npm -> pnpm

math-tutor/README.md

@@ -33,7 +33,8 @@ Frontend (Vite):
 
 ``` powershell
 cd math-tutor/frontend
-npm install
+corepack enable
+pnpm install --frozen-lockfile
 ```
 
 ## Run the app
@@ -50,7 +51,7 @@ Frontend (Vite):
 
 ```powershell
 cd math-tutor/frontend
-npm run dev
+pnpm run dev
 ```
 
 ### Task Deep Links
@@ -75,9 +76,22 @@ Add the frontend- and backend-adress in the `backend/.env`-file in the frontend-
 
 ```powershell
 python -m uvicorn app.main:app --reload --host 0.0.0.0 --port 8000
-npm run dev -- --host 0.0.0.0
+pnpm run dev -- --host 0.0.0.0
 ```
 
+### Frontend package manager policy (pnpm)
+
+- Required versions:
+  - Node.js: 22.x or newer
+  - pnpm: pinned via `math-tutor/frontend/package.json` (`packageManager`)
+- Lockfile policy:
+  - Commit `pnpm-lock.yaml`.
+  - Use `pnpm install --frozen-lockfile` in local CI-like checks and Docker builds.
+- Install-script policy (strict):
+  - Dependency build/install scripts are allowlisted.
+  - After adding/updating dependencies, run `pnpm approve-builds` and review what is allowed.
+  - Check blocked scripts with `pnpm ignored-builds`.
+
 ### Vite Proxy (Development)
 
 The frontend now supports a dev proxy for API calls:

math-tutor/frontend/Dockerfile

@@ -2,11 +2,13 @@ FROM node:22-alpine AS build
 
 WORKDIR /app
 
-COPY package*.json ./
-RUN npm ci
+RUN corepack enable
+
+COPY package.json pnpm-lock.yaml ./
+RUN pnpm install --frozen-lockfile
 
 COPY . .
-RUN npm run build
+RUN pnpm run build
 
 FROM nginx:1.27-alpine
 

math-tutor/frontend/package.json

@@ -3,6 +3,7 @@
   "private": true,
   "version": "0.0.0",
   "type": "module",
+  "packageManager": "pnpm@10.30.3",
   "scripts": {
     "dev": "vite",
     "build": "tsc -b && vite build",
@@ -32,5 +33,8 @@
   },
   "overrides": {
     "vite": "npm:rolldown-vite@7.2.5"
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": []
   }
 }