diff --git a/.config/pnpm/catalog.yaml b/.config/pnpm/catalog.yaml new file mode 100644 index 0000000000..00b033e551 --- /dev/null +++ b/.config/pnpm/catalog.yaml @@ -0,0 +1,337 @@ +catalog: + # @babel/core 8.x (and its plugins) require Node.js ^22.18.0 || >=24.11.0, + # above pnpm's supported floor of Node.js >=22.13. + '@babel/core': ^7.29.7 + '@babel/plugin-transform-explicit-resource-management': ^7.29.7 + '@commitlint/cli': ^21.2.4 + '@commitlint/config-conventional': ^21.2.4 + '@commitlint/prompt-cli': ^21.2.4 + '@cyclonedx/cyclonedx-library': 10.3.0 + '@emnapi/wasi-threads': 2.2.0 + '@eslint/js': ^10.0.1 + '@inquirer/prompts': ^8.7.4 + # Jest 30.5.0 breaks ESM package imports in the Jest runtime. + '@jest/globals': 30.4.1 + '@npm/types': ^2.1.0 + '@pnpm/byline': ^1.0.0 + '@pnpm/colorize-semver-diff': ^2.0.0 + '@pnpm/exec': ^4.0.0 + '@pnpm/logger': '^1100.0.0' + '@pnpm/meta-updater': 2.0.6 + '@pnpm/nopt': ^0.3.1 + '@pnpm/npm-package-arg': ^2.0.0 + '@pnpm/patch-package': 0.0.1 + '@pnpm/semver-diff': ^2.0.0 + '@pnpm/tabtab': ^0.5.4 + '@pnpm/tgz-fixtures': 0.0.0 + '@reflink/reflink': 0.1.19 + '@rushstack/worker-pool': 0.7.30 + '@stylistic/eslint-plugin': ^5.10.0 + '@tybys/wasm-util': 0.10.4 + '@types/adm-zip': ^0.6.0 + '@types/archy': 0.0.36 + '@types/cross-spawn': ^6.0.6 + '@types/fs-extra': ^11.0.4 + '@types/graceful-fs': ^4.1.9 + '@types/hosted-git-info': ^3.0.5 + '@types/ini': 4.1.1 + '@types/is-gzip': 2.0.2 + '@types/is-windows': ^1.0.2 + '@types/isexe': 2.0.4 + '@types/jest': ^30.0.0 + '@types/js-yaml': ^4.0.9 + '@types/libnpmpublish': ^11.2.0 + '@types/lodash.kebabcase': 4.1.9 + '@types/lodash.throttle': 4.1.9 + '@types/micromatch': ^4.0.10 + # Kept on 22.x to match pnpm's minimum supported Node.js version (>=22.13); + # newer majors would type APIs that don't exist on the supported floor. + '@types/node': ^22.19.19 + '@types/normalize-package-data': ^2.4.4 + '@types/normalize-path': ^3.0.2 + '@types/npm-registry-fetch': ^8.0.9 + '@types/object-hash': 3.0.6 + '@types/parse-json': ^7.0.0 + '@types/picomatch': ^4.0.3 + '@types/pnpm__byline': npm:@types/byline@^4.2.36 + '@types/proxyquire': ^1.3.31 + '@types/qrcode-terminal': ^0.12.2 + '@types/ramda': 0.32.0 + '@types/retry': ^0.12.5 + '@types/semver': 7.8.0 + '@types/spdx-expression-parse': 4.0.0 + '@types/ssri': ^7.1.5 + '@types/tar-stream': ^3.1.5 + '@types/touch': ^3.1.5 + '@types/validate-npm-package-name': ^4.0.2 + '@types/which': ^3.0.4 + '@types/write-file-atomic': ^4.0.3 + '@types/yarnpkg__lockfile': ^1.1.9 + '@types/yauzl': ^3.4.0 + '@types/zkochan__table': npm:@types/table@6.3.2 + '@typescript-eslint/utils': ^8.72.0 + '@typescript/native-preview': 7.0.0-dev.20260707.2 + '@webcontainer/api': ^1.6.4 + # @yarnpkg/core 4.9.2 was published with a Yarn `patch:` specifier for its + # `got` dependency, which pnpm resolves to a nonexistent local path. The + # `@yarnpkg/nm` override keeps its transitive copy on this version too. + '@yarnpkg/core': 4.9.1 + '@yarnpkg/extensions': 2.0.7 + '@yarnpkg/fslib': ^3.1.5 + '@yarnpkg/lockfile': ^1.1.0 + '@yarnpkg/nm': 4.1.1 + '@yarnpkg/parsers': 3.1.0 + '@yarnpkg/pnp': ^4.1.7 + '@yarnpkg/shell': 4.1.3 + '@zkochan/retry': ^0.2.0 + '@zkochan/rimraf': ^4.0.0 + '@zkochan/table': ^2.0.1 + adm-zip: ^0.6.1 + agentkeepalive: ^4.6.0 + amaro: ^1.2.1 + ansi-diff: ^1.2.0 + archy: ^1.0.0 + better-path-resolve: 2.0.0 + # bin-links 7.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's + # supported floor of Node.js >=22.13. + bin-links: ^6.0.2 + # bole 6 is ESM-only. Under Jest, the workspace logger's ESM bole and the + # published @pnpm/logger's CJS bole 5 land in different realms, so the + # globalThis.$$bole output registry is no longer shared and log events + # emitted through one logger copy never reach the other's streamParser. + # Keep bole 5 until the published @pnpm/logger ships with bole 6. + bole: ^5.0.29 + boxen: npm:@zkochan/boxen@5.1.2 + c8: ^12.0.0 + camelcase: ^10.0.0 + camelcase-keys: ^10.0.3 + can-link: ^3.0.0 + can-write-to-dir: ^2.0.0 + chalk: ^6.0.1 + ci-info: ^4.4.0 + cli-truncate: ^6.1.1 + cmd-extension: ^2.0.0 + comver-to-semver: ^2.0.0 + cross-env: ^10.1.0 + cross-spawn: ^7.0.6 + # cspell 10.x requires Node.js >=22.18.0, above pnpm's supported floor of + # Node.js >=22.13. + cspell: 9.8.0 + deep-require-cwd: 1.0.0 + delay: ^7.0.0 + detect-indent: 7.0.2 + detect-libc: ^2.1.2 + didyoumean2: ^7.0.4 + dint: ^5.1.0 + dir-is-case-sensitive: ^3.0.0 + empathic: ^2.1.0 + esbuild: ^0.28.2 + escape-string-regexp: ^5.0.0 + eslint: ^10.13.0 + eslint-plugin-import-x: ^4.17.1 + eslint-plugin-jest: ^29.17.0 + eslint-plugin-n: ^18.5.0 + eslint-plugin-promise: ^7.3.0 + eslint-plugin-regexp: ^3.1.1 + eslint-plugin-simple-import-sort: ^14.0.0 + execa: npm:safe-execa@0.3.0 + exists-link: 2.0.0 + fast-deep-equal: ^3.1.3 + fast-glob: ^3.3.3 + fs-extra: ^11.4.1 + fuse-native: ^2.2.6 + # Bundled into the pnpm 12 wrapper's dist/ payload, where the Corepack entry + # point loads it from; see pnpm/npm/pnpm/bin/pnpm.mjs. + get-pnpm: ^0.0.5 + get-port: ^7.2.0 + ghooks: 2.0.4 + graceful-fs: ^4.2.11 + graph-cycles: 3.0.0 + hosted-git-info: npm:@pnpm/hosted-git-info@1.0.0 + http-proxy-agent: ^9.1.0 + https-proxy-agent: ^9.1.0 + https-proxy-server-express: 0.1.2 + husky: ^9.1.7 + hyperdrive-schemas: ^2.0.0 + # ini 7.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's + # supported floor of Node.js >=22.13. + ini: 6.0.0 + is-gzip: 2.0.0 + is-inner-link: ^5.0.0 + is-subdir: ^2.0.1 + is-windows: ^1.0.2 + isexe: 4.0.0 + jest: 30.4.2 + jest-diff: 30.4.1 + human-id: ^4.2.2 + js-yaml: npm:@zkochan/js-yaml@0.0.11 + json5: ^2.2.3 + keyv: 6.1.0 + lcov-result-merger: ^6.0.0 + # libnpmpublish 12.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above + # pnpm's supported floor of Node.js >=22.13. + libnpmpublish: ^11.2.0 + load-json-file: ^7.0.1 + lodash.kebabcase: ^4.1.1 + lodash.throttle: 4.1.1 + loud-rejection: ^2.2.0 + lru-cache: ^11.5.3 + make-empty-dir: ^4.0.0 + mdast-util-to-string: ^4.0.0 + memfs: ^4.80.0 + memoize: ^11.0.0 + micromatch: ^4.0.8 + msgpackr: 2.1.2 + nm-prune: ^5.0.0 + # node-gyp 13 (with its nopt 10 and which 7 dependencies) requires Node.js + # ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's supported floor of >=22.13. + node-gyp: ^12.3.0 + normalize-newline: 5.0.0 + # normalize-package-data 9.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, + # above pnpm's supported floor of Node.js >=22.13. + normalize-package-data: ^8.0.0 + normalize-path: ^3.0.0 + normalize-registry-url: 2.0.1 + # npm-packlist 11.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above + # pnpm's supported floor of Node.js >=22.13. + npm-packlist: 10.0.4 + # npm-registry-fetch 20.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, + # above pnpm's supported floor of Node.js >=22.13. + npm-registry-fetch: ^19.0.0 + object-hash: 3.0.0 + open: ^11.0.4 + openpgp: ^6.3.2 + '@openpgp/web-stream-tools': 0.3.1 + p-defer: ^4.0.1 + p-every: ^2.0.0 + p-filter: ^4.1.0 + p-limit: ^7.3.3 + p-queue: ^10.0.0 + parse-json: ^8.3.0 + path-absolute: ^2.0.0 + path-exists: ^5.0.0 + path-name: ^1.0.0 + path-temp: ^3.0.0 + pidtree: ^1.0.0 + playwright-core: ^1.64.1 + preferred-pm: ^5.0.1 + pretty-bytes: ^7.2.0 + pretty-ms: ^10.0.0 + promise-share: ^2.0.1 + proxy: ^4.1.0 + proxyquire: ^2.1.3 + ps-list: ^9.0.0 + qrcode-terminal: ^0.12.0 + ramda: npm:@pnpm/ramda@0.28.1 + read-ini-file: 5.0.0 + read-yaml-file: ^3.0.0 + realpath-missing: ^2.0.0 + remark-parse: ^11.0.0 + remark-stringify: ^11.0.0 + rename-overwrite: ^7.0.1 + render-help: ^2.0.0 + resolve-link-target: ^3.0.0 + rimraf: ^6.1.3 + root-link-target: ^4.0.0 + rxjs: ^7.8.2 + safe-buffer: 5.2.1 + safe-execa: ^0.3.0 + safe-promise-defer: ^2.0.0 + sanitize-filename: ^1.6.4 + seek-bzip: 2.0.0 + semver: ^7.8.5 + semver-range-intersect: ^0.3.1 + semver-utils: ^1.1.4 + shlex: ^3.0.0 + shx: ^0.4.0 + signal-exit: ^4.1.0 + socks: ^2.8.10 + socks-proxy-agent: ^10.1.0 + sort-keys: ^6.0.1 + spdx-expression-parse: 5.0.0 + split-cmd: ^1.1.0 + split2: ^4.2.0 + # ssri 14.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's + # supported floor of Node.js >=22.13. + ssri: 13.0.1 + stacktracey: ^2.2.0 + string-length: ^7.0.1 + string-width: ^8.3.0 + strip-bom: ^5.0.0 + strip-comments-strings: 1.2.0 + symlink-dir: ^10.0.3 + tar: ^7.5.22 + tar-stream: ^3.2.2 + # tempy >=3.1.0 uses temp-dir 3.x which has an async fs.realpath() in its + # module init. When esbuild bundles this into its __esm lazy-init pattern, + # the async operation deadlocks and the pnpm binary hangs on startup. + tempy: 3.0.0 + terminal-link: ^5.0.0 + tinyglobby: ^0.2.17 + touch: 3.1.1 + tree-kill: ^1.2.2 + ts-jest-resolver: 2.0.1 + # Kept on 6.x because typescript-eslint does not support the TypeScript 7.0 API + # yet (https://github.com/typescript-eslint/typescript-eslint/issues/10940); the + # 7.x compiler ships separately as @typescript/native-preview (tsgo). + typescript: 6.0.3 + typescript-eslint: ^8.72.0 + uid-number: 0.0.6 + # undici 8.x requires Node.js >=22.19.0, above pnpm's supported floor of + # Node.js >=22.13. + undici: ^7.29.1 + unified: ^11.0.5 + # validate-npm-package-name 8.x requires Node.js ^22.22.2 || ^24.15.0 || + # >=26.0.0, above pnpm's supported floor of Node.js >=22.13. + validate-npm-package-name: 7.0.2 + version-selector-type: ^3.0.0 + vfile: ^6.0.3 + which: npm:@pnpm/which@^3.0.1 + # write-file-atomic 8.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, + # above pnpm's supported floor of Node.js >=22.13. + write-file-atomic: ^7.0.1 + write-ini-file: 5.0.0 + write-json-file: ^7.0.0 + write-json5-file: ^4.0.0 + write-package: 7.2.0 + write-yaml-file: ^6.0.0 + yaml: ^2.9.1 + yaml-tag: 1.1.0 + yauzl: ^3.4.0 + enhanced-resolve: 5.26.0 + +catalogMode: strict + +catalogPrune: true + +# Dependencies deliberately held back, which `pnpm update --latest` (run by the +# update-lockfile workflow) would otherwise bump. Most of them are packages +# whose newer versions require a Node.js version above pnpm's supported floor +# (>=22.13); the comment at each catalog entry above records the reason. +# typescript is held on 6.x because typescript-eslint does not support the +# TypeScript 7.0 API yet. +update: + ignoreDeps: + - '@babel/core' + - '@babel/plugin-transform-explicit-resource-management' + - '@jest/globals' + - '@types/node' + - '@yarnpkg/core' + - bin-links + - bole + - cspell + - eslint-plugin-regexp + - ini + - jest + - jest-diff + - libnpmpublish + - node-gyp + - normalize-package-data + - npm-packlist + - npm-registry-fetch + - ssri + - tempy + - typescript + - undici + - validate-npm-package-name + - write-file-atomic diff --git a/__patches__/@tybys__wasm-util@0.10.4.patch b/.config/pnpm/patches/@tybys__wasm-util@0.10.4.patch similarity index 100% rename from __patches__/@tybys__wasm-util@0.10.4.patch rename to .config/pnpm/patches/@tybys__wasm-util@0.10.4.patch diff --git a/__patches__/graceful-fs@4.2.11.patch b/.config/pnpm/patches/graceful-fs@4.2.11.patch similarity index 100% rename from __patches__/graceful-fs@4.2.11.patch rename to .config/pnpm/patches/graceful-fs@4.2.11.patch diff --git a/__patches__/mdast-util-to-string@2.0.0.patch b/.config/pnpm/patches/mdast-util-to-string@2.0.0.patch similarity index 100% rename from __patches__/mdast-util-to-string@2.0.0.patch rename to .config/pnpm/patches/mdast-util-to-string@2.0.0.patch diff --git a/__patches__/normalize-registry-url@2.0.1.patch b/.config/pnpm/patches/normalize-registry-url@2.0.1.patch similarity index 100% rename from __patches__/normalize-registry-url@2.0.1.patch rename to .config/pnpm/patches/normalize-registry-url@2.0.1.patch diff --git a/.config/pnpm/patches/patches.yaml b/.config/pnpm/patches/patches.yaml new file mode 100644 index 0000000000..9988a2d83c --- /dev/null +++ b/.config/pnpm/patches/patches.yaml @@ -0,0 +1,7 @@ +patchedDependencies: + '@tybys/wasm-util@0.10.4': '@tybys__wasm-util@0.10.4.patch' + graceful-fs@4.2.11: graceful-fs@4.2.11.patch + normalize-registry-url@2.0.1: normalize-registry-url@2.0.1.patch + unrs-resolver@1.12.2: unrs-resolver@1.12.2.patch + +patchesDir: . diff --git a/__patches__/unrs-resolver@1.12.2.patch b/.config/pnpm/patches/unrs-resolver@1.12.2.patch similarity index 100% rename from __patches__/unrs-resolver@1.12.2.patch rename to .config/pnpm/patches/unrs-resolver@1.12.2.patch diff --git a/.config/pnpm/policies.yaml b/.config/pnpm/policies.yaml new file mode 100644 index 0000000000..83d2af50c0 --- /dev/null +++ b/.config/pnpm/policies.yaml @@ -0,0 +1,170 @@ +allowBuilds: + '@parcel/watcher': false + core-js: false + esbuild: true + fuse-native: true + ghooks: true + msgpackr-extract: true + unrs-resolver: true + +auditConfig: + ignoreGhsas: + - GHSA-2g4f-4pwh-qvx6 + - GHSA-76c9-3jph-rj3q + - GHSA-ffrw-9mx8-89p8 + - GHSA-mh29-5h37-fv8m + - GHSA-w5hq-g745-h8pq + # GHSA-vwc7-r8mq-g2x9: adm-zip follows pre-existing destination symlinks during + # extraction. No patched adm-zip release exists. It is only a devDependency of + # @pnpm/fetching.binary-fetcher, used to build zip fixtures, and never extracts. + - GHSA-vwc7-r8mq-g2x9 + # GHSA-h67p-54hq-rp68: js-yaml quadratic-complexity DoS in merge key handling. + # Patched only in >=4.1.2 with no v3 fix; @yarnpkg/parsers requires the js-yaml 3 + # API (yaml.safeLoad), so its transitive js-yaml cannot be upgraded. + - GHSA-h67p-54hq-rp68 + # GHSA-vfj7-8cjw-p6xm: braces stack exhaustion on deeply nested patterns. + # No patched braces release exists. pnpm expands patterns from the user's config + # and command line, or from scripts and manifests of dependencies already allowed + # to run code, so a crash gives an attacker nothing new. + - GHSA-vfj7-8cjw-p6xm + # GHSA-ch52-4w7c-c8xp: http-cache-semantics max-stale leaks other users' + # responses from a shared cache. No patched release exists. make-fetch-happen + # uses it for a private, single-user client cache, which has no other users. + - GHSA-ch52-4w7c-c8xp + # GHSA-hp3w-g68c-fv3c: sprintf-js DoS through unbounded precision specifiers. + # No patched release exists. It is reached only through argparse 1, which + # formats its own help text with it, never attacker-controlled formats. + - GHSA-hp3w-g68c-fv3c + +minimumReleaseAge: 1440 # At least a day + +minimumReleaseAgeExclude: + - '@pnpm/*' + - '@zkochan/*' + - better-path-resolve + - can-link + - can-write-to-dir + - cmd-extension + - comver-to-semver + - dir-is-case-sensitive + - '@esbuild/*' + - glob@11.1.0 + - is-inner-link + - is-subdir + - make-empty-dir + - normalize-registry-url + - path-absolute + - path-temp + - pnpm + - preferred-pm + - promise-share + - read-ini-file + - read-yaml-file + - realpath-missing + - rename-overwrite + - render-help + - resolve-link-target + - root-link-target + - safe-execa + - safe-promise-defer + - symlink-dir + - which-pm + - write-ini-file + - write-json5-file + - write-yaml-file + - http-proxy-middleware@3.0.7 + +minimumReleaseAgeExcludePrune: true + +overrides: + '@cypress/request@3.0.9>qs': ^6.14.1 + '@yarnpkg/fslib@2': '3' + '@yarnpkg/nm>@yarnpkg/core': 'catalog:' + adm-zip@<0.6.0: ^0.6.0 + ajv@>=7.0.0-alpha.0 <8.18.0: '>=8.18.0' + body-parser@<2.2.1: '^2.2.1' + brace-expansion@<5.0.5: '>=5.0.5' + clipanion: 3.2.0-rc.6 + cookie@<0.7.0: '>=0.7.0' + cross-spawn@<7.0.5: '>=7.0.5' + debug@<3.1.0: '>=3.1.0' + diff@<8.0.3: '^8.0.3' + express@<4.22.1: ^4.22.1 + follow-redirects@<=1.15.5: '>=1.15.6' + glob-parent@<5.1.2: '>=5.1.2' + glob@>=10.3.7 <=11.0.3: '^11.1.0' + handlebars@>=4.0.0 <4.7.9: '>=4.7.9' + hosted-git-info@1: 'catalog:' + istanbul-reports: npm:@zkochan/istanbul-reports + js-yaml@<3.14.2: '^3.14.2' + js-yaml@^4.0.0: 'catalog:' + json5@<2.2.2: 'catalog:' + jsonwebtoken@<=8.5.1: '>=9.0.0' + jws@<3.2.3: '^3.2.3' + lodash@<=4.17.23: '>=4.18.0' + lodash@>=4.0.0 <=4.17.22: '^4.17.23' + lodash@>=4.0.0 <=4.17.23: '>=4.18.0' + minimatch@>=7.0.0 <7.4.7: '^7.4.7' + minimatch@>=9.0.0 <10.0.0: '>=10.2.4' + nopt@5: npm:@pnpm/nopt@^0.2.1 + on-headers@<1.1.0: '>=1.1.0' + path-to-regexp@<0.1.13: ^0.1.13 + path-to-regexp@>=4.0.0 <6.3.0: '>=6.3.0' + path-to-regexp@>=7.0.0 <8.0.0: '>=8.0.0' + postman-request>qs: ^6.14.1 + qs@>=6.11.1 <=6.15.1: ^6.15.2 + request: npm:postman-request@2.88.1-postman.40 + semver@<7.5.2: 'catalog:' + send@<0.19.0: ^0.19.0 + shell-quote@<1.8.4: '>=1.8.4' + serve-static@<1.16.0: ^1.16.0 + # GHSA-w7jw-789q-3m8p / CVE-2026-9277: 1.8.4 patches critical shell-quote vulnerabilities in <=1.8.3. + shell-quote: 1.8.4 + socks@2: ^2.8.1 + tar@<=7.5.9: '>=7.5.10' + tmp@<=0.2.3: '>=0.2.4' + tough-cookie@<4.1.3: '>=4.1.3' + validator@<13.15.22: '>=13.15.22' + yaml@<2.2.2: '>=2.2.2' + http-proxy-middleware@>=0.16.0 <3.0.6: ^3.0.6 + deepmerge-ts@<8.0.0: ^8.0.0 + +packageExtensions: + '@babel/parser': + peerDependencies: + '@babel/types': '*' + # The shell's declarations import micromatch's, which it does not depend on. + '@yarnpkg/shell': + dependencies: + '@types/micromatch': ^4.0.10 + jest-circus: + dependencies: + slash: '3' + remark-parse: + dependencies: + vfile: ^6.0.0 + peerDependencies: + unified: '*' + remark-stringify: + dependencies: + vfile: ^6.0.0 + peerDependencies: + unified: '*' + +registries: + https://registry.npmjs.org/: + scopes: + - '@pnpm' + +trustPolicy: no-downgrade + +trustPolicyExclude: + - '@pnpm/*' + - '@yarnpkg/libzip@3.2.2' + - pnpm + - rxjs@7.8.2 + - undici-types@6.21.0 + +trustPolicyExcludePrune: true + +trustPolicyIgnoreAfter: 10080 # 1 week diff --git a/.config/pnpm/tasks.yaml b/.config/pnpm/tasks.yaml new file mode 100644 index 0000000000..cf579722c0 --- /dev/null +++ b/.config/pnpm/tasks.yaml @@ -0,0 +1,95 @@ +# Every `ci:*` script lives in the root manifest only, so the workflows run +# these pipelines with `--include-workspace-root --full`; the test runners do +# their own package selection and file sharding. The workflows also pass +# `--no-cache`: no task declares `outputs`, so none is cacheable today, and the +# flag keeps a check from being skipped if one ever does. +pipelines: + ts-check: [ci:compile, ci:lint] + # Named after the scripts they run: the test workflow passes one value as both + # the pipeline name and the `TEST_SCRIPT` the chunk runner re-runs. + ci:test-all: [ci:test-all] + ci:test-branch: [ci:test-branch] + ts-test-chunk: [ci:test-chunk] + rust-test: [ci:rust-test] + pnpr-test: [ci:pnpr-test] + rust-clippy: [ci:rust-clippy] + rust-doc: [ci:rust-doc] + rust-deny: [ci:rust-deny] + rust-format: [ci:rust-fmt, ci:toml-fmt] + rust-dylint: [ci:rust-dylint] + build-pnpr: [ci:build-pnpr] + +# Every entry names a script the root manifest alone defines. A name a +# workspace package also defines must not appear here: the entry would drop +# that task's default `dependsOn: ['^']` ordering, and each project's +# run of it would take a slot of the group, serializing a recursive run. +tasks: + ci:compile: + concurrencyGroup: typescript + ci:lint: + dependsOn: [ci:compile] + concurrencyGroup: typescript + ci:test-all: + concurrencyGroup: typescript + ci:test-branch: + concurrencyGroup: typescript + ci:test-chunk: + concurrencyGroup: typescript + test-all: + concurrencyGroup: typescript + test-branch: + concurrencyGroup: typescript + test-pkgs-all: + concurrencyGroup: typescript + test-pkgs-all-report-summary: + concurrencyGroup: typescript + test-pkgs-branch: + concurrencyGroup: typescript + build:pnpm: + concurrencyGroup: cargo + build:pnpm:wasm: + concurrencyGroup: cargo + build:wasm-runtime-probe: + concurrencyGroup: cargo + check:rust: + concurrencyGroup: cargo + fix:rust: + concurrencyGroup: cargo + lint:rust: + concurrencyGroup: cargo + pre-push:rust: + concurrencyGroup: cargo + priority: 10 + ready:rust: + concurrencyGroup: cargo + test:rust: + concurrencyGroup: cargo + test:rust-affected: + concurrencyGroup: cargo + test:rust-smoke: + concurrencyGroup: cargo + ci:build-pnpr: + concurrencyGroup: cargo + ci:pnpr-test: + concurrencyGroup: cargo + ci:rust-clippy: + concurrencyGroup: cargo + outputs: [] + env: [RUSTFLAGS] + ci:rust-doc: + concurrencyGroup: cargo + outputs: [] + env: [RUSTFLAGS, RUSTDOCFLAGS] + ci:rust-dylint: + concurrencyGroup: cargo + ci:rust-test: + concurrencyGroup: cargo + +# The repository is checked out into many worktrees at once, and a second +# Rust build or TypeScript test run on the same machine only takes cores and +# memory from the first. The TypeScript test scripts also share the +# `../pnpm_tmp` scratch directory across worktrees, which one of them wipes +# on startup. A task past the limit waits for a slot instead of starting. +concurrencyGroups: + cargo: 1 + typescript: 1 diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index c7f6778395..a9bb09aa57 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -6,3 +6,14 @@ /pnpm11/reviewing/license-scanner/* @weyert /pnpm11/reviewing/plugin-commands-licenses/* @weyert /pnpm11/hooks/* @d3lm + +# Supply-chain settings and code that runs on install +/pnpm-workspace.yaml @zkochan +/.config/pnpm/policies.yaml @zkochan +/.pnpmfile.cjs @zkochan +/.config/pnpm/patches/ @zkochan + +# No code owner: pnpm-workspace.yaml lets these files define only the +# catalog settings, the update settings, and the task-runner settings. +/.config/pnpm/catalog.yaml +/.config/pnpm/tasks.yaml diff --git a/.github/scripts/ts-test-scope.test.mjs b/.github/scripts/ts-test-scope.test.mjs index 75bf7f7f45..f7fd7c43b9 100644 --- a/.github/scripts/ts-test-scope.test.mjs +++ b/.github/scripts/ts-test-scope.test.mjs @@ -38,7 +38,7 @@ test('PR scope stays pinned when main advances; global changes and missing bases assert.equal(scope().full_tests, 'false', 'TS code plus release notes remain affected') commit(checkout, 'pnpm/crates/example/src/lib.rs', 'rust') assert.equal(scope().full_tests, 'false', 'TS code plus pacquet sources remain affected') - for (const file of ['package.json', 'pnpm-lock.yaml', '.pnpmfile.cjs', 'pnpm-workspace.yaml', '__patches__/dependency.patch', '.github/scripts/new-helper.mjs', '.changeset/config.json', 'pnpr/crates/example/src/lib.rs', 'pnpr/.fixtures/packages/example/package.json', 'Cargo.lock']) { + for (const file of ['package.json', 'pnpm-lock.yaml', '.pnpmfile.cjs', 'pnpm-workspace.yaml', '.config/pnpm/patches/dependency.patch', '.github/scripts/new-helper.mjs', '.changeset/config.json', 'pnpr/crates/example/src/lib.rs', 'pnpr/.fixtures/packages/example/package.json', 'Cargo.lock']) { commit(checkout, file, 'global input') assert.equal(scope().full_tests, 'true', file) git(checkout, 'reset', '--hard', 'HEAD^') diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 83e07f49c2..0e0dbda814 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -28,6 +28,7 @@ on: - 'pnpm11/**' - 'package.json' - 'pnpm-workspace.yaml' + - '.config/pnpm/**' - 'pnpm-lock.yaml' - '.github/workflows/benchmark.yml' diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3233ff5603..8729800dce 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -56,7 +56,7 @@ jobs: ts: - 'pnpm11/**' - '.meta-updater/**' - - '__patches__/**' + - '.config/pnpm/**' - 'package.json' - 'pnpm-workspace.yaml' - 'pnpm-lock.yaml' diff --git a/.github/workflows/pacquet-ci.yml b/.github/workflows/pacquet-ci.yml index be07c80f1a..b31543a524 100644 --- a/.github/workflows/pacquet-ci.yml +++ b/.github/workflows/pacquet-ci.yml @@ -89,6 +89,7 @@ jobs: - 'package.json' - 'pnpm-lock.yaml' - 'pnpm-workspace.yaml' + - '.config/pnpm/**' - 'rust-toolchain.toml' - 'rustfmt.toml' - 'deny.toml' diff --git a/.github/workflows/pacquet-integrated-benchmark.yml b/.github/workflows/pacquet-integrated-benchmark.yml index bed3ec102e..6c61d4b3a4 100644 --- a/.github/workflows/pacquet-integrated-benchmark.yml +++ b/.github/workflows/pacquet-integrated-benchmark.yml @@ -23,6 +23,7 @@ on: - 'pnpm/tasks/registry-mock/package.json' - 'pnpm-lock.yaml' - 'pnpm-workspace.yaml' + - '.config/pnpm/**' - 'pnpm/tasks/integrated-benchmark/src/fixtures/**' - '.github/actions/rustup/**' - '.github/actions/binstall/**' @@ -52,6 +53,7 @@ on: - 'pnpm/tasks/registry-mock/package.json' - 'pnpm-lock.yaml' - 'pnpm-workspace.yaml' + - '.config/pnpm/**' - 'pnpm/tasks/integrated-benchmark/src/fixtures/**' - '.github/actions/rustup/**' - '.github/actions/binstall/**' diff --git a/.github/workflows/pnpm-wasm.yml b/.github/workflows/pnpm-wasm.yml index 1c1e18b783..c756942781 100644 --- a/.github/workflows/pnpm-wasm.yml +++ b/.github/workflows/pnpm-wasm.yml @@ -13,7 +13,7 @@ on: - 'Cargo.lock' - 'rust-toolchain.toml' - '.cargo/**' - - '__patches__/**' + - '.config/pnpm/**' - 'package.json' - 'pnpm-lock.yaml' - 'pnpm-workspace.yaml' diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index e2bad2d622..c6cfd3577a 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -65,101 +65,32 @@ packages: - '!**/test/**' - '!pnpm11/resolving/local-resolver/example-package/**' -# Every `ci:*` script lives in the root manifest only, so the workflows run -# these pipelines with `--include-workspace-root --full`; the test runners do -# their own package selection and file sharding. The workflows also pass -# `--no-cache`: no task declares `outputs`, so none is cacheable today, and the -# flag keeps a check from being skipped if one ever does. -pipelines: - ts-check: [ci:compile, ci:lint] - # Named after the scripts they run: the test workflow passes one value as both - # the pipeline name and the `TEST_SCRIPT` the chunk runner re-runs. - ci:test-all: [ci:test-all] - ci:test-branch: [ci:test-branch] - ts-test-chunk: [ci:test-chunk] - rust-test: [ci:rust-test] - pnpr-test: [ci:pnpr-test] - rust-clippy: [ci:rust-clippy] - rust-doc: [ci:rust-doc] - rust-deny: [ci:rust-deny] - rust-format: [ci:rust-fmt, ci:toml-fmt] - rust-dylint: [ci:rust-dylint] - build-pnpr: [ci:build-pnpr] - -# Every entry names a script the root manifest alone defines. A name a -# workspace package also defines must not appear here: the entry would drop -# that task's default `dependsOn: ['^']` ordering, and each project's -# run of it would take a slot of the group, serializing a recursive run. -tasks: - ci:compile: - concurrencyGroup: typescript - ci:lint: - dependsOn: [ci:compile] - concurrencyGroup: typescript - ci:test-all: - concurrencyGroup: typescript - ci:test-branch: - concurrencyGroup: typescript - ci:test-chunk: - concurrencyGroup: typescript - test-all: - concurrencyGroup: typescript - test-branch: - concurrencyGroup: typescript - test-pkgs-all: - concurrencyGroup: typescript - test-pkgs-all-report-summary: - concurrencyGroup: typescript - test-pkgs-branch: - concurrencyGroup: typescript - build:pnpm: - concurrencyGroup: cargo - build:pnpm:wasm: - concurrencyGroup: cargo - build:wasm-runtime-probe: - concurrencyGroup: cargo - check:rust: - concurrencyGroup: cargo - fix:rust: - concurrencyGroup: cargo - lint:rust: - concurrencyGroup: cargo - pre-push:rust: - concurrencyGroup: cargo - priority: 10 - ready:rust: - concurrencyGroup: cargo - test:rust: - concurrencyGroup: cargo - test:rust-affected: - concurrencyGroup: cargo - test:rust-smoke: - concurrencyGroup: cargo - ci:build-pnpr: - concurrencyGroup: cargo - ci:pnpr-test: - concurrencyGroup: cargo - ci:rust-clippy: - concurrencyGroup: cargo - outputs: [] - env: [RUSTFLAGS] - ci:rust-doc: - concurrencyGroup: cargo - outputs: [] - env: [RUSTFLAGS, RUSTDOCFLAGS] - ci:rust-dylint: - concurrencyGroup: cargo - ci:rust-test: - concurrencyGroup: cargo - -# The repository is checked out into many worktrees at once, and a second -# Rust build or TypeScript test run on the same machine only takes cores and -# memory from the first. The TypeScript test scripts also share the -# `../pnpm_tmp` scratch directory across worktrees, which one of them wipes -# on startup. A task past the limit waits for a slot instead of starting. -concurrencyGroups: - cargo: 1 - typescript: 1 +include: + ./.config/pnpm/policies.yaml: + - allowBuilds + - auditConfig + - minimumReleaseAge + - minimumReleaseAgeExclude + - minimumReleaseAgeExcludePrune + - overrides + - packageExtensions + - registries + - trustPolicy + - trustPolicyExclude + - trustPolicyExcludePrune + - trustPolicyIgnoreAfter + ./.config/pnpm/patches/patches.yaml: + - patchedDependencies + - patchesDir + ./.config/pnpm/catalog.yaml: + - catalogMode + - catalogPrune + - catalogs + - update + ./.config/pnpm/tasks.yaml: + - concurrencyGroups + - pipelines + - tasks # Native workspace release management (consumed by `pnpm change` / `pnpm version -r`). # The Rust CLI wrapper is the workspace package `pacquet` (published to npm as @@ -200,353 +131,9 @@ versioning: '@pnpm/pnpr': alpha '@pnpm/pnpr-ui': alpha -allowBuilds: - '@parcel/watcher': false - core-js: false - esbuild: true - fuse-native: true - ghooks: true - msgpackr-extract: true - unrs-resolver: true - -auditConfig: - ignoreGhsas: - - GHSA-2g4f-4pwh-qvx6 - - GHSA-76c9-3jph-rj3q - - GHSA-ffrw-9mx8-89p8 - - GHSA-mh29-5h37-fv8m - - GHSA-w5hq-g745-h8pq - # GHSA-vwc7-r8mq-g2x9: adm-zip follows pre-existing destination symlinks during - # extraction. No patched adm-zip release exists. It is only a devDependency of - # @pnpm/fetching.binary-fetcher, used to build zip fixtures, and never extracts. - - GHSA-vwc7-r8mq-g2x9 - # GHSA-h67p-54hq-rp68: js-yaml quadratic-complexity DoS in merge key handling. - # Patched only in >=4.1.2 with no v3 fix; @yarnpkg/parsers requires the js-yaml 3 - # API (yaml.safeLoad), so its transitive js-yaml cannot be upgraded. - - GHSA-h67p-54hq-rp68 - # GHSA-vfj7-8cjw-p6xm: braces stack exhaustion on deeply nested patterns. - # No patched braces release exists. pnpm expands patterns from the user's config - # and command line, or from scripts and manifests of dependencies already allowed - # to run code, so a crash gives an attacker nothing new. - - GHSA-vfj7-8cjw-p6xm - # GHSA-ch52-4w7c-c8xp: http-cache-semantics max-stale leaks other users' - # responses from a shared cache. No patched release exists. make-fetch-happen - # uses it for a private, single-user client cache, which has no other users. - - GHSA-ch52-4w7c-c8xp - # GHSA-hp3w-g68c-fv3c: sprintf-js DoS through unbounded precision specifiers. - # No patched release exists. It is reached only through argparse 1, which - # formats its own help text with it, never attacker-controlled formats. - - GHSA-hp3w-g68c-fv3c - cargo: enabled: true -catalog: - # @babel/core 8.x (and its plugins) require Node.js ^22.18.0 || >=24.11.0, - # above pnpm's supported floor of Node.js >=22.13. - '@babel/core': ^7.29.7 - '@babel/plugin-transform-explicit-resource-management': ^7.29.7 - '@commitlint/cli': ^21.2.4 - '@commitlint/config-conventional': ^21.2.4 - '@commitlint/prompt-cli': ^21.2.4 - '@cyclonedx/cyclonedx-library': 10.3.0 - '@emnapi/wasi-threads': 2.2.0 - '@eslint/js': ^10.0.1 - '@inquirer/prompts': ^8.7.4 - # Jest 30.5.0 breaks ESM package imports in the Jest runtime. - '@jest/globals': 30.4.1 - '@npm/types': ^2.1.0 - '@pnpm/byline': ^1.0.0 - '@pnpm/colorize-semver-diff': ^2.0.0 - '@pnpm/exec': ^4.0.0 - '@pnpm/logger': '^1100.0.0' - '@pnpm/meta-updater': 2.0.6 - '@pnpm/nopt': ^0.3.1 - '@pnpm/npm-package-arg': ^2.0.0 - '@pnpm/patch-package': 0.0.1 - '@pnpm/semver-diff': ^2.0.0 - '@pnpm/tabtab': ^0.5.4 - '@pnpm/tgz-fixtures': 0.0.0 - '@reflink/reflink': 0.1.19 - '@rushstack/worker-pool': 0.7.30 - '@stylistic/eslint-plugin': ^5.10.0 - '@tybys/wasm-util': 0.10.4 - '@types/adm-zip': ^0.6.0 - '@types/archy': 0.0.36 - '@types/cross-spawn': ^6.0.6 - '@types/fs-extra': ^11.0.4 - '@types/graceful-fs': ^4.1.9 - '@types/hosted-git-info': ^3.0.5 - '@types/ini': 4.1.1 - '@types/is-gzip': 2.0.2 - '@types/is-windows': ^1.0.2 - '@types/isexe': 2.0.4 - '@types/jest': ^30.0.0 - '@types/js-yaml': ^4.0.9 - '@types/libnpmpublish': ^11.2.0 - '@types/lodash.kebabcase': 4.1.9 - '@types/lodash.throttle': 4.1.9 - '@types/micromatch': ^4.0.10 - # Kept on 22.x to match pnpm's minimum supported Node.js version (>=22.13); - # newer majors would type APIs that don't exist on the supported floor. - '@types/node': ^22.19.19 - '@types/normalize-package-data': ^2.4.4 - '@types/normalize-path': ^3.0.2 - '@types/npm-registry-fetch': ^8.0.9 - '@types/object-hash': 3.0.6 - '@types/parse-json': ^7.0.0 - '@types/picomatch': ^4.0.3 - '@types/pnpm__byline': npm:@types/byline@^4.2.36 - '@types/proxyquire': ^1.3.31 - '@types/qrcode-terminal': ^0.12.2 - '@types/ramda': 0.32.0 - '@types/retry': ^0.12.5 - '@types/semver': 7.8.0 - '@types/spdx-expression-parse': 4.0.0 - '@types/ssri': ^7.1.5 - '@types/tar-stream': ^3.1.5 - '@types/touch': ^3.1.5 - '@types/validate-npm-package-name': ^4.0.2 - '@types/which': ^3.0.4 - '@types/write-file-atomic': ^4.0.3 - '@types/yarnpkg__lockfile': ^1.1.9 - '@types/yauzl': ^3.4.0 - '@types/zkochan__table': npm:@types/table@6.3.2 - '@typescript-eslint/utils': ^8.72.0 - '@typescript/native-preview': 7.0.0-dev.20260707.2 - '@webcontainer/api': ^1.6.4 - # @yarnpkg/core 4.9.2 was published with a Yarn `patch:` specifier for its - # `got` dependency, which pnpm resolves to a nonexistent local path. The - # `@yarnpkg/nm` override keeps its transitive copy on this version too. - '@yarnpkg/core': 4.9.1 - '@yarnpkg/extensions': 2.0.7 - '@yarnpkg/fslib': ^3.1.5 - '@yarnpkg/lockfile': ^1.1.0 - '@yarnpkg/nm': 4.1.1 - '@yarnpkg/parsers': 3.1.0 - '@yarnpkg/pnp': ^4.1.7 - '@yarnpkg/shell': 4.1.3 - '@zkochan/retry': ^0.2.0 - '@zkochan/rimraf': ^4.0.0 - '@zkochan/table': ^2.0.1 - adm-zip: ^0.6.1 - agentkeepalive: ^4.6.0 - amaro: ^1.2.1 - ansi-diff: ^1.2.0 - archy: ^1.0.0 - better-path-resolve: 2.0.0 - # bin-links 7.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's - # supported floor of Node.js >=22.13. - bin-links: ^6.0.2 - # bole 6 is ESM-only. Under Jest, the workspace logger's ESM bole and the - # published @pnpm/logger's CJS bole 5 land in different realms, so the - # globalThis.$$bole output registry is no longer shared and log events - # emitted through one logger copy never reach the other's streamParser. - # Keep bole 5 until the published @pnpm/logger ships with bole 6. - bole: ^5.0.29 - boxen: npm:@zkochan/boxen@5.1.2 - c8: ^12.0.0 - camelcase: ^10.0.0 - camelcase-keys: ^10.0.3 - can-link: ^3.0.0 - can-write-to-dir: ^2.0.0 - chalk: ^6.0.1 - ci-info: ^4.4.0 - cli-truncate: ^6.1.1 - cmd-extension: ^2.0.0 - comver-to-semver: ^2.0.0 - cross-env: ^10.1.0 - cross-spawn: ^7.0.6 - # cspell 10.x requires Node.js >=22.18.0, above pnpm's supported floor of - # Node.js >=22.13. - cspell: 9.8.0 - deep-require-cwd: 1.0.0 - delay: ^7.0.0 - detect-indent: 7.0.2 - detect-libc: ^2.1.2 - didyoumean2: ^7.0.4 - dint: ^5.1.0 - dir-is-case-sensitive: ^3.0.0 - empathic: ^2.1.0 - esbuild: ^0.28.2 - escape-string-regexp: ^5.0.0 - eslint: ^10.13.0 - eslint-plugin-import-x: ^4.17.1 - eslint-plugin-jest: ^29.17.0 - eslint-plugin-n: ^18.5.0 - eslint-plugin-promise: ^7.3.0 - eslint-plugin-regexp: ^3.1.1 - eslint-plugin-simple-import-sort: ^14.0.0 - execa: npm:safe-execa@0.3.0 - exists-link: 2.0.0 - fast-deep-equal: ^3.1.3 - fast-glob: ^3.3.3 - fs-extra: ^11.4.1 - fuse-native: ^2.2.6 - # Bundled into the pnpm 12 wrapper's dist/ payload, where the Corepack entry - # point loads it from; see pnpm/npm/pnpm/bin/pnpm.mjs. - get-pnpm: ^0.0.5 - get-port: ^7.2.0 - ghooks: 2.0.4 - graceful-fs: ^4.2.11 - graph-cycles: 3.0.0 - hosted-git-info: npm:@pnpm/hosted-git-info@1.0.0 - http-proxy-agent: ^9.1.0 - https-proxy-agent: ^9.1.0 - https-proxy-server-express: 0.1.2 - husky: ^9.1.7 - hyperdrive-schemas: ^2.0.0 - # ini 7.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's - # supported floor of Node.js >=22.13. - ini: 6.0.0 - is-gzip: 2.0.0 - is-inner-link: ^5.0.0 - is-subdir: ^2.0.1 - is-windows: ^1.0.2 - isexe: 4.0.0 - jest: 30.4.2 - jest-diff: 30.4.1 - human-id: ^4.2.2 - js-yaml: npm:@zkochan/js-yaml@0.0.11 - json5: ^2.2.3 - keyv: 6.1.0 - lcov-result-merger: ^6.0.0 - # libnpmpublish 12.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above - # pnpm's supported floor of Node.js >=22.13. - libnpmpublish: ^11.2.0 - load-json-file: ^7.0.1 - lodash.kebabcase: ^4.1.1 - lodash.throttle: 4.1.1 - loud-rejection: ^2.2.0 - lru-cache: ^11.5.3 - make-empty-dir: ^4.0.0 - mdast-util-to-string: ^4.0.0 - memfs: ^4.80.0 - memoize: ^11.0.0 - micromatch: ^4.0.8 - msgpackr: 2.1.2 - nm-prune: ^5.0.0 - # node-gyp 13 (with its nopt 10 and which 7 dependencies) requires Node.js - # ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's supported floor of >=22.13. - node-gyp: ^12.3.0 - normalize-newline: 5.0.0 - # normalize-package-data 9.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, - # above pnpm's supported floor of Node.js >=22.13. - normalize-package-data: ^8.0.0 - normalize-path: ^3.0.0 - normalize-registry-url: 2.0.1 - # npm-packlist 11.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above - # pnpm's supported floor of Node.js >=22.13. - npm-packlist: 10.0.4 - # npm-registry-fetch 20.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, - # above pnpm's supported floor of Node.js >=22.13. - npm-registry-fetch: ^19.0.0 - object-hash: 3.0.0 - open: ^11.0.4 - openpgp: ^6.3.2 - '@openpgp/web-stream-tools': 0.3.1 - p-defer: ^4.0.1 - p-every: ^2.0.0 - p-filter: ^4.1.0 - p-limit: ^7.3.3 - p-queue: ^10.0.0 - parse-json: ^8.3.0 - path-absolute: ^2.0.0 - path-exists: ^5.0.0 - path-name: ^1.0.0 - path-temp: ^3.0.0 - pidtree: ^1.0.0 - playwright-core: ^1.64.1 - preferred-pm: ^5.0.1 - pretty-bytes: ^7.2.0 - pretty-ms: ^10.0.0 - promise-share: ^2.0.1 - proxy: ^4.1.0 - proxyquire: ^2.1.3 - ps-list: ^9.0.0 - qrcode-terminal: ^0.12.0 - ramda: npm:@pnpm/ramda@0.28.1 - read-ini-file: 5.0.0 - read-yaml-file: ^3.0.0 - realpath-missing: ^2.0.0 - remark-parse: ^11.0.0 - remark-stringify: ^11.0.0 - rename-overwrite: ^7.0.1 - render-help: ^2.0.0 - resolve-link-target: ^3.0.0 - rimraf: ^6.1.3 - root-link-target: ^4.0.0 - rxjs: ^7.8.2 - safe-buffer: 5.2.1 - safe-execa: ^0.3.0 - safe-promise-defer: ^2.0.0 - sanitize-filename: ^1.6.4 - seek-bzip: 2.0.0 - semver: ^7.8.5 - semver-range-intersect: ^0.3.1 - semver-utils: ^1.1.4 - shlex: ^3.0.0 - shx: ^0.4.0 - signal-exit: ^4.1.0 - socks: ^2.8.10 - socks-proxy-agent: ^10.1.0 - sort-keys: ^6.0.1 - spdx-expression-parse: 5.0.0 - split-cmd: ^1.1.0 - split2: ^4.2.0 - # ssri 14.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's - # supported floor of Node.js >=22.13. - ssri: 13.0.1 - stacktracey: ^2.2.0 - string-length: ^7.0.1 - string-width: ^8.3.0 - strip-bom: ^5.0.0 - strip-comments-strings: 1.2.0 - symlink-dir: ^10.0.3 - tar: ^7.5.22 - tar-stream: ^3.2.2 - # tempy >=3.1.0 uses temp-dir 3.x which has an async fs.realpath() in its - # module init. When esbuild bundles this into its __esm lazy-init pattern, - # the async operation deadlocks and the pnpm binary hangs on startup. - tempy: 3.0.0 - terminal-link: ^5.0.0 - tinyglobby: ^0.2.17 - touch: 3.1.1 - tree-kill: ^1.2.2 - ts-jest-resolver: 2.0.1 - # Kept on 6.x because typescript-eslint does not support the TypeScript 7.0 API - # yet (https://github.com/typescript-eslint/typescript-eslint/issues/10940); the - # 7.x compiler ships separately as @typescript/native-preview (tsgo). - typescript: 6.0.3 - typescript-eslint: ^8.72.0 - uid-number: 0.0.6 - # undici 8.x requires Node.js >=22.19.0, above pnpm's supported floor of - # Node.js >=22.13. - undici: ^7.29.1 - unified: ^11.0.5 - # validate-npm-package-name 8.x requires Node.js ^22.22.2 || ^24.15.0 || - # >=26.0.0, above pnpm's supported floor of Node.js >=22.13. - validate-npm-package-name: 7.0.2 - version-selector-type: ^3.0.0 - vfile: ^6.0.3 - which: npm:@pnpm/which@^3.0.1 - # write-file-atomic 8.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, - # above pnpm's supported floor of Node.js >=22.13. - write-file-atomic: ^7.0.1 - write-ini-file: 5.0.0 - write-json-file: ^7.0.0 - write-json5-file: ^4.0.0 - write-package: 7.2.0 - write-yaml-file: ^6.0.0 - yaml: ^2.9.1 - yaml-tag: 1.1.0 - yauzl: ^3.4.0 - enhanced-resolve: 5.26.0 - -catalogMode: strict - -catalogPrune: true - enablePrePostScripts: false engineStrict: false @@ -556,190 +143,17 @@ gitChecks: false hoistPattern: - jest-runner -minimumReleaseAge: 1440 # At least a day - -minimumReleaseAgeExclude: - - '@pnpm/*' - - '@zkochan/*' - - better-path-resolve - - can-link - - can-write-to-dir - - cmd-extension - - comver-to-semver - - dir-is-case-sensitive - - '@esbuild/*' - - glob@11.1.0 - - is-inner-link - - is-subdir - - make-empty-dir - - normalize-registry-url - - path-absolute - - path-temp - - pnpm - - preferred-pm - - promise-share - - read-ini-file - - read-yaml-file - - realpath-missing - - rename-overwrite - - render-help - - resolve-link-target - - root-link-target - - safe-execa - - safe-promise-defer - - symlink-dir - - which-pm - - write-ini-file - - write-json5-file - - write-yaml-file - - http-proxy-middleware@3.0.7 - lockfile: includeResolutionSettings: true -minimumReleaseAgeExcludePrune: true - nodeVersion: 22.13.0 -overrides: - '@cypress/request@3.0.9>qs': ^6.14.1 - '@yarnpkg/fslib@2': '3' - '@yarnpkg/nm>@yarnpkg/core': 'catalog:' - adm-zip@<0.6.0: ^0.6.0 - ajv@>=7.0.0-alpha.0 <8.18.0: '>=8.18.0' - body-parser@<2.2.1: '^2.2.1' - brace-expansion@<5.0.5: '>=5.0.5' - clipanion: 3.2.0-rc.6 - cookie@<0.7.0: '>=0.7.0' - cross-spawn@<7.0.5: '>=7.0.5' - debug@<3.1.0: '>=3.1.0' - diff@<8.0.3: '^8.0.3' - express@<4.22.1: ^4.22.1 - follow-redirects@<=1.15.5: '>=1.15.6' - glob-parent@<5.1.2: '>=5.1.2' - glob@>=10.3.7 <=11.0.3: '^11.1.0' - handlebars@>=4.0.0 <4.7.9: '>=4.7.9' - hosted-git-info@1: 'catalog:' - istanbul-reports: npm:@zkochan/istanbul-reports - js-yaml@<3.14.2: '^3.14.2' - js-yaml@^4.0.0: 'catalog:' - json5@<2.2.2: 'catalog:' - jsonwebtoken@<=8.5.1: '>=9.0.0' - jws@<3.2.3: '^3.2.3' - lodash@<=4.17.23: '>=4.18.0' - lodash@>=4.0.0 <=4.17.22: '^4.17.23' - lodash@>=4.0.0 <=4.17.23: '>=4.18.0' - minimatch@>=7.0.0 <7.4.7: '^7.4.7' - minimatch@>=9.0.0 <10.0.0: '>=10.2.4' - nopt@5: npm:@pnpm/nopt@^0.2.1 - on-headers@<1.1.0: '>=1.1.0' - path-to-regexp@<0.1.13: ^0.1.13 - path-to-regexp@>=4.0.0 <6.3.0: '>=6.3.0' - path-to-regexp@>=7.0.0 <8.0.0: '>=8.0.0' - postman-request>qs: ^6.14.1 - qs@>=6.11.1 <=6.15.1: ^6.15.2 - request: npm:postman-request@2.88.1-postman.40 - semver@<7.5.2: 'catalog:' - send@<0.19.0: ^0.19.0 - shell-quote@<1.8.4: '>=1.8.4' - serve-static@<1.16.0: ^1.16.0 - # GHSA-w7jw-789q-3m8p / CVE-2026-9277: 1.8.4 patches critical shell-quote vulnerabilities in <=1.8.3. - shell-quote: 1.8.4 - socks@2: ^2.8.1 - tar@<=7.5.9: '>=7.5.10' - tmp@<=0.2.3: '>=0.2.4' - tough-cookie@<4.1.3: '>=4.1.3' - validator@<13.15.22: '>=13.15.22' - yaml@<2.2.2: '>=2.2.2' - http-proxy-middleware@>=0.16.0 <3.0.6: ^3.0.6 - deepmerge-ts@<8.0.0: ^8.0.0 - -packageExtensions: - '@babel/parser': - peerDependencies: - '@babel/types': '*' - # The shell's declarations import micromatch's, which it does not depend on. - '@yarnpkg/shell': - dependencies: - '@types/micromatch': ^4.0.10 - jest-circus: - dependencies: - slash: '3' - remark-parse: - dependencies: - vfile: ^6.0.0 - peerDependencies: - unified: '*' - remark-stringify: - dependencies: - vfile: ^6.0.0 - peerDependencies: - unified: '*' - -patchedDependencies: - '@tybys/wasm-util@0.10.4': __patches__/@tybys__wasm-util@0.10.4.patch - graceful-fs@4.2.11: __patches__/graceful-fs@4.2.11.patch - normalize-registry-url@2.0.1: __patches__/normalize-registry-url@2.0.1.patch - unrs-resolver@1.12.2: __patches__/unrs-resolver@1.12.2.patch - -patchesDir: __patches__ - publishBranch: main resolutionMode: lowest-direct savePrefix: '' -trustPolicy: no-downgrade - -trustPolicyExclude: - - '@pnpm/*' - - '@yarnpkg/libzip@3.2.2' - - pnpm - - rxjs@7.8.2 - - undici-types@6.21.0 - -trustPolicyExcludePrune: true - -trustPolicyIgnoreAfter: 10080 # 1 week - -# Dependencies deliberately held back, which `pnpm update --latest` (run by the -# update-lockfile workflow) would otherwise bump. Most of them are packages -# whose newer versions require a Node.js version above pnpm's supported floor -# (>=22.13); the comment at each catalog entry above records the reason. -# typescript is held on 6.x because typescript-eslint does not support the -# TypeScript 7.0 API yet. -update: - ignoreDeps: - - '@babel/core' - - '@babel/plugin-transform-explicit-resource-management' - - '@jest/globals' - - '@types/node' - - '@yarnpkg/core' - - bin-links - - bole - - cspell - - eslint-plugin-regexp - - ini - - jest - - jest-diff - - libnpmpublish - - node-gyp - - normalize-package-data - - npm-packlist - - npm-registry-fetch - - ssri - - tempy - - typescript - - undici - - validate-npm-package-name - - write-file-atomic - virtualStoreType: global autoDedupe: true - -registries: - https://registry.npmjs.org/: - scopes: - - '@pnpm'