Have been looking at pnpm as a solution for the mess that is js dependencies. One significant plus is that it completely removes all individual package-lock.json files, replacing instead with an easier-to-read top-level yaml file.
The migration is ... challenging, esp with CI considerations. But the benefit is real. No more package-lock.json files in diff review...pretty nice.
Anyway one haunted issue I came across was apps that use chronik-client being built in CI and not being able to find long. Specifying it here "should" help that.