Switch from Yarn to npm

.devcontainer/devcontainer.json

@@ -36,7 +36,7 @@
     "source=copilot-config-${devcontainerId},target=/home/vscode/.copilot,type=volume",
     "source=shell-history-${devcontainerId},target=/home/vscode/.commandhistory,type=volume"
   ],
-  "postCreateCommand": "./init.sh && cd website && yarn playwright install chromium",
+  "postCreateCommand": "./init.sh && cd website && npx playwright install chromium",
   "postStartCommand": "bash /workspaces/${localWorkspaceFolderBasename}/.devcontainer/setup-git-signing.sh",
   "customizations": {
     "vscode": {

.devcontainer/dockerfile

@@ -34,21 +34,16 @@ RUN wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh \
     && ./dotnet-install.sh --channel 11.0 --install-dir /usr/share/dotnet \
     && ln -s /usr/share/dotnet/dotnet /usr/bin/dotnet
 
-# Install Node.js 24 (the version CI uses; Corepack is no longer bundled from Node.js 25 on)
+# Install Node.js 24 (the version CI uses)
 RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
     && apt-get install -y nodejs
 
-# Suppress Corepack's "about to download" prompt during yarn activation
-ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
-
-# Update npm, install GitHub Copilot CLI and Codex CLI, and enable Corepack so the
-# Yarn version from package.json's packageManager field is used
-RUN npm install -g npm@11.12.0 @openai/codex @github/copilot \
-    && corepack enable
+# Install GitHub Copilot CLI and Codex CLI
+RUN npm install -g @openai/codex @github/copilot
 
 # Install Playwright's OS dependencies for Chromium (version-independent apt packages).
 # The browser binary itself is downloaded in postCreateCommand so it matches the
-# Playwright version resolved from yarn.lock. DejaVu is the fallback font the visual
+# Playwright version resolved from package-lock.json. DejaVu is the fallback font the visual
 # regression baselines are rendered with.
 RUN apt-get update && npx -y playwright install-deps chromium \
     && apt-get install -y fonts-dejavu-core

.github/workflows/ci.yml

@@ -34,7 +34,7 @@ jobs:
       - name: Check for changes in website directory
         id: check-website
         run: |
-          changes=$(git diff --name-only HEAD~1 HEAD -- ./website)
+          changes=$(git diff --name-only HEAD~1 HEAD -- ./website ./src/Mocha/src/mocha-visualizer)
           if [[ -n "$changes" ]]; then
             echo "website_changes=true" >> $GITHUB_OUTPUT
           else
@@ -151,45 +151,44 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-          cache: "yarn"
-          cache-dependency-path: "website/yarn.lock"
+          cache: "npm"
+          cache-dependency-path: "website/package-lock.json"
 
-      - name: Cache Yarn Packages
+      - name: Cache Next.js Build Artifacts
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
-            website/.yarn/cache
             website/.next/cache
-          key: ${{ runner.os }}-yarn-${{ hashFiles('website/yarn.lock') }}
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('website/package-lock.json') }}
           restore-keys: |
-            ${{ runner.os }}-yarn-
+            ${{ runner.os }}-nextjs-
 
       - name: Install Packages
-        run: yarn --immutable --network-timeout 100000
+        run: npm ci
         working-directory: website
 
       - name: Install Playwright Chromium
-        run: yarn playwright install --with-deps chromium
+        run: npx playwright install --with-deps chromium
         working-directory: website
 
       - name: Format Check
-        run: yarn format:check
+        run: npm run format:check
         working-directory: website
 
       - name: Lint
-        run: yarn lint
+        run: npm run lint
         working-directory: website
 
       - name: Generate Agent Skills
-        run: yarn generate-agent-skills
+        run: npm run generate-agent-skills
         working-directory: website
 
       - name: Build
-        run: yarn build
+        run: npm run build
         working-directory: website
 
       - name: Visual Regression Tests
-        run: yarn test:visual
+        run: npm run test:visual
         working-directory: website
 
       - name: Upload Playwright Report
@@ -489,16 +488,13 @@ jobs:
         with:
           node-version: 24
 
-      - name: Enable corepack
-        run: corepack enable
-
       - name: Install dependencies
         working-directory: src/Nitro/CommandLine/src/npm/chillicream-nitro
-        run: yarn install --immutable
+        run: npm ci
 
       - name: Build
         working-directory: src/Nitro/CommandLine/src/npm/chillicream-nitro
-        run: yarn build
+        run: npm run build
 
       - name: Inject optionalDependencies
         working-directory: src/Nitro/CommandLine/src/npm/chillicream-nitro

.github/workflows/publish-website.yml

@@ -32,50 +32,50 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
-          cache: "yarn"
-          cache-dependency-path: "website/yarn.lock"
+          cache: "npm"
+          cache-dependency-path: "website/package-lock.json"
 
       - name: Cache Next.js Build Artifacts
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             website/.next/cache
-          key: ${{ runner.os }}-nextjs-${{ hashFiles('website/yarn.lock') }}-${{ github.sha }}
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('website/package-lock.json') }}-${{ github.sha }}
           restore-keys: |
-            ${{ runner.os }}-nextjs-${{ hashFiles('website/yarn.lock') }}-
+            ${{ runner.os }}-nextjs-${{ hashFiles('website/package-lock.json') }}-
             ${{ runner.os }}-nextjs-
 
       - name: Install Packages
-        run: yarn --immutable --network-timeout 100000
+        run: npm ci
         working-directory: website
 
       - name: Install Playwright Chromium
-        run: yarn playwright install --with-deps chromium
+        run: npx playwright install --with-deps chromium
         working-directory: website
 
       - name: Cache Optimized Images
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             website/public/_optimized
-          key: ${{ runner.os }}-optimized-images-${{ hashFiles('website/public/images/**', 'website/src/image-optimization/**', 'website/scripts/optimize-images.mjs', 'website/yarn.lock') }}
+          key: ${{ runner.os }}-optimized-images-${{ hashFiles('website/public/images/**', 'website/src/image-optimization/**', 'website/scripts/optimize-images.mjs', 'website/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-optimized-images-
 
       - name: Optimize Images
-        run: yarn optimize-images
+        run: npm run optimize-images
         working-directory: website
 
       - name: Generate Git Metadata
-        run: yarn generate-git-metadata
+        run: npm run generate-git-metadata
         working-directory: website
 
       - name: Generate Agent Skills
-        run: yarn generate-agent-skills
+        run: npm run generate-agent-skills
         working-directory: website
 
       - name: Build Website
-        run: yarn build
+        run: npm run build
         working-directory: website
         env:
           NEXT_PUBLIC_SITE_URL: "https://chillicream.com"

.github/workflows/release.yml

@@ -372,9 +372,6 @@ jobs:
           registry-url: ${{ vars.NPM_REGISTRY_URL }}
           scope: "@chillicream"
 
-      - name: 🧰 Enable corepack
-        run: corepack enable
-
       - name: 📥 Download all nitro binaries
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -410,8 +407,8 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          yarn install --immutable
-          yarn build
+          npm ci
+          npm run build
           npm version "$GIT_TAG" --no-git-tag-version --allow-same-version
           jq --arg v "$GIT_TAG" '
             .optionalDependencies = {

AGENTS.md

@@ -15,13 +15,15 @@ This file provides guidance to coding agents when working with this repository.
 
 ### Website
 
-Use `yarn` instead of `npm`.
+Use `npm`.
 
 ```bash
 cd website
-yarn
+npm ci
 ```
 
+Until [npm/cli#10059](https://github.com/npm/cli/pull/10059) ships in npm 11, `npm install-scripts approve` writes `allowScripts` entries that npm cannot match under the linked install strategy ([npm/cli#9939](https://github.com/npm/cli/issues/9939)), so add approvals by hand as `"<package>@<version>": true`.
+
 ### C# Source Code
 
 Builds report IDE code-style violations (`IDE*`) as build errors, the same as CI does. Fix every reported style error.

CONTRIBUTING.md

@@ -62,11 +62,11 @@ Core contributors will review your pull request and provide feedback.
 
 The easiest way to work on the platform is the [devcontainer](./.devcontainer/devcontainer.json). It has the .NET SDKs, Node.js, and all other tools pre-installed, and runs `init.sh` when it is created.
 
-To work outside the devcontainer, you will need the .NET SDK version from [global.json](./global.json) and Node.js. After cloning the repository, run `init.sh` (or `init.ps1` on Windows) from the repository root to restore .NET packages and install the website's [Yarn](https://yarnpkg.com/) dependencies.
+To work outside the devcontainer, you will need the .NET SDK version from [global.json](./global.json) and Node.js. After cloning the repository, run `init.sh` (or `init.ps1` on Windows) from the repository root to restore .NET packages and install the website's npm dependencies.
 
 [src/All.slnx](./src/All.slnx) is the root solution. More focused per-area solution files exist if you want to narrow in on a particular part of the platform. They're great when working with [VS Code](https://code.visualstudio.com/).
 
-The documentation is located in the `website` directory and can be started with `yarn dev` (served on port 3002).
+The documentation is located in the `website` directory and can be started with `npm run dev` (served on port 3002).
 
 ## How to Check the docs
 

init.ps1

@@ -1,5 +1,5 @@
 # Initialize a fresh checkout: restore .NET packages for the root solution, then
-# install the website's yarn dependencies.
+# install the website's npm dependencies.
 
 $ErrorActionPreference = 'Stop'
 
@@ -10,7 +10,7 @@ try {
 
     Push-Location website
     try {
-        & yarn
+        & npm ci
         if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
     }
     finally {

init.sh

@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
 
 # Initialize a fresh checkout: restore .NET packages for the root solution, then
-# install the website's yarn dependencies.
+# install the website's npm dependencies.
 
 set -euo pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 dotnet restore src/All.slnx
-(cd website && yarn)
+(cd website && npm ci)

src/HotChocolate/Core/test/Types.SpecVersion.Tests/node/.npmrc

@@ -1,2 +1,5 @@
-# 7 days
+allow-git=none
+allow-remote=none
+install-strategy=linked
 min-release-age=7
+strict-allow-scripts=true

src/HotChocolate/Core/test/Types.SpecVersion.Tests/node/package.json

@@ -3,5 +3,12 @@
   "dependencies": {
     "graphql-october-2021": "npm:graphql@16.8.2",
     "graphql-september-2025": "npm:graphql@16.13.2"
+  },
+  "devEngines": {
+    "packageManager": {
+      "name": "npm",
+      "onFail": "error",
+      "version": ">=11.18.0"
+    }
   }
 }

src/Mocha/src/mocha-visualizer/package.json

@@ -24,7 +24,7 @@
     "@fortawesome/free-solid-svg-icons": "^7.1.0",
     "@fortawesome/react-fontawesome": "^3.1.1",
     "@xyflow/react": "^12.10.0",
-    "elkjs": "^0.11.0",
+    "elkjs": "^0.11.0 || ^0.12.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
     "styled-components": "^6.0.0"

src/Nitro/CommandLine/src/npm/chillicream-nitro/.gitignore

@@ -1,11 +1,2 @@
-.yarn/*
-!.yarn/patches
-!.yarn/plugins
-!.yarn/releases
-!.yarn/sdks
-!.yarn/versions
-
 node_modules
 dist
-
-.pnp.*

src/Nitro/CommandLine/src/npm/chillicream-nitro/.npmrc

@@ -0,0 +1,5 @@
+allow-git=none
+allow-remote=none
+install-strategy=linked
+min-release-age=7
+strict-allow-scripts=true