chore: split workspace settings into policy, catalog, and task files (#17192)
* chore: move supply-chain settings to a protected config file Use the `include` setting from pnpm 12.15 to move the settings that decide what gets installed and what may run into .config/pnpm/security.yaml: allowBuilds, auditConfig, the minimumReleaseAge and trustPolicy settings, overrides, packageExtensions, patchedDependencies, patchesDir, and registries. pnpm-workspace.yaml delegates exactly that list, so no other file can define those settings. Patch paths are relative to the included file. pnpm 12.14 ignores `include` and would drop every moved setting, so the packageManager pin moves to 12.15.0. CODEOWNERS now names both workspace files, the pnpmfile, and the patches explicitly, and the CI path filters watch the new file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: move routine settings to a file without a code owner The catalog, the update settings, and the task-runner settings (pipelines, tasks, concurrencyGroups) move to .config/pnpm/routine.yaml, which CODEOWNERS leaves unowned. Because pnpm-workspace.yaml delegates only that list to the file, any other setting defined there fails with ERR_PNPM_SETTING_NOT_DELEGATED, so the file cannot be used to change the protected settings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: move the catalogs to their own file .config/pnpm/catalog.yaml owns `catalogs`, which covers the default catalog and any named catalog added later. Like routine.yaml, it has no code owner. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: name the protected file policies.yaml and give tasks their own file security.yaml becomes policies.yaml. The task-runner settings (pipelines, tasks, concurrencyGroups) move to tasks.yaml, and `update` joins the catalogs in catalog.yaml, since its ignoreDeps list holds back catalog entries. routine.yaml is gone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: move catalogMode and catalogPrune to catalog.yaml Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: keep the patch list next to the patches patchedDependencies and patchesDir move to __patches__/patches.yaml, so the entries name the patch files without a directory prefix and patchesDir is `.`. CODEOWNERS already covers __patches__/. The CI path filters that did not watch __patches__/ now watch patches.yaml, since they watched the patch list when it lived in pnpm-workspace.yaml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: move the patches to .config/pnpm/patches Every pnpm configuration file now lives under .config/pnpm, so each CI path filter watches `.config/pnpm/**` instead of listing the files. CODEOWNERS keeps the patches protected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Zoltan KochanandClaude Opus 5.5 authored and GitHub committed
1 parent
87636f932c
commit
82e235bacf
17 files changed
+653
-615
No files matched your search
@@ -0,0 +1,337 @@
|
||||
catalog:
|
||||
# @babel/core 8.x (and its plugins) require Node.js ^22.18.0 || >=24.11.0,
|
||||
# above pnpm's supported floor of Node.js >=22.13.
|
||||
'@babel/core': ^7.29.7
|
||||
'@babel/plugin-transform-explicit-resource-management': ^7.29.7
|
||||
'@commitlint/cli': ^21.2.4
|
||||
'@commitlint/config-conventional': ^21.2.4
|
||||
'@commitlint/prompt-cli': ^21.2.4
|
||||
'@cyclonedx/cyclonedx-library': 10.3.0
|
||||
'@emnapi/wasi-threads': 2.2.0
|
||||
'@eslint/js': ^10.0.1
|
||||
'@inquirer/prompts': ^8.7.4
|
||||
# Jest 30.5.0 breaks ESM package imports in the Jest runtime.
|
||||
'@jest/globals': 30.4.1
|
||||
'@npm/types': ^2.1.0
|
||||
'@pnpm/byline': ^1.0.0
|
||||
'@pnpm/colorize-semver-diff': ^2.0.0
|
||||
'@pnpm/exec': ^4.0.0
|
||||
'@pnpm/logger': '^1100.0.0'
|
||||
'@pnpm/meta-updater': 2.0.6
|
||||
'@pnpm/nopt': ^0.3.1
|
||||
'@pnpm/npm-package-arg': ^2.0.0
|
||||
'@pnpm/patch-package': 0.0.1
|
||||
'@pnpm/semver-diff': ^2.0.0
|
||||
'@pnpm/tabtab': ^0.5.4
|
||||
'@pnpm/tgz-fixtures': 0.0.0
|
||||
'@reflink/reflink': 0.1.19
|
||||
'@rushstack/worker-pool': 0.7.30
|
||||
'@stylistic/eslint-plugin': ^5.10.0
|
||||
'@tybys/wasm-util': 0.10.4
|
||||
'@types/adm-zip': ^0.6.0
|
||||
'@types/archy': 0.0.36
|
||||
'@types/cross-spawn': ^6.0.6
|
||||
'@types/fs-extra': ^11.0.4
|
||||
'@types/graceful-fs': ^4.1.9
|
||||
'@types/hosted-git-info': ^3.0.5
|
||||
'@types/ini': 4.1.1
|
||||
'@types/is-gzip': 2.0.2
|
||||
'@types/is-windows': ^1.0.2
|
||||
'@types/isexe': 2.0.4
|
||||
'@types/jest': ^30.0.0
|
||||
'@types/js-yaml': ^4.0.9
|
||||
'@types/libnpmpublish': ^11.2.0
|
||||
'@types/lodash.kebabcase': 4.1.9
|
||||
'@types/lodash.throttle': 4.1.9
|
||||
'@types/micromatch': ^4.0.10
|
||||
# Kept on 22.x to match pnpm's minimum supported Node.js version (>=22.13);
|
||||
# newer majors would type APIs that don't exist on the supported floor.
|
||||
'@types/node': ^22.19.19
|
||||
'@types/normalize-package-data': ^2.4.4
|
||||
'@types/normalize-path': ^3.0.2
|
||||
'@types/npm-registry-fetch': ^8.0.9
|
||||
'@types/object-hash': 3.0.6
|
||||
'@types/parse-json': ^7.0.0
|
||||
'@types/picomatch': ^4.0.3
|
||||
'@types/pnpm__byline': npm:@types/byline@^4.2.36
|
||||
'@types/proxyquire': ^1.3.31
|
||||
'@types/qrcode-terminal': ^0.12.2
|
||||
'@types/ramda': 0.32.0
|
||||
'@types/retry': ^0.12.5
|
||||
'@types/semver': 7.8.0
|
||||
'@types/spdx-expression-parse': 4.0.0
|
||||
'@types/ssri': ^7.1.5
|
||||
'@types/tar-stream': ^3.1.5
|
||||
'@types/touch': ^3.1.5
|
||||
'@types/validate-npm-package-name': ^4.0.2
|
||||
'@types/which': ^3.0.4
|
||||
'@types/write-file-atomic': ^4.0.3
|
||||
'@types/yarnpkg__lockfile': ^1.1.9
|
||||
'@types/yauzl': ^3.4.0
|
||||
'@types/zkochan__table': npm:@types/table@6.3.2
|
||||
'@typescript-eslint/utils': ^8.72.0
|
||||
'@typescript/native-preview': 7.0.0-dev.20260707.2
|
||||
'@webcontainer/api': ^1.6.4
|
||||
# @yarnpkg/core 4.9.2 was published with a Yarn `patch:` specifier for its
|
||||
# `got` dependency, which pnpm resolves to a nonexistent local path. The
|
||||
# `@yarnpkg/nm` override keeps its transitive copy on this version too.
|
||||
'@yarnpkg/core': 4.9.1
|
||||
'@yarnpkg/extensions': 2.0.7
|
||||
'@yarnpkg/fslib': ^3.1.5
|
||||
'@yarnpkg/lockfile': ^1.1.0
|
||||
'@yarnpkg/nm': 4.1.1
|
||||
'@yarnpkg/parsers': 3.1.0
|
||||
'@yarnpkg/pnp': ^4.1.7
|
||||
'@yarnpkg/shell': 4.1.3
|
||||
'@zkochan/retry': ^0.2.0
|
||||
'@zkochan/rimraf': ^4.0.0
|
||||
'@zkochan/table': ^2.0.1
|
||||
adm-zip: ^0.6.1
|
||||
agentkeepalive: ^4.6.0
|
||||
amaro: ^1.2.1
|
||||
ansi-diff: ^1.2.0
|
||||
archy: ^1.0.0
|
||||
better-path-resolve: 2.0.0
|
||||
# bin-links 7.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's
|
||||
# supported floor of Node.js >=22.13.
|
||||
bin-links: ^6.0.2
|
||||
# bole 6 is ESM-only. Under Jest, the workspace logger's ESM bole and the
|
||||
# published @pnpm/logger's CJS bole 5 land in different realms, so the
|
||||
# globalThis.$$bole output registry is no longer shared and log events
|
||||
# emitted through one logger copy never reach the other's streamParser.
|
||||
# Keep bole 5 until the published @pnpm/logger ships with bole 6.
|
||||
bole: ^5.0.29
|
||||
boxen: npm:@zkochan/boxen@5.1.2
|
||||
c8: ^12.0.0
|
||||
camelcase: ^10.0.0
|
||||
camelcase-keys: ^10.0.3
|
||||
can-link: ^3.0.0
|
||||
can-write-to-dir: ^2.0.0
|
||||
chalk: ^6.0.1
|
||||
ci-info: ^4.4.0
|
||||
cli-truncate: ^6.1.1
|
||||
cmd-extension: ^2.0.0
|
||||
comver-to-semver: ^2.0.0
|
||||
cross-env: ^10.1.0
|
||||
cross-spawn: ^7.0.6
|
||||
# cspell 10.x requires Node.js >=22.18.0, above pnpm's supported floor of
|
||||
# Node.js >=22.13.
|
||||
cspell: 9.8.0
|
||||
deep-require-cwd: 1.0.0
|
||||
delay: ^7.0.0
|
||||
detect-indent: 7.0.2
|
||||
detect-libc: ^2.1.2
|
||||
didyoumean2: ^7.0.4
|
||||
dint: ^5.1.0
|
||||
dir-is-case-sensitive: ^3.0.0
|
||||
empathic: ^2.1.0
|
||||
esbuild: ^0.28.2
|
||||
escape-string-regexp: ^5.0.0
|
||||
eslint: ^10.13.0
|
||||
eslint-plugin-import-x: ^4.17.1
|
||||
eslint-plugin-jest: ^29.17.0
|
||||
eslint-plugin-n: ^18.5.0
|
||||
eslint-plugin-promise: ^7.3.0
|
||||
eslint-plugin-regexp: ^3.1.1
|
||||
eslint-plugin-simple-import-sort: ^14.0.0
|
||||
execa: npm:safe-execa@0.3.0
|
||||
exists-link: 2.0.0
|
||||
fast-deep-equal: ^3.1.3
|
||||
fast-glob: ^3.3.3
|
||||
fs-extra: ^11.4.1
|
||||
fuse-native: ^2.2.6
|
||||
# Bundled into the pnpm 12 wrapper's dist/ payload, where the Corepack entry
|
||||
# point loads it from; see pnpm/npm/pnpm/bin/pnpm.mjs.
|
||||
get-pnpm: ^0.0.5
|
||||
get-port: ^7.2.0
|
||||
ghooks: 2.0.4
|
||||
graceful-fs: ^4.2.11
|
||||
graph-cycles: 3.0.0
|
||||
hosted-git-info: npm:@pnpm/hosted-git-info@1.0.0
|
||||
http-proxy-agent: ^9.1.0
|
||||
https-proxy-agent: ^9.1.0
|
||||
https-proxy-server-express: 0.1.2
|
||||
husky: ^9.1.7
|
||||
hyperdrive-schemas: ^2.0.0
|
||||
# ini 7.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's
|
||||
# supported floor of Node.js >=22.13.
|
||||
ini: 6.0.0
|
||||
is-gzip: 2.0.0
|
||||
is-inner-link: ^5.0.0
|
||||
is-subdir: ^2.0.1
|
||||
is-windows: ^1.0.2
|
||||
isexe: 4.0.0
|
||||
jest: 30.4.2
|
||||
jest-diff: 30.4.1
|
||||
human-id: ^4.2.2
|
||||
js-yaml: npm:@zkochan/js-yaml@0.0.11
|
||||
json5: ^2.2.3
|
||||
keyv: 6.1.0
|
||||
lcov-result-merger: ^6.0.0
|
||||
# libnpmpublish 12.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above
|
||||
# pnpm's supported floor of Node.js >=22.13.
|
||||
libnpmpublish: ^11.2.0
|
||||
load-json-file: ^7.0.1
|
||||
lodash.kebabcase: ^4.1.1
|
||||
lodash.throttle: 4.1.1
|
||||
loud-rejection: ^2.2.0
|
||||
lru-cache: ^11.5.3
|
||||
make-empty-dir: ^4.0.0
|
||||
mdast-util-to-string: ^4.0.0
|
||||
memfs: ^4.80.0
|
||||
memoize: ^11.0.0
|
||||
micromatch: ^4.0.8
|
||||
msgpackr: 2.1.2
|
||||
nm-prune: ^5.0.0
|
||||
# node-gyp 13 (with its nopt 10 and which 7 dependencies) requires Node.js
|
||||
# ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's supported floor of >=22.13.
|
||||
node-gyp: ^12.3.0
|
||||
normalize-newline: 5.0.0
|
||||
# normalize-package-data 9.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0,
|
||||
# above pnpm's supported floor of Node.js >=22.13.
|
||||
normalize-package-data: ^8.0.0
|
||||
normalize-path: ^3.0.0
|
||||
normalize-registry-url: 2.0.1
|
||||
# npm-packlist 11.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above
|
||||
# pnpm's supported floor of Node.js >=22.13.
|
||||
npm-packlist: 10.0.4
|
||||
# npm-registry-fetch 20.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0,
|
||||
# above pnpm's supported floor of Node.js >=22.13.
|
||||
npm-registry-fetch: ^19.0.0
|
||||
object-hash: 3.0.0
|
||||
open: ^11.0.4
|
||||
openpgp: ^6.3.2
|
||||
'@openpgp/web-stream-tools': 0.3.1
|
||||
p-defer: ^4.0.1
|
||||
p-every: ^2.0.0
|
||||
p-filter: ^4.1.0
|
||||
p-limit: ^7.3.3
|
||||
p-queue: ^10.0.0
|
||||
parse-json: ^8.3.0
|
||||
path-absolute: ^2.0.0
|
||||
path-exists: ^5.0.0
|
||||
path-name: ^1.0.0
|
||||
path-temp: ^3.0.0
|
||||
pidtree: ^1.0.0
|
||||
playwright-core: ^1.64.1
|
||||
preferred-pm: ^5.0.1
|
||||
pretty-bytes: ^7.2.0
|
||||
pretty-ms: ^10.0.0
|
||||
promise-share: ^2.0.1
|
||||
proxy: ^4.1.0
|
||||
proxyquire: ^2.1.3
|
||||
ps-list: ^9.0.0
|
||||
qrcode-terminal: ^0.12.0
|
||||
ramda: npm:@pnpm/ramda@0.28.1
|
||||
read-ini-file: 5.0.0
|
||||
read-yaml-file: ^3.0.0
|
||||
realpath-missing: ^2.0.0
|
||||
remark-parse: ^11.0.0
|
||||
remark-stringify: ^11.0.0
|
||||
rename-overwrite: ^7.0.1
|
||||
render-help: ^2.0.0
|
||||
resolve-link-target: ^3.0.0
|
||||
rimraf: ^6.1.3
|
||||
root-link-target: ^4.0.0
|
||||
rxjs: ^7.8.2
|
||||
safe-buffer: 5.2.1
|
||||
safe-execa: ^0.3.0
|
||||
safe-promise-defer: ^2.0.0
|
||||
sanitize-filename: ^1.6.4
|
||||
seek-bzip: 2.0.0
|
||||
semver: ^7.8.5
|
||||
semver-range-intersect: ^0.3.1
|
||||
semver-utils: ^1.1.4
|
||||
shlex: ^3.0.0
|
||||
shx: ^0.4.0
|
||||
signal-exit: ^4.1.0
|
||||
socks: ^2.8.10
|
||||
socks-proxy-agent: ^10.1.0
|
||||
sort-keys: ^6.0.1
|
||||
spdx-expression-parse: 5.0.0
|
||||
split-cmd: ^1.1.0
|
||||
split2: ^4.2.0
|
||||
# ssri 14.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's
|
||||
# supported floor of Node.js >=22.13.
|
||||
ssri: 13.0.1
|
||||
stacktracey: ^2.2.0
|
||||
string-length: ^7.0.1
|
||||
string-width: ^8.3.0
|
||||
strip-bom: ^5.0.0
|
||||
strip-comments-strings: 1.2.0
|
||||
symlink-dir: ^10.0.3
|
||||
tar: ^7.5.22
|
||||
tar-stream: ^3.2.2
|
||||
# tempy >=3.1.0 uses temp-dir 3.x which has an async fs.realpath() in its
|
||||
# module init. When esbuild bundles this into its __esm lazy-init pattern,
|
||||
# the async operation deadlocks and the pnpm binary hangs on startup.
|
||||
tempy: 3.0.0
|
||||
terminal-link: ^5.0.0
|
||||
tinyglobby: ^0.2.17
|
||||
touch: 3.1.1
|
||||
tree-kill: ^1.2.2
|
||||
ts-jest-resolver: 2.0.1
|
||||
# Kept on 6.x because typescript-eslint does not support the TypeScript 7.0 API
|
||||
# yet (https://github.com/typescript-eslint/typescript-eslint/issues/10940); the
|
||||
# 7.x compiler ships separately as @typescript/native-preview (tsgo).
|
||||
typescript: 6.0.3
|
||||
typescript-eslint: ^8.72.0
|
||||
uid-number: 0.0.6
|
||||
# undici 8.x requires Node.js >=22.19.0, above pnpm's supported floor of
|
||||
# Node.js >=22.13.
|
||||
undici: ^7.29.1
|
||||
unified: ^11.0.5
|
||||
# validate-npm-package-name 8.x requires Node.js ^22.22.2 || ^24.15.0 ||
|
||||
# >=26.0.0, above pnpm's supported floor of Node.js >=22.13.
|
||||
validate-npm-package-name: 7.0.2
|
||||
version-selector-type: ^3.0.0
|
||||
vfile: ^6.0.3
|
||||
which: npm:@pnpm/which@^3.0.1
|
||||
# write-file-atomic 8.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0,
|
||||
# above pnpm's supported floor of Node.js >=22.13.
|
||||
write-file-atomic: ^7.0.1
|
||||
write-ini-file: 5.0.0
|
||||
write-json-file: ^7.0.0
|
||||
write-json5-file: ^4.0.0
|
||||
write-package: 7.2.0
|
||||
write-yaml-file: ^6.0.0
|
||||
yaml: ^2.9.1
|
||||
yaml-tag: 1.1.0
|
||||
yauzl: ^3.4.0
|
||||
enhanced-resolve: 5.26.0
|
||||
|
||||
catalogMode: strict
|
||||
|
||||
catalogPrune: true
|
||||
|
||||
# Dependencies deliberately held back, which `pnpm update --latest` (run by the
|
||||
# update-lockfile workflow) would otherwise bump. Most of them are packages
|
||||
# whose newer versions require a Node.js version above pnpm's supported floor
|
||||
# (>=22.13); the comment at each catalog entry above records the reason.
|
||||
# typescript is held on 6.x because typescript-eslint does not support the
|
||||
# TypeScript 7.0 API yet.
|
||||
update:
|
||||
ignoreDeps:
|
||||
- '@babel/core'
|
||||
- '@babel/plugin-transform-explicit-resource-management'
|
||||
- '@jest/globals'
|
||||
- '@types/node'
|
||||
- '@yarnpkg/core'
|
||||
- bin-links
|
||||
- bole
|
||||
- cspell
|
||||
- eslint-plugin-regexp
|
||||
- ini
|
||||
- jest
|
||||
- jest-diff
|
||||
- libnpmpublish
|
||||
- node-gyp
|
||||
- normalize-package-data
|
||||
- npm-packlist
|
||||
- npm-registry-fetch
|
||||
- ssri
|
||||
- tempy
|
||||
- typescript
|
||||
- undici
|
||||
- validate-npm-package-name
|
||||
- write-file-atomic
|
||||
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
@@ -0,0 +1,7 @@
|
||||
patchedDependencies:
|
||||
'@tybys/wasm-util@0.10.4': '@tybys__wasm-util@0.10.4.patch'
|
||||
graceful-fs@4.2.11: graceful-fs@4.2.11.patch
|
||||
normalize-registry-url@2.0.1: normalize-registry-url@2.0.1.patch
|
||||
unrs-resolver@1.12.2: unrs-resolver@1.12.2.patch
|
||||
|
||||
patchesDir: .
|
||||
File renamed without changes.
@@ -0,0 +1,170 @@
|
||||
allowBuilds:
|
||||
'@parcel/watcher': false
|
||||
core-js: false
|
||||
esbuild: true
|
||||
fuse-native: true
|
||||
ghooks: true
|
||||
msgpackr-extract: true
|
||||
unrs-resolver: true
|
||||
|
||||
auditConfig:
|
||||
ignoreGhsas:
|
||||
- GHSA-2g4f-4pwh-qvx6
|
||||
- GHSA-76c9-3jph-rj3q
|
||||
- GHSA-ffrw-9mx8-89p8
|
||||
- GHSA-mh29-5h37-fv8m
|
||||
- GHSA-w5hq-g745-h8pq
|
||||
# GHSA-vwc7-r8mq-g2x9: adm-zip follows pre-existing destination symlinks during
|
||||
# extraction. No patched adm-zip release exists. It is only a devDependency of
|
||||
# @pnpm/fetching.binary-fetcher, used to build zip fixtures, and never extracts.
|
||||
- GHSA-vwc7-r8mq-g2x9
|
||||
# GHSA-h67p-54hq-rp68: js-yaml quadratic-complexity DoS in merge key handling.
|
||||
# Patched only in >=4.1.2 with no v3 fix; @yarnpkg/parsers requires the js-yaml 3
|
||||
# API (yaml.safeLoad), so its transitive js-yaml cannot be upgraded.
|
||||
- GHSA-h67p-54hq-rp68
|
||||
# GHSA-vfj7-8cjw-p6xm: braces stack exhaustion on deeply nested patterns.
|
||||
# No patched braces release exists. pnpm expands patterns from the user's config
|
||||
# and command line, or from scripts and manifests of dependencies already allowed
|
||||
# to run code, so a crash gives an attacker nothing new.
|
||||
- GHSA-vfj7-8cjw-p6xm
|
||||
# GHSA-ch52-4w7c-c8xp: http-cache-semantics max-stale leaks other users'
|
||||
# responses from a shared cache. No patched release exists. make-fetch-happen
|
||||
# uses it for a private, single-user client cache, which has no other users.
|
||||
- GHSA-ch52-4w7c-c8xp
|
||||
# GHSA-hp3w-g68c-fv3c: sprintf-js DoS through unbounded precision specifiers.
|
||||
# No patched release exists. It is reached only through argparse 1, which
|
||||
# formats its own help text with it, never attacker-controlled formats.
|
||||
- GHSA-hp3w-g68c-fv3c
|
||||
|
||||
minimumReleaseAge: 1440 # At least a day
|
||||
|
||||
minimumReleaseAgeExclude:
|
||||
- '@pnpm/*'
|
||||
- '@zkochan/*'
|
||||
- better-path-resolve
|
||||
- can-link
|
||||
- can-write-to-dir
|
||||
- cmd-extension
|
||||
- comver-to-semver
|
||||
- dir-is-case-sensitive
|
||||
- '@esbuild/*'
|
||||
- glob@11.1.0
|
||||
- is-inner-link
|
||||
- is-subdir
|
||||
- make-empty-dir
|
||||
- normalize-registry-url
|
||||
- path-absolute
|
||||
- path-temp
|
||||
- pnpm
|
||||
- preferred-pm
|
||||
- promise-share
|
||||
- read-ini-file
|
||||
- read-yaml-file
|
||||
- realpath-missing
|
||||
- rename-overwrite
|
||||
- render-help
|
||||
- resolve-link-target
|
||||
- root-link-target
|
||||
- safe-execa
|
||||
- safe-promise-defer
|
||||
- symlink-dir
|
||||
- which-pm
|
||||
- write-ini-file
|
||||
- write-json5-file
|
||||
- write-yaml-file
|
||||
- http-proxy-middleware@3.0.7
|
||||
|
||||
minimumReleaseAgeExcludePrune: true
|
||||
|
||||
overrides:
|
||||
'@cypress/request@3.0.9>qs': ^6.14.1
|
||||
'@yarnpkg/fslib@2': '3'
|
||||
'@yarnpkg/nm>@yarnpkg/core': 'catalog:'
|
||||
adm-zip@<0.6.0: ^0.6.0
|
||||
ajv@>=7.0.0-alpha.0 <8.18.0: '>=8.18.0'
|
||||
body-parser@<2.2.1: '^2.2.1'
|
||||
brace-expansion@<5.0.5: '>=5.0.5'
|
||||
clipanion: 3.2.0-rc.6
|
||||
cookie@<0.7.0: '>=0.7.0'
|
||||
cross-spawn@<7.0.5: '>=7.0.5'
|
||||
debug@<3.1.0: '>=3.1.0'
|
||||
diff@<8.0.3: '^8.0.3'
|
||||
express@<4.22.1: ^4.22.1
|
||||
follow-redirects@<=1.15.5: '>=1.15.6'
|
||||
glob-parent@<5.1.2: '>=5.1.2'
|
||||
glob@>=10.3.7 <=11.0.3: '^11.1.0'
|
||||
handlebars@>=4.0.0 <4.7.9: '>=4.7.9'
|
||||
hosted-git-info@1: 'catalog:'
|
||||
istanbul-reports: npm:@zkochan/istanbul-reports
|
||||
js-yaml@<3.14.2: '^3.14.2'
|
||||
js-yaml@^4.0.0: 'catalog:'
|
||||
json5@<2.2.2: 'catalog:'
|
||||
jsonwebtoken@<=8.5.1: '>=9.0.0'
|
||||
jws@<3.2.3: '^3.2.3'
|
||||
lodash@<=4.17.23: '>=4.18.0'
|
||||
lodash@>=4.0.0 <=4.17.22: '^4.17.23'
|
||||
lodash@>=4.0.0 <=4.17.23: '>=4.18.0'
|
||||
minimatch@>=7.0.0 <7.4.7: '^7.4.7'
|
||||
minimatch@>=9.0.0 <10.0.0: '>=10.2.4'
|
||||
nopt@5: npm:@pnpm/nopt@^0.2.1
|
||||
on-headers@<1.1.0: '>=1.1.0'
|
||||
path-to-regexp@<0.1.13: ^0.1.13
|
||||
path-to-regexp@>=4.0.0 <6.3.0: '>=6.3.0'
|
||||
path-to-regexp@>=7.0.0 <8.0.0: '>=8.0.0'
|
||||
postman-request>qs: ^6.14.1
|
||||
qs@>=6.11.1 <=6.15.1: ^6.15.2
|
||||
request: npm:postman-request@2.88.1-postman.40
|
||||
semver@<7.5.2: 'catalog:'
|
||||
send@<0.19.0: ^0.19.0
|
||||
shell-quote@<1.8.4: '>=1.8.4'
|
||||
serve-static@<1.16.0: ^1.16.0
|
||||
# GHSA-w7jw-789q-3m8p / CVE-2026-9277: 1.8.4 patches critical shell-quote vulnerabilities in <=1.8.3.
|
||||
shell-quote: 1.8.4
|
||||
socks@2: ^2.8.1
|
||||
tar@<=7.5.9: '>=7.5.10'
|
||||
tmp@<=0.2.3: '>=0.2.4'
|
||||
tough-cookie@<4.1.3: '>=4.1.3'
|
||||
validator@<13.15.22: '>=13.15.22'
|
||||
yaml@<2.2.2: '>=2.2.2'
|
||||
http-proxy-middleware@>=0.16.0 <3.0.6: ^3.0.6
|
||||
deepmerge-ts@<8.0.0: ^8.0.0
|
||||
|
||||
packageExtensions:
|
||||
'@babel/parser':
|
||||
peerDependencies:
|
||||
'@babel/types': '*'
|
||||
# The shell's declarations import micromatch's, which it does not depend on.
|
||||
'@yarnpkg/shell':
|
||||
dependencies:
|
||||
'@types/micromatch': ^4.0.10
|
||||
jest-circus:
|
||||
dependencies:
|
||||
slash: '3'
|
||||
remark-parse:
|
||||
dependencies:
|
||||
vfile: ^6.0.0
|
||||
peerDependencies:
|
||||
unified: '*'
|
||||
remark-stringify:
|
||||
dependencies:
|
||||
vfile: ^6.0.0
|
||||
peerDependencies:
|
||||
unified: '*'
|
||||
|
||||
registries:
|
||||
https://registry.npmjs.org/:
|
||||
scopes:
|
||||
- '@pnpm'
|
||||
|
||||
trustPolicy: no-downgrade
|
||||
|
||||
trustPolicyExclude:
|
||||
- '@pnpm/*'
|
||||
- '@yarnpkg/libzip@3.2.2'
|
||||
- pnpm
|
||||
- rxjs@7.8.2
|
||||
- undici-types@6.21.0
|
||||
|
||||
trustPolicyExcludePrune: true
|
||||
|
||||
trustPolicyIgnoreAfter: 10080 # 1 week
|
||||
@@ -0,0 +1,95 @@
|
||||
# Every `ci:*` script lives in the root manifest only, so the workflows run
|
||||
# these pipelines with `--include-workspace-root --full`; the test runners do
|
||||
# their own package selection and file sharding. The workflows also pass
|
||||
# `--no-cache`: no task declares `outputs`, so none is cacheable today, and the
|
||||
# flag keeps a check from being skipped if one ever does.
|
||||
pipelines:
|
||||
ts-check: [ci:compile, ci:lint]
|
||||
# Named after the scripts they run: the test workflow passes one value as both
|
||||
# the pipeline name and the `TEST_SCRIPT` the chunk runner re-runs.
|
||||
ci:test-all: [ci:test-all]
|
||||
ci:test-branch: [ci:test-branch]
|
||||
ts-test-chunk: [ci:test-chunk]
|
||||
rust-test: [ci:rust-test]
|
||||
pnpr-test: [ci:pnpr-test]
|
||||
rust-clippy: [ci:rust-clippy]
|
||||
rust-doc: [ci:rust-doc]
|
||||
rust-deny: [ci:rust-deny]
|
||||
rust-format: [ci:rust-fmt, ci:toml-fmt]
|
||||
rust-dylint: [ci:rust-dylint]
|
||||
build-pnpr: [ci:build-pnpr]
|
||||
|
||||
# Every entry names a script the root manifest alone defines. A name a
|
||||
# workspace package also defines must not appear here: the entry would drop
|
||||
# that task's default `dependsOn: ['^<name>']` ordering, and each project's
|
||||
# run of it would take a slot of the group, serializing a recursive run.
|
||||
tasks:
|
||||
ci:compile:
|
||||
concurrencyGroup: typescript
|
||||
ci:lint:
|
||||
dependsOn: [ci:compile]
|
||||
concurrencyGroup: typescript
|
||||
ci:test-all:
|
||||
concurrencyGroup: typescript
|
||||
ci:test-branch:
|
||||
concurrencyGroup: typescript
|
||||
ci:test-chunk:
|
||||
concurrencyGroup: typescript
|
||||
test-all:
|
||||
concurrencyGroup: typescript
|
||||
test-branch:
|
||||
concurrencyGroup: typescript
|
||||
test-pkgs-all:
|
||||
concurrencyGroup: typescript
|
||||
test-pkgs-all-report-summary:
|
||||
concurrencyGroup: typescript
|
||||
test-pkgs-branch:
|
||||
concurrencyGroup: typescript
|
||||
build:pnpm:
|
||||
concurrencyGroup: cargo
|
||||
build:pnpm:wasm:
|
||||
concurrencyGroup: cargo
|
||||
build:wasm-runtime-probe:
|
||||
concurrencyGroup: cargo
|
||||
check:rust:
|
||||
concurrencyGroup: cargo
|
||||
fix:rust:
|
||||
concurrencyGroup: cargo
|
||||
lint:rust:
|
||||
concurrencyGroup: cargo
|
||||
pre-push:rust:
|
||||
concurrencyGroup: cargo
|
||||
priority: 10
|
||||
ready:rust:
|
||||
concurrencyGroup: cargo
|
||||
test:rust:
|
||||
concurrencyGroup: cargo
|
||||
test:rust-affected:
|
||||
concurrencyGroup: cargo
|
||||
test:rust-smoke:
|
||||
concurrencyGroup: cargo
|
||||
ci:build-pnpr:
|
||||
concurrencyGroup: cargo
|
||||
ci:pnpr-test:
|
||||
concurrencyGroup: cargo
|
||||
ci:rust-clippy:
|
||||
concurrencyGroup: cargo
|
||||
outputs: []
|
||||
env: [RUSTFLAGS]
|
||||
ci:rust-doc:
|
||||
concurrencyGroup: cargo
|
||||
outputs: []
|
||||
env: [RUSTFLAGS, RUSTDOCFLAGS]
|
||||
ci:rust-dylint:
|
||||
concurrencyGroup: cargo
|
||||
ci:rust-test:
|
||||
concurrencyGroup: cargo
|
||||
|
||||
# The repository is checked out into many worktrees at once, and a second
|
||||
# Rust build or TypeScript test run on the same machine only takes cores and
|
||||
# memory from the first. The TypeScript test scripts also share the
|
||||
# `../pnpm_tmp` scratch directory across worktrees, which one of them wipes
|
||||
# on startup. A task past the limit waits for a slot instead of starting.
|
||||
concurrencyGroups:
|
||||
cargo: 1
|
||||
typescript: 1
|
||||
@@ -6,3 +6,14 @@
|
||||
/pnpm11/reviewing/license-scanner/* @weyert
|
||||
/pnpm11/reviewing/plugin-commands-licenses/* @weyert
|
||||
/pnpm11/hooks/* @d3lm
|
||||
|
||||
# Supply-chain settings and code that runs on install
|
||||
/pnpm-workspace.yaml @zkochan
|
||||
/.config/pnpm/policies.yaml @zkochan
|
||||
/.pnpmfile.cjs @zkochan
|
||||
/.config/pnpm/patches/ @zkochan
|
||||
|
||||
# No code owner: pnpm-workspace.yaml lets these files define only the
|
||||
# catalog settings, the update settings, and the task-runner settings.
|
||||
/.config/pnpm/catalog.yaml
|
||||
/.config/pnpm/tasks.yaml
|
||||
@@ -38,7 +38,7 @@ test('PR scope stays pinned when main advances; global changes and missing bases
|
||||
assert.equal(scope().full_tests, 'false', 'TS code plus release notes remain affected')
|
||||
commit(checkout, 'pnpm/crates/example/src/lib.rs', 'rust')
|
||||
assert.equal(scope().full_tests, 'false', 'TS code plus pacquet sources remain affected')
|
||||
for (const file of ['package.json', 'pnpm-lock.yaml', '.pnpmfile.cjs', 'pnpm-workspace.yaml', '__patches__/dependency.patch', '.github/scripts/new-helper.mjs', '.changeset/config.json', 'pnpr/crates/example/src/lib.rs', 'pnpr/.fixtures/packages/example/package.json', 'Cargo.lock']) {
|
||||
for (const file of ['package.json', 'pnpm-lock.yaml', '.pnpmfile.cjs', 'pnpm-workspace.yaml', '.config/pnpm/patches/dependency.patch', '.github/scripts/new-helper.mjs', '.changeset/config.json', 'pnpr/crates/example/src/lib.rs', 'pnpr/.fixtures/packages/example/package.json', 'Cargo.lock']) {
|
||||
commit(checkout, file, 'global input')
|
||||
assert.equal(scope().full_tests, 'true', file)
|
||||
git(checkout, 'reset', '--hard', 'HEAD^')
|
||||
|
||||
@@ -28,6 +28,7 @@ on:
|
||||
- 'pnpm11/**'
|
||||
- 'package.json'
|
||||
- 'pnpm-workspace.yaml'
|
||||
- '.config/pnpm/**'
|
||||
- 'pnpm-lock.yaml'
|
||||
- '.github/workflows/benchmark.yml'
|
||||
|
||||
|
||||
@@ -56,7 +56,7 @@ jobs:
|
||||
ts:
|
||||
- 'pnpm11/**'
|
||||
- '.meta-updater/**'
|
||||
- '__patches__/**'
|
||||
- '.config/pnpm/**'
|
||||
- 'package.json'
|
||||
- 'pnpm-workspace.yaml'
|
||||
- 'pnpm-lock.yaml'
|
||||
|
||||
@@ -89,6 +89,7 @@ jobs:
|
||||
- 'package.json'
|
||||
- 'pnpm-lock.yaml'
|
||||
- 'pnpm-workspace.yaml'
|
||||
- '.config/pnpm/**'
|
||||
- 'rust-toolchain.toml'
|
||||
- 'rustfmt.toml'
|
||||
- 'deny.toml'
|
||||
|
||||
@@ -23,6 +23,7 @@ on:
|
||||
- 'pnpm/tasks/registry-mock/package.json'
|
||||
- 'pnpm-lock.yaml'
|
||||
- 'pnpm-workspace.yaml'
|
||||
- '.config/pnpm/**'
|
||||
- 'pnpm/tasks/integrated-benchmark/src/fixtures/**'
|
||||
- '.github/actions/rustup/**'
|
||||
- '.github/actions/binstall/**'
|
||||
@@ -52,6 +53,7 @@ on:
|
||||
- 'pnpm/tasks/registry-mock/package.json'
|
||||
- 'pnpm-lock.yaml'
|
||||
- 'pnpm-workspace.yaml'
|
||||
- '.config/pnpm/**'
|
||||
- 'pnpm/tasks/integrated-benchmark/src/fixtures/**'
|
||||
- '.github/actions/rustup/**'
|
||||
- '.github/actions/binstall/**'
|
||||
|
||||
@@ -13,7 +13,7 @@ on:
|
||||
- 'Cargo.lock'
|
||||
- 'rust-toolchain.toml'
|
||||
- '.cargo/**'
|
||||
- '__patches__/**'
|
||||
- '.config/pnpm/**'
|
||||
- 'package.json'
|
||||
- 'pnpm-lock.yaml'
|
||||
- 'pnpm-workspace.yaml'
|
||||
|
||||
+26
-612
@@ -65,101 +65,32 @@ packages:
|
||||
- '!**/test/**'
|
||||
- '!pnpm11/resolving/local-resolver/example-package/**'
|
||||
|
||||
# Every `ci:*` script lives in the root manifest only, so the workflows run
|
||||
# these pipelines with `--include-workspace-root --full`; the test runners do
|
||||
# their own package selection and file sharding. The workflows also pass
|
||||
# `--no-cache`: no task declares `outputs`, so none is cacheable today, and the
|
||||
# flag keeps a check from being skipped if one ever does.
|
||||
pipelines:
|
||||
ts-check: [ci:compile, ci:lint]
|
||||
# Named after the scripts they run: the test workflow passes one value as both
|
||||
# the pipeline name and the `TEST_SCRIPT` the chunk runner re-runs.
|
||||
ci:test-all: [ci:test-all]
|
||||
ci:test-branch: [ci:test-branch]
|
||||
ts-test-chunk: [ci:test-chunk]
|
||||
rust-test: [ci:rust-test]
|
||||
pnpr-test: [ci:pnpr-test]
|
||||
rust-clippy: [ci:rust-clippy]
|
||||
rust-doc: [ci:rust-doc]
|
||||
rust-deny: [ci:rust-deny]
|
||||
rust-format: [ci:rust-fmt, ci:toml-fmt]
|
||||
rust-dylint: [ci:rust-dylint]
|
||||
build-pnpr: [ci:build-pnpr]
|
||||
|
||||
# Every entry names a script the root manifest alone defines. A name a
|
||||
# workspace package also defines must not appear here: the entry would drop
|
||||
# that task's default `dependsOn: ['^<name>']` ordering, and each project's
|
||||
# run of it would take a slot of the group, serializing a recursive run.
|
||||
tasks:
|
||||
ci:compile:
|
||||
concurrencyGroup: typescript
|
||||
ci:lint:
|
||||
dependsOn: [ci:compile]
|
||||
concurrencyGroup: typescript
|
||||
ci:test-all:
|
||||
concurrencyGroup: typescript
|
||||
ci:test-branch:
|
||||
concurrencyGroup: typescript
|
||||
ci:test-chunk:
|
||||
concurrencyGroup: typescript
|
||||
test-all:
|
||||
concurrencyGroup: typescript
|
||||
test-branch:
|
||||
concurrencyGroup: typescript
|
||||
test-pkgs-all:
|
||||
concurrencyGroup: typescript
|
||||
test-pkgs-all-report-summary:
|
||||
concurrencyGroup: typescript
|
||||
test-pkgs-branch:
|
||||
concurrencyGroup: typescript
|
||||
build:pnpm:
|
||||
concurrencyGroup: cargo
|
||||
build:pnpm:wasm:
|
||||
concurrencyGroup: cargo
|
||||
build:wasm-runtime-probe:
|
||||
concurrencyGroup: cargo
|
||||
check:rust:
|
||||
concurrencyGroup: cargo
|
||||
fix:rust:
|
||||
concurrencyGroup: cargo
|
||||
lint:rust:
|
||||
concurrencyGroup: cargo
|
||||
pre-push:rust:
|
||||
concurrencyGroup: cargo
|
||||
priority: 10
|
||||
ready:rust:
|
||||
concurrencyGroup: cargo
|
||||
test:rust:
|
||||
concurrencyGroup: cargo
|
||||
test:rust-affected:
|
||||
concurrencyGroup: cargo
|
||||
test:rust-smoke:
|
||||
concurrencyGroup: cargo
|
||||
ci:build-pnpr:
|
||||
concurrencyGroup: cargo
|
||||
ci:pnpr-test:
|
||||
concurrencyGroup: cargo
|
||||
ci:rust-clippy:
|
||||
concurrencyGroup: cargo
|
||||
outputs: []
|
||||
env: [RUSTFLAGS]
|
||||
ci:rust-doc:
|
||||
concurrencyGroup: cargo
|
||||
outputs: []
|
||||
env: [RUSTFLAGS, RUSTDOCFLAGS]
|
||||
ci:rust-dylint:
|
||||
concurrencyGroup: cargo
|
||||
ci:rust-test:
|
||||
concurrencyGroup: cargo
|
||||
|
||||
# The repository is checked out into many worktrees at once, and a second
|
||||
# Rust build or TypeScript test run on the same machine only takes cores and
|
||||
# memory from the first. The TypeScript test scripts also share the
|
||||
# `../pnpm_tmp` scratch directory across worktrees, which one of them wipes
|
||||
# on startup. A task past the limit waits for a slot instead of starting.
|
||||
concurrencyGroups:
|
||||
cargo: 1
|
||||
typescript: 1
|
||||
include:
|
||||
./.config/pnpm/policies.yaml:
|
||||
- allowBuilds
|
||||
- auditConfig
|
||||
- minimumReleaseAge
|
||||
- minimumReleaseAgeExclude
|
||||
- minimumReleaseAgeExcludePrune
|
||||
- overrides
|
||||
- packageExtensions
|
||||
- registries
|
||||
- trustPolicy
|
||||
- trustPolicyExclude
|
||||
- trustPolicyExcludePrune
|
||||
- trustPolicyIgnoreAfter
|
||||
./.config/pnpm/patches/patches.yaml:
|
||||
- patchedDependencies
|
||||
- patchesDir
|
||||
./.config/pnpm/catalog.yaml:
|
||||
- catalogMode
|
||||
- catalogPrune
|
||||
- catalogs
|
||||
- update
|
||||
./.config/pnpm/tasks.yaml:
|
||||
- concurrencyGroups
|
||||
- pipelines
|
||||
- tasks
|
||||
|
||||
# Native workspace release management (consumed by `pnpm change` / `pnpm version -r`).
|
||||
# The Rust CLI wrapper is the workspace package `pacquet` (published to npm as
|
||||
@@ -200,353 +131,9 @@ versioning:
|
||||
'@pnpm/pnpr': alpha
|
||||
'@pnpm/pnpr-ui': alpha
|
||||
|
||||
allowBuilds:
|
||||
'@parcel/watcher': false
|
||||
core-js: false
|
||||
esbuild: true
|
||||
fuse-native: true
|
||||
ghooks: true
|
||||
msgpackr-extract: true
|
||||
unrs-resolver: true
|
||||
|
||||
auditConfig:
|
||||
ignoreGhsas:
|
||||
- GHSA-2g4f-4pwh-qvx6
|
||||
- GHSA-76c9-3jph-rj3q
|
||||
- GHSA-ffrw-9mx8-89p8
|
||||
- GHSA-mh29-5h37-fv8m
|
||||
- GHSA-w5hq-g745-h8pq
|
||||
# GHSA-vwc7-r8mq-g2x9: adm-zip follows pre-existing destination symlinks during
|
||||
# extraction. No patched adm-zip release exists. It is only a devDependency of
|
||||
# @pnpm/fetching.binary-fetcher, used to build zip fixtures, and never extracts.
|
||||
- GHSA-vwc7-r8mq-g2x9
|
||||
# GHSA-h67p-54hq-rp68: js-yaml quadratic-complexity DoS in merge key handling.
|
||||
# Patched only in >=4.1.2 with no v3 fix; @yarnpkg/parsers requires the js-yaml 3
|
||||
# API (yaml.safeLoad), so its transitive js-yaml cannot be upgraded.
|
||||
- GHSA-h67p-54hq-rp68
|
||||
# GHSA-vfj7-8cjw-p6xm: braces stack exhaustion on deeply nested patterns.
|
||||
# No patched braces release exists. pnpm expands patterns from the user's config
|
||||
# and command line, or from scripts and manifests of dependencies already allowed
|
||||
# to run code, so a crash gives an attacker nothing new.
|
||||
- GHSA-vfj7-8cjw-p6xm
|
||||
# GHSA-ch52-4w7c-c8xp: http-cache-semantics max-stale leaks other users'
|
||||
# responses from a shared cache. No patched release exists. make-fetch-happen
|
||||
# uses it for a private, single-user client cache, which has no other users.
|
||||
- GHSA-ch52-4w7c-c8xp
|
||||
# GHSA-hp3w-g68c-fv3c: sprintf-js DoS through unbounded precision specifiers.
|
||||
# No patched release exists. It is reached only through argparse 1, which
|
||||
# formats its own help text with it, never attacker-controlled formats.
|
||||
- GHSA-hp3w-g68c-fv3c
|
||||
|
||||
cargo:
|
||||
enabled: true
|
||||
|
||||
catalog:
|
||||
# @babel/core 8.x (and its plugins) require Node.js ^22.18.0 || >=24.11.0,
|
||||
# above pnpm's supported floor of Node.js >=22.13.
|
||||
'@babel/core': ^7.29.7
|
||||
'@babel/plugin-transform-explicit-resource-management': ^7.29.7
|
||||
'@commitlint/cli': ^21.2.4
|
||||
'@commitlint/config-conventional': ^21.2.4
|
||||
'@commitlint/prompt-cli': ^21.2.4
|
||||
'@cyclonedx/cyclonedx-library': 10.3.0
|
||||
'@emnapi/wasi-threads': 2.2.0
|
||||
'@eslint/js': ^10.0.1
|
||||
'@inquirer/prompts': ^8.7.4
|
||||
# Jest 30.5.0 breaks ESM package imports in the Jest runtime.
|
||||
'@jest/globals': 30.4.1
|
||||
'@npm/types': ^2.1.0
|
||||
'@pnpm/byline': ^1.0.0
|
||||
'@pnpm/colorize-semver-diff': ^2.0.0
|
||||
'@pnpm/exec': ^4.0.0
|
||||
'@pnpm/logger': '^1100.0.0'
|
||||
'@pnpm/meta-updater': 2.0.6
|
||||
'@pnpm/nopt': ^0.3.1
|
||||
'@pnpm/npm-package-arg': ^2.0.0
|
||||
'@pnpm/patch-package': 0.0.1
|
||||
'@pnpm/semver-diff': ^2.0.0
|
||||
'@pnpm/tabtab': ^0.5.4
|
||||
'@pnpm/tgz-fixtures': 0.0.0
|
||||
'@reflink/reflink': 0.1.19
|
||||
'@rushstack/worker-pool': 0.7.30
|
||||
'@stylistic/eslint-plugin': ^5.10.0
|
||||
'@tybys/wasm-util': 0.10.4
|
||||
'@types/adm-zip': ^0.6.0
|
||||
'@types/archy': 0.0.36
|
||||
'@types/cross-spawn': ^6.0.6
|
||||
'@types/fs-extra': ^11.0.4
|
||||
'@types/graceful-fs': ^4.1.9
|
||||
'@types/hosted-git-info': ^3.0.5
|
||||
'@types/ini': 4.1.1
|
||||
'@types/is-gzip': 2.0.2
|
||||
'@types/is-windows': ^1.0.2
|
||||
'@types/isexe': 2.0.4
|
||||
'@types/jest': ^30.0.0
|
||||
'@types/js-yaml': ^4.0.9
|
||||
'@types/libnpmpublish': ^11.2.0
|
||||
'@types/lodash.kebabcase': 4.1.9
|
||||
'@types/lodash.throttle': 4.1.9
|
||||
'@types/micromatch': ^4.0.10
|
||||
# Kept on 22.x to match pnpm's minimum supported Node.js version (>=22.13);
|
||||
# newer majors would type APIs that don't exist on the supported floor.
|
||||
'@types/node': ^22.19.19
|
||||
'@types/normalize-package-data': ^2.4.4
|
||||
'@types/normalize-path': ^3.0.2
|
||||
'@types/npm-registry-fetch': ^8.0.9
|
||||
'@types/object-hash': 3.0.6
|
||||
'@types/parse-json': ^7.0.0
|
||||
'@types/picomatch': ^4.0.3
|
||||
'@types/pnpm__byline': npm:@types/byline@^4.2.36
|
||||
'@types/proxyquire': ^1.3.31
|
||||
'@types/qrcode-terminal': ^0.12.2
|
||||
'@types/ramda': 0.32.0
|
||||
'@types/retry': ^0.12.5
|
||||
'@types/semver': 7.8.0
|
||||
'@types/spdx-expression-parse': 4.0.0
|
||||
'@types/ssri': ^7.1.5
|
||||
'@types/tar-stream': ^3.1.5
|
||||
'@types/touch': ^3.1.5
|
||||
'@types/validate-npm-package-name': ^4.0.2
|
||||
'@types/which': ^3.0.4
|
||||
'@types/write-file-atomic': ^4.0.3
|
||||
'@types/yarnpkg__lockfile': ^1.1.9
|
||||
'@types/yauzl': ^3.4.0
|
||||
'@types/zkochan__table': npm:@types/table@6.3.2
|
||||
'@typescript-eslint/utils': ^8.72.0
|
||||
'@typescript/native-preview': 7.0.0-dev.20260707.2
|
||||
'@webcontainer/api': ^1.6.4
|
||||
# @yarnpkg/core 4.9.2 was published with a Yarn `patch:` specifier for its
|
||||
# `got` dependency, which pnpm resolves to a nonexistent local path. The
|
||||
# `@yarnpkg/nm` override keeps its transitive copy on this version too.
|
||||
'@yarnpkg/core': 4.9.1
|
||||
'@yarnpkg/extensions': 2.0.7
|
||||
'@yarnpkg/fslib': ^3.1.5
|
||||
'@yarnpkg/lockfile': ^1.1.0
|
||||
'@yarnpkg/nm': 4.1.1
|
||||
'@yarnpkg/parsers': 3.1.0
|
||||
'@yarnpkg/pnp': ^4.1.7
|
||||
'@yarnpkg/shell': 4.1.3
|
||||
'@zkochan/retry': ^0.2.0
|
||||
'@zkochan/rimraf': ^4.0.0
|
||||
'@zkochan/table': ^2.0.1
|
||||
adm-zip: ^0.6.1
|
||||
agentkeepalive: ^4.6.0
|
||||
amaro: ^1.2.1
|
||||
ansi-diff: ^1.2.0
|
||||
archy: ^1.0.0
|
||||
better-path-resolve: 2.0.0
|
||||
# bin-links 7.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's
|
||||
# supported floor of Node.js >=22.13.
|
||||
bin-links: ^6.0.2
|
||||
# bole 6 is ESM-only. Under Jest, the workspace logger's ESM bole and the
|
||||
# published @pnpm/logger's CJS bole 5 land in different realms, so the
|
||||
# globalThis.$$bole output registry is no longer shared and log events
|
||||
# emitted through one logger copy never reach the other's streamParser.
|
||||
# Keep bole 5 until the published @pnpm/logger ships with bole 6.
|
||||
bole: ^5.0.29
|
||||
boxen: npm:@zkochan/boxen@5.1.2
|
||||
c8: ^12.0.0
|
||||
camelcase: ^10.0.0
|
||||
camelcase-keys: ^10.0.3
|
||||
can-link: ^3.0.0
|
||||
can-write-to-dir: ^2.0.0
|
||||
chalk: ^6.0.1
|
||||
ci-info: ^4.4.0
|
||||
cli-truncate: ^6.1.1
|
||||
cmd-extension: ^2.0.0
|
||||
comver-to-semver: ^2.0.0
|
||||
cross-env: ^10.1.0
|
||||
cross-spawn: ^7.0.6
|
||||
# cspell 10.x requires Node.js >=22.18.0, above pnpm's supported floor of
|
||||
# Node.js >=22.13.
|
||||
cspell: 9.8.0
|
||||
deep-require-cwd: 1.0.0
|
||||
delay: ^7.0.0
|
||||
detect-indent: 7.0.2
|
||||
detect-libc: ^2.1.2
|
||||
didyoumean2: ^7.0.4
|
||||
dint: ^5.1.0
|
||||
dir-is-case-sensitive: ^3.0.0
|
||||
empathic: ^2.1.0
|
||||
esbuild: ^0.28.2
|
||||
escape-string-regexp: ^5.0.0
|
||||
eslint: ^10.13.0
|
||||
eslint-plugin-import-x: ^4.17.1
|
||||
eslint-plugin-jest: ^29.17.0
|
||||
eslint-plugin-n: ^18.5.0
|
||||
eslint-plugin-promise: ^7.3.0
|
||||
eslint-plugin-regexp: ^3.1.1
|
||||
eslint-plugin-simple-import-sort: ^14.0.0
|
||||
execa: npm:safe-execa@0.3.0
|
||||
exists-link: 2.0.0
|
||||
fast-deep-equal: ^3.1.3
|
||||
fast-glob: ^3.3.3
|
||||
fs-extra: ^11.4.1
|
||||
fuse-native: ^2.2.6
|
||||
# Bundled into the pnpm 12 wrapper's dist/ payload, where the Corepack entry
|
||||
# point loads it from; see pnpm/npm/pnpm/bin/pnpm.mjs.
|
||||
get-pnpm: ^0.0.5
|
||||
get-port: ^7.2.0
|
||||
ghooks: 2.0.4
|
||||
graceful-fs: ^4.2.11
|
||||
graph-cycles: 3.0.0
|
||||
hosted-git-info: npm:@pnpm/hosted-git-info@1.0.0
|
||||
http-proxy-agent: ^9.1.0
|
||||
https-proxy-agent: ^9.1.0
|
||||
https-proxy-server-express: 0.1.2
|
||||
husky: ^9.1.7
|
||||
hyperdrive-schemas: ^2.0.0
|
||||
# ini 7.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's
|
||||
# supported floor of Node.js >=22.13.
|
||||
ini: 6.0.0
|
||||
is-gzip: 2.0.0
|
||||
is-inner-link: ^5.0.0
|
||||
is-subdir: ^2.0.1
|
||||
is-windows: ^1.0.2
|
||||
isexe: 4.0.0
|
||||
jest: 30.4.2
|
||||
jest-diff: 30.4.1
|
||||
human-id: ^4.2.2
|
||||
js-yaml: npm:@zkochan/js-yaml@0.0.11
|
||||
json5: ^2.2.3
|
||||
keyv: 6.1.0
|
||||
lcov-result-merger: ^6.0.0
|
||||
# libnpmpublish 12.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above
|
||||
# pnpm's supported floor of Node.js >=22.13.
|
||||
libnpmpublish: ^11.2.0
|
||||
load-json-file: ^7.0.1
|
||||
lodash.kebabcase: ^4.1.1
|
||||
lodash.throttle: 4.1.1
|
||||
loud-rejection: ^2.2.0
|
||||
lru-cache: ^11.5.3
|
||||
make-empty-dir: ^4.0.0
|
||||
mdast-util-to-string: ^4.0.0
|
||||
memfs: ^4.80.0
|
||||
memoize: ^11.0.0
|
||||
micromatch: ^4.0.8
|
||||
msgpackr: 2.1.2
|
||||
nm-prune: ^5.0.0
|
||||
# node-gyp 13 (with its nopt 10 and which 7 dependencies) requires Node.js
|
||||
# ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's supported floor of >=22.13.
|
||||
node-gyp: ^12.3.0
|
||||
normalize-newline: 5.0.0
|
||||
# normalize-package-data 9.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0,
|
||||
# above pnpm's supported floor of Node.js >=22.13.
|
||||
normalize-package-data: ^8.0.0
|
||||
normalize-path: ^3.0.0
|
||||
normalize-registry-url: 2.0.1
|
||||
# npm-packlist 11.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above
|
||||
# pnpm's supported floor of Node.js >=22.13.
|
||||
npm-packlist: 10.0.4
|
||||
# npm-registry-fetch 20.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0,
|
||||
# above pnpm's supported floor of Node.js >=22.13.
|
||||
npm-registry-fetch: ^19.0.0
|
||||
object-hash: 3.0.0
|
||||
open: ^11.0.4
|
||||
openpgp: ^6.3.2
|
||||
'@openpgp/web-stream-tools': 0.3.1
|
||||
p-defer: ^4.0.1
|
||||
p-every: ^2.0.0
|
||||
p-filter: ^4.1.0
|
||||
p-limit: ^7.3.3
|
||||
p-queue: ^10.0.0
|
||||
parse-json: ^8.3.0
|
||||
path-absolute: ^2.0.0
|
||||
path-exists: ^5.0.0
|
||||
path-name: ^1.0.0
|
||||
path-temp: ^3.0.0
|
||||
pidtree: ^1.0.0
|
||||
playwright-core: ^1.64.1
|
||||
preferred-pm: ^5.0.1
|
||||
pretty-bytes: ^7.2.0
|
||||
pretty-ms: ^10.0.0
|
||||
promise-share: ^2.0.1
|
||||
proxy: ^4.1.0
|
||||
proxyquire: ^2.1.3
|
||||
ps-list: ^9.0.0
|
||||
qrcode-terminal: ^0.12.0
|
||||
ramda: npm:@pnpm/ramda@0.28.1
|
||||
read-ini-file: 5.0.0
|
||||
read-yaml-file: ^3.0.0
|
||||
realpath-missing: ^2.0.0
|
||||
remark-parse: ^11.0.0
|
||||
remark-stringify: ^11.0.0
|
||||
rename-overwrite: ^7.0.1
|
||||
render-help: ^2.0.0
|
||||
resolve-link-target: ^3.0.0
|
||||
rimraf: ^6.1.3
|
||||
root-link-target: ^4.0.0
|
||||
rxjs: ^7.8.2
|
||||
safe-buffer: 5.2.1
|
||||
safe-execa: ^0.3.0
|
||||
safe-promise-defer: ^2.0.0
|
||||
sanitize-filename: ^1.6.4
|
||||
seek-bzip: 2.0.0
|
||||
semver: ^7.8.5
|
||||
semver-range-intersect: ^0.3.1
|
||||
semver-utils: ^1.1.4
|
||||
shlex: ^3.0.0
|
||||
shx: ^0.4.0
|
||||
signal-exit: ^4.1.0
|
||||
socks: ^2.8.10
|
||||
socks-proxy-agent: ^10.1.0
|
||||
sort-keys: ^6.0.1
|
||||
spdx-expression-parse: 5.0.0
|
||||
split-cmd: ^1.1.0
|
||||
split2: ^4.2.0
|
||||
# ssri 14.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's
|
||||
# supported floor of Node.js >=22.13.
|
||||
ssri: 13.0.1
|
||||
stacktracey: ^2.2.0
|
||||
string-length: ^7.0.1
|
||||
string-width: ^8.3.0
|
||||
strip-bom: ^5.0.0
|
||||
strip-comments-strings: 1.2.0
|
||||
symlink-dir: ^10.0.3
|
||||
tar: ^7.5.22
|
||||
tar-stream: ^3.2.2
|
||||
# tempy >=3.1.0 uses temp-dir 3.x which has an async fs.realpath() in its
|
||||
# module init. When esbuild bundles this into its __esm lazy-init pattern,
|
||||
# the async operation deadlocks and the pnpm binary hangs on startup.
|
||||
tempy: 3.0.0
|
||||
terminal-link: ^5.0.0
|
||||
tinyglobby: ^0.2.17
|
||||
touch: 3.1.1
|
||||
tree-kill: ^1.2.2
|
||||
ts-jest-resolver: 2.0.1
|
||||
# Kept on 6.x because typescript-eslint does not support the TypeScript 7.0 API
|
||||
# yet (https://github.com/typescript-eslint/typescript-eslint/issues/10940); the
|
||||
# 7.x compiler ships separately as @typescript/native-preview (tsgo).
|
||||
typescript: 6.0.3
|
||||
typescript-eslint: ^8.72.0
|
||||
uid-number: 0.0.6
|
||||
# undici 8.x requires Node.js >=22.19.0, above pnpm's supported floor of
|
||||
# Node.js >=22.13.
|
||||
undici: ^7.29.1
|
||||
unified: ^11.0.5
|
||||
# validate-npm-package-name 8.x requires Node.js ^22.22.2 || ^24.15.0 ||
|
||||
# >=26.0.0, above pnpm's supported floor of Node.js >=22.13.
|
||||
validate-npm-package-name: 7.0.2
|
||||
version-selector-type: ^3.0.0
|
||||
vfile: ^6.0.3
|
||||
which: npm:@pnpm/which@^3.0.1
|
||||
# write-file-atomic 8.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0,
|
||||
# above pnpm's supported floor of Node.js >=22.13.
|
||||
write-file-atomic: ^7.0.1
|
||||
write-ini-file: 5.0.0
|
||||
write-json-file: ^7.0.0
|
||||
write-json5-file: ^4.0.0
|
||||
write-package: 7.2.0
|
||||
write-yaml-file: ^6.0.0
|
||||
yaml: ^2.9.1
|
||||
yaml-tag: 1.1.0
|
||||
yauzl: ^3.4.0
|
||||
enhanced-resolve: 5.26.0
|
||||
|
||||
catalogMode: strict
|
||||
|
||||
catalogPrune: true
|
||||
|
||||
enablePrePostScripts: false
|
||||
|
||||
engineStrict: false
|
||||
@@ -556,190 +143,17 @@ gitChecks: false
|
||||
hoistPattern:
|
||||
- jest-runner
|
||||
|
||||
minimumReleaseAge: 1440 # At least a day
|
||||
|
||||
minimumReleaseAgeExclude:
|
||||
- '@pnpm/*'
|
||||
- '@zkochan/*'
|
||||
- better-path-resolve
|
||||
- can-link
|
||||
- can-write-to-dir
|
||||
- cmd-extension
|
||||
- comver-to-semver
|
||||
- dir-is-case-sensitive
|
||||
- '@esbuild/*'
|
||||
- glob@11.1.0
|
||||
- is-inner-link
|
||||
- is-subdir
|
||||
- make-empty-dir
|
||||
- normalize-registry-url
|
||||
- path-absolute
|
||||
- path-temp
|
||||
- pnpm
|
||||
- preferred-pm
|
||||
- promise-share
|
||||
- read-ini-file
|
||||
- read-yaml-file
|
||||
- realpath-missing
|
||||
- rename-overwrite
|
||||
- render-help
|
||||
- resolve-link-target
|
||||
- root-link-target
|
||||
- safe-execa
|
||||
- safe-promise-defer
|
||||
- symlink-dir
|
||||
- which-pm
|
||||
- write-ini-file
|
||||
- write-json5-file
|
||||
- write-yaml-file
|
||||
- http-proxy-middleware@3.0.7
|
||||
|
||||
lockfile:
|
||||
includeResolutionSettings: true
|
||||
|
||||
minimumReleaseAgeExcludePrune: true
|
||||
|
||||
nodeVersion: 22.13.0
|
||||
|
||||
overrides:
|
||||
'@cypress/request@3.0.9>qs': ^6.14.1
|
||||
'@yarnpkg/fslib@2': '3'
|
||||
'@yarnpkg/nm>@yarnpkg/core': 'catalog:'
|
||||
adm-zip@<0.6.0: ^0.6.0
|
||||
ajv@>=7.0.0-alpha.0 <8.18.0: '>=8.18.0'
|
||||
body-parser@<2.2.1: '^2.2.1'
|
||||
brace-expansion@<5.0.5: '>=5.0.5'
|
||||
clipanion: 3.2.0-rc.6
|
||||
cookie@<0.7.0: '>=0.7.0'
|
||||
cross-spawn@<7.0.5: '>=7.0.5'
|
||||
debug@<3.1.0: '>=3.1.0'
|
||||
diff@<8.0.3: '^8.0.3'
|
||||
express@<4.22.1: ^4.22.1
|
||||
follow-redirects@<=1.15.5: '>=1.15.6'
|
||||
glob-parent@<5.1.2: '>=5.1.2'
|
||||
glob@>=10.3.7 <=11.0.3: '^11.1.0'
|
||||
handlebars@>=4.0.0 <4.7.9: '>=4.7.9'
|
||||
hosted-git-info@1: 'catalog:'
|
||||
istanbul-reports: npm:@zkochan/istanbul-reports
|
||||
js-yaml@<3.14.2: '^3.14.2'
|
||||
js-yaml@^4.0.0: 'catalog:'
|
||||
json5@<2.2.2: 'catalog:'
|
||||
jsonwebtoken@<=8.5.1: '>=9.0.0'
|
||||
jws@<3.2.3: '^3.2.3'
|
||||
lodash@<=4.17.23: '>=4.18.0'
|
||||
lodash@>=4.0.0 <=4.17.22: '^4.17.23'
|
||||
lodash@>=4.0.0 <=4.17.23: '>=4.18.0'
|
||||
minimatch@>=7.0.0 <7.4.7: '^7.4.7'
|
||||
minimatch@>=9.0.0 <10.0.0: '>=10.2.4'
|
||||
nopt@5: npm:@pnpm/nopt@^0.2.1
|
||||
on-headers@<1.1.0: '>=1.1.0'
|
||||
path-to-regexp@<0.1.13: ^0.1.13
|
||||
path-to-regexp@>=4.0.0 <6.3.0: '>=6.3.0'
|
||||
path-to-regexp@>=7.0.0 <8.0.0: '>=8.0.0'
|
||||
postman-request>qs: ^6.14.1
|
||||
qs@>=6.11.1 <=6.15.1: ^6.15.2
|
||||
request: npm:postman-request@2.88.1-postman.40
|
||||
semver@<7.5.2: 'catalog:'
|
||||
send@<0.19.0: ^0.19.0
|
||||
shell-quote@<1.8.4: '>=1.8.4'
|
||||
serve-static@<1.16.0: ^1.16.0
|
||||
# GHSA-w7jw-789q-3m8p / CVE-2026-9277: 1.8.4 patches critical shell-quote vulnerabilities in <=1.8.3.
|
||||
shell-quote: 1.8.4
|
||||
socks@2: ^2.8.1
|
||||
tar@<=7.5.9: '>=7.5.10'
|
||||
tmp@<=0.2.3: '>=0.2.4'
|
||||
tough-cookie@<4.1.3: '>=4.1.3'
|
||||
validator@<13.15.22: '>=13.15.22'
|
||||
yaml@<2.2.2: '>=2.2.2'
|
||||
http-proxy-middleware@>=0.16.0 <3.0.6: ^3.0.6
|
||||
deepmerge-ts@<8.0.0: ^8.0.0
|
||||
|
||||
packageExtensions:
|
||||
'@babel/parser':
|
||||
peerDependencies:
|
||||
'@babel/types': '*'
|
||||
# The shell's declarations import micromatch's, which it does not depend on.
|
||||
'@yarnpkg/shell':
|
||||
dependencies:
|
||||
'@types/micromatch': ^4.0.10
|
||||
jest-circus:
|
||||
dependencies:
|
||||
slash: '3'
|
||||
remark-parse:
|
||||
dependencies:
|
||||
vfile: ^6.0.0
|
||||
peerDependencies:
|
||||
unified: '*'
|
||||
remark-stringify:
|
||||
dependencies:
|
||||
vfile: ^6.0.0
|
||||
peerDependencies:
|
||||
unified: '*'
|
||||
|
||||
patchedDependencies:
|
||||
'@tybys/wasm-util@0.10.4': __patches__/@tybys__wasm-util@0.10.4.patch
|
||||
graceful-fs@4.2.11: __patches__/graceful-fs@4.2.11.patch
|
||||
normalize-registry-url@2.0.1: __patches__/normalize-registry-url@2.0.1.patch
|
||||
unrs-resolver@1.12.2: __patches__/unrs-resolver@1.12.2.patch
|
||||
|
||||
patchesDir: __patches__
|
||||
|
||||
publishBranch: main
|
||||
|
||||
resolutionMode: lowest-direct
|
||||
|
||||
savePrefix: ''
|
||||
|
||||
trustPolicy: no-downgrade
|
||||
|
||||
trustPolicyExclude:
|
||||
- '@pnpm/*'
|
||||
- '@yarnpkg/libzip@3.2.2'
|
||||
- pnpm
|
||||
- rxjs@7.8.2
|
||||
- undici-types@6.21.0
|
||||
|
||||
trustPolicyExcludePrune: true
|
||||
|
||||
trustPolicyIgnoreAfter: 10080 # 1 week
|
||||
|
||||
# Dependencies deliberately held back, which `pnpm update --latest` (run by the
|
||||
# update-lockfile workflow) would otherwise bump. Most of them are packages
|
||||
# whose newer versions require a Node.js version above pnpm's supported floor
|
||||
# (>=22.13); the comment at each catalog entry above records the reason.
|
||||
# typescript is held on 6.x because typescript-eslint does not support the
|
||||
# TypeScript 7.0 API yet.
|
||||
update:
|
||||
ignoreDeps:
|
||||
- '@babel/core'
|
||||
- '@babel/plugin-transform-explicit-resource-management'
|
||||
- '@jest/globals'
|
||||
- '@types/node'
|
||||
- '@yarnpkg/core'
|
||||
- bin-links
|
||||
- bole
|
||||
- cspell
|
||||
- eslint-plugin-regexp
|
||||
- ini
|
||||
- jest
|
||||
- jest-diff
|
||||
- libnpmpublish
|
||||
- node-gyp
|
||||
- normalize-package-data
|
||||
- npm-packlist
|
||||
- npm-registry-fetch
|
||||
- ssri
|
||||
- tempy
|
||||
- typescript
|
||||
- undici
|
||||
- validate-npm-package-name
|
||||
- write-file-atomic
|
||||
|
||||
virtualStoreType: global
|
||||
|
||||
autoDedupe: true
|
||||
|
||||
registries:
|
||||
https://registry.npmjs.org/:
|
||||
scopes:
|
||||
- '@pnpm'
|
||||
Reference in new issue
Block a user