "node version-bump.mjs && git add manifest.json versions.json",
 		"build:css": "esbuild src/styles.src.css --loader:.css=css --minify --outfile=styles.css",
 		"release": "node release.mjs",
@@ -57,5 +57,11 @@
 		"typescript": "^6.0.3",
 		"typescript-eslint": "^8.59.4"
 	},
-	"packageManager": "yarn@4.12.0"
+	"packageManager": "pnpm@10.33.4",
+	"pnpm": {
+		"onlyBuiltDependencies": [
+			"esbuild",
+			"unrs-resolver"
+		]
+	}
 }

release.mjs

@@ -3,7 +3,7 @@ import { execFileSync } from "node:child_process";
 const [versionArg] = process.argv.slice(2).filter(arg => arg !== "--");
 
 if (!versionArg) {
-	console.error("Release version or strategy is required. Example: yarn release -- patch");
+	console.error("Release version or strategy is required. Example: pnpm release -- patch");
 	process.exit(1);
 }
 
@@ -12,8 +12,8 @@ const run = (command, args) => {
 };
 
 try {
-	run("yarn", ["version", "--immediate", versionArg]);
-	run("yarn", ["run", "version"]);
+	run("npm", ["version", "--no-git-tag-version", versionArg]);
+	run("pnpm", ["run", "version"]);
 
 	const version = execFileSync("node", ["-p", "require('./package.json').version"], {
 		encoding: "utf8",