From 82e235bacfffe6b9bebe0cc120f2b876f80d021b Mon Sep 17 00:00:00 2001 From: Zoltan Kochan Date: Wed, 21 Oct 2026 14:33:59 +0200 Subject: [PATCH] chore: split workspace settings into policy, catalog, and task files (#17192) * chore: move supply-chain settings to a protected config file Use the `include` setting from pnpm 12.15 to move the settings that decide what gets installed and what may run into .config/pnpm/security.yaml: allowBuilds, auditConfig, the minimumReleaseAge and trustPolicy settings, overrides, packageExtensions, patchedDependencies, patchesDir, and registries. pnpm-workspace.yaml delegates exactly that list, so no other file can define those settings. Patch paths are relative to the included file. pnpm 12.14 ignores `include` and would drop every moved setting, so the packageManager pin moves to 12.15.0. CODEOWNERS now names both workspace files, the pnpmfile, and the patches explicitly, and the CI path filters watch the new file. Co-Authored-By: Claude Opus 5.5 * chore: move routine settings to a file without a code owner The catalog, the update settings, and the task-runner settings (pipelines, tasks, concurrencyGroups) move to .config/pnpm/routine.yaml, which CODEOWNERS leaves unowned. Because pnpm-workspace.yaml delegates only that list to the file, any other setting defined there fails with ERR_PNPM_SETTING_NOT_DELEGATED, so the file cannot be used to change the protected settings. Co-Authored-By: Claude Opus 5.5 * chore: move the catalogs to their own file .config/pnpm/catalog.yaml owns `catalogs`, which covers the default catalog and any named catalog added later. Like routine.yaml, it has no code owner. Co-Authored-By: Claude Opus 5.5 * chore: name the protected file policies.yaml and give tasks their own file security.yaml becomes policies.yaml. The task-runner settings (pipelines, tasks, concurrencyGroups) move to tasks.yaml, and `update` joins the catalogs in catalog.yaml, since its ignoreDeps list holds back catalog entries. routine.yaml is gone. Co-Authored-By: Claude Opus 5.5 * chore: move catalogMode and catalogPrune to catalog.yaml Co-Authored-By: Claude Opus 5.5 * chore: keep the patch list next to the patches patchedDependencies and patchesDir move to __patches__/patches.yaml, so the entries name the patch files without a directory prefix and patchesDir is `.`. CODEOWNERS already covers __patches__/. The CI path filters that did not watch __patches__/ now watch patches.yaml, since they watched the patch list when it lived in pnpm-workspace.yaml. Co-Authored-By: Claude Opus 5.5 * chore: move the patches to .config/pnpm/patches Every pnpm configuration file now lives under .config/pnpm, so each CI path filter watches `.config/pnpm/**` instead of listing the files. CODEOWNERS keeps the patches protected. Co-Authored-By: Claude Opus 5.5 --------- Co-authored-by: Claude Opus 5.5 --- .config/pnpm/catalog.yaml | 337 +++++++++ .../patches}/@tybys__wasm-util@0.10.4.patch | 0 .../pnpm/patches}/graceful-fs@4.2.11.patch | 0 .../patches}/mdast-util-to-string@2.0.0.patch | 0 .../normalize-registry-url@2.0.1.patch | 0 .config/pnpm/patches/patches.yaml | 7 + .../pnpm/patches}/unrs-resolver@1.12.2.patch | 0 .config/pnpm/policies.yaml | 170 +++++ .config/pnpm/tasks.yaml | 95 +++ .github/CODEOWNERS | 11 + .github/scripts/ts-test-scope.test.mjs | 2 +- .github/workflows/benchmark.yml | 1 + .github/workflows/ci.yml | 2 +- .github/workflows/pacquet-ci.yml | 1 + .../pacquet-integrated-benchmark.yml | 2 + .github/workflows/pnpm-wasm.yml | 2 +- pnpm-workspace.yaml | 638 +----------------- 17 files changed, 653 insertions(+), 615 deletions(-) create mode 100644 .config/pnpm/catalog.yaml rename {__patches__ => .config/pnpm/patches}/@tybys__wasm-util@0.10.4.patch (100%) rename {__patches__ => .config/pnpm/patches}/graceful-fs@4.2.11.patch (100%) rename {__patches__ => .config/pnpm/patches}/mdast-util-to-string@2.0.0.patch (100%) rename {__patches__ => .config/pnpm/patches}/normalize-registry-url@2.0.1.patch (100%) create mode 100644 .config/pnpm/patches/patches.yaml rename {__patches__ => .config/pnpm/patches}/unrs-resolver@1.12.2.patch (100%) create mode 100644 .config/pnpm/policies.yaml create mode 100644 .config/pnpm/tasks.yaml diff --git a/.config/pnpm/catalog.yaml b/.config/pnpm/catalog.yaml new file mode 100644 index 0000000000..00b033e551 --- /dev/null +++ b/.config/pnpm/catalog.yaml @@ -0,0 +1,337 @@ +catalog: + # @babel/core 8.x (and its plugins) require Node.js ^22.18.0 || >=24.11.0, + # above pnpm's supported floor of Node.js >=22.13. + '@babel/core': ^7.29.7 + '@babel/plugin-transform-explicit-resource-management': ^7.29.7 + '@commitlint/cli': ^21.2.4 + '@commitlint/config-conventional': ^21.2.4 + '@commitlint/prompt-cli': ^21.2.4 + '@cyclonedx/cyclonedx-library': 10.3.0 + '@emnapi/wasi-threads': 2.2.0 + '@eslint/js': ^10.0.1 + '@inquirer/prompts': ^8.7.4 + # Jest 30.5.0 breaks ESM package imports in the Jest runtime. + '@jest/globals': 30.4.1 + '@npm/types': ^2.1.0 + '@pnpm/byline': ^1.0.0 + '@pnpm/colorize-semver-diff': ^2.0.0 + '@pnpm/exec': ^4.0.0 + '@pnpm/logger': '^1100.0.0' + '@pnpm/meta-updater': 2.0.6 + '@pnpm/nopt': ^0.3.1 + '@pnpm/npm-package-arg': ^2.0.0 + '@pnpm/patch-package': 0.0.1 + '@pnpm/semver-diff': ^2.0.0 + '@pnpm/tabtab': ^0.5.4 + '@pnpm/tgz-fixtures': 0.0.0 + '@reflink/reflink': 0.1.19 + '@rushstack/worker-pool': 0.7.30 + '@stylistic/eslint-plugin': ^5.10.0 + '@tybys/wasm-util': 0.10.4 + '@types/adm-zip': ^0.6.0 + '@types/archy': 0.0.36 + '@types/cross-spawn': ^6.0.6 + '@types/fs-extra': ^11.0.4 + '@types/graceful-fs': ^4.1.9 + '@types/hosted-git-info': ^3.0.5 + '@types/ini': 4.1.1 + '@types/is-gzip': 2.0.2 + '@types/is-windows': ^1.0.2 + '@types/isexe': 2.0.4 + '@types/jest': ^30.0.0 + '@types/js-yaml': ^4.0.9 + '@types/libnpmpublish': ^11.2.0 + '@types/lodash.kebabcase': 4.1.9 + '@types/lodash.throttle': 4.1.9 + '@types/micromatch': ^4.0.10 + # Kept on 22.x to match pnpm's minimum supported Node.js version (>=22.13); + # newer majors would type APIs that don't exist on the supported floor. + '@types/node': ^22.19.19 + '@types/normalize-package-data': ^2.4.4 + '@types/normalize-path': ^3.0.2 + '@types/npm-registry-fetch': ^8.0.9 + '@types/object-hash': 3.0.6 + '@types/parse-json': ^7.0.0 + '@types/picomatch': ^4.0.3 + '@types/pnpm__byline': npm:@types/byline@^4.2.36 + '@types/proxyquire': ^1.3.31 + '@types/qrcode-terminal': ^0.12.2 + '@types/ramda': 0.32.0 + '@types/retry': ^0.12.5 + '@types/semver': 7.8.0 + '@types/spdx-expression-parse': 4.0.0 + '@types/ssri': ^7.1.5 + '@types/tar-stream': ^3.1.5 + '@types/touch': ^3.1.5 + '@types/validate-npm-package-name': ^4.0.2 + '@types/which': ^3.0.4 + '@types/write-file-atomic': ^4.0.3 + '@types/yarnpkg__lockfile': ^1.1.9 + '@types/yauzl': ^3.4.0 + '@types/zkochan__table': npm:@types/table@6.3.2 + '@typescript-eslint/utils': ^8.72.0 + '@typescript/native-preview': 7.0.0-dev.20260707.2 + '@webcontainer/api': ^1.6.4 + # @yarnpkg/core 4.9.2 was published with a Yarn `patch:` specifier for its + # `got` dependency, which pnpm resolves to a nonexistent local path. The + # `@yarnpkg/nm` override keeps its transitive copy on this version too. + '@yarnpkg/core': 4.9.1 + '@yarnpkg/extensions': 2.0.7 + '@yarnpkg/fslib': ^3.1.5 + '@yarnpkg/lockfile': ^1.1.0 + '@yarnpkg/nm': 4.1.1 + '@yarnpkg/parsers': 3.1.0 + '@yarnpkg/pnp': ^4.1.7 + '@yarnpkg/shell': 4.1.3 + '@zkochan/retry': ^0.2.0 + '@zkochan/rimraf': ^4.0.0 + '@zkochan/table': ^2.0.1 + adm-zip: ^0.6.1 + agentkeepalive: ^4.6.0 + amaro: ^1.2.1 + ansi-diff: ^1.2.0 + archy: ^1.0.0 + better-path-resolve: 2.0.0 + # bin-links 7.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's + # supported floor of Node.js >=22.13. + bin-links: ^6.0.2 + # bole 6 is ESM-only. Under Jest, the workspace logger's ESM bole and the + # published @pnpm/logger's CJS bole 5 land in different realms, so the + # globalThis.$$bole output registry is no longer shared and log events + # emitted through one logger copy never reach the other's streamParser. + # Keep bole 5 until the published @pnpm/logger ships with bole 6. + bole: ^5.0.29 + boxen: npm:@zkochan/boxen@5.1.2 + c8: ^12.0.0 + camelcase: ^10.0.0 + camelcase-keys: ^10.0.3 + can-link: ^3.0.0 + can-write-to-dir: ^2.0.0 + chalk: ^6.0.1 + ci-info: ^4.4.0 + cli-truncate: ^6.1.1 + cmd-extension: ^2.0.0 + comver-to-semver: ^2.0.0 + cross-env: ^10.1.0 + cross-spawn: ^7.0.6 + # cspell 10.x requires Node.js >=22.18.0, above pnpm's supported floor of + # Node.js >=22.13. + cspell: 9.8.0 + deep-require-cwd: 1.0.0 + delay: ^7.0.0 + detect-indent: 7.0.2 + detect-libc: ^2.1.2 + didyoumean2: ^7.0.4 + dint: ^5.1.0 + dir-is-case-sensitive: ^3.0.0 + empathic: ^2.1.0 + esbuild: ^0.28.2 + escape-string-regexp: ^5.0.0 + eslint: ^10.13.0 + eslint-plugin-import-x: ^4.17.1 + eslint-plugin-jest: ^29.17.0 + eslint-plugin-n: ^18.5.0 + eslint-plugin-promise: ^7.3.0 + eslint-plugin-regexp: ^3.1.1 + eslint-plugin-simple-import-sort: ^14.0.0 + execa: npm:safe-execa@0.3.0 + exists-link: 2.0.0 + fast-deep-equal: ^3.1.3 + fast-glob: ^3.3.3 + fs-extra: ^11.4.1 + fuse-native: ^2.2.6 + # Bundled into the pnpm 12 wrapper's dist/ payload, where the Corepack entry + # point loads it from; see pnpm/npm/pnpm/bin/pnpm.mjs. + get-pnpm: ^0.0.5 + get-port: ^7.2.0 + ghooks: 2.0.4 + graceful-fs: ^4.2.11 + graph-cycles: 3.0.0 + hosted-git-info: npm:@pnpm/hosted-git-info@1.0.0 + http-proxy-agent: ^9.1.0 + https-proxy-agent: ^9.1.0 + https-proxy-server-express: 0.1.2 + husky: ^9.1.7 + hyperdrive-schemas: ^2.0.0 + # ini 7.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's + # supported floor of Node.js >=22.13. + ini: 6.0.0 + is-gzip: 2.0.0 + is-inner-link: ^5.0.0 + is-subdir: ^2.0.1 + is-windows: ^1.0.2 + isexe: 4.0.0 + jest: 30.4.2 + jest-diff: 30.4.1 + human-id: ^4.2.2 + js-yaml: npm:@zkochan/js-yaml@0.0.11 + json5: ^2.2.3 + keyv: 6.1.0 + lcov-result-merger: ^6.0.0 + # libnpmpublish 12.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above + # pnpm's supported floor of Node.js >=22.13. + libnpmpublish: ^11.2.0 + load-json-file: ^7.0.1 + lodash.kebabcase: ^4.1.1 + lodash.throttle: 4.1.1 + loud-rejection: ^2.2.0 + lru-cache: ^11.5.3 + make-empty-dir: ^4.0.0 + mdast-util-to-string: ^4.0.0 + memfs: ^4.80.0 + memoize: ^11.0.0 + micromatch: ^4.0.8 + msgpackr: 2.1.2 + nm-prune: ^5.0.0 + # node-gyp 13 (with its nopt 10 and which 7 dependencies) requires Node.js + # ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's supported floor of >=22.13. + node-gyp: ^12.3.0 + normalize-newline: 5.0.0 + # normalize-package-data 9.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, + # above pnpm's supported floor of Node.js >=22.13. + normalize-package-data: ^8.0.0 + normalize-path: ^3.0.0 + normalize-registry-url: 2.0.1 + # npm-packlist 11.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above + # pnpm's supported floor of Node.js >=22.13. + npm-packlist: 10.0.4 + # npm-registry-fetch 20.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, + # above pnpm's supported floor of Node.js >=22.13. + npm-registry-fetch: ^19.0.0 + object-hash: 3.0.0 + open: ^11.0.4 + openpgp: ^6.3.2 + '@openpgp/web-stream-tools': 0.3.1 + p-defer: ^4.0.1 + p-every: ^2.0.0 + p-filter: ^4.1.0 + p-limit: ^7.3.3 + p-queue: ^10.0.0 + parse-json: ^8.3.0 + path-absolute: ^2.0.0 + path-exists: ^5.0.0 + path-name: ^1.0.0 + path-temp: ^3.0.0 + pidtree: ^1.0.0 + playwright-core: ^1.64.1 + preferred-pm: ^5.0.1 + pretty-bytes: ^7.2.0 + pretty-ms: ^10.0.0 + promise-share: ^2.0.1 + proxy: ^4.1.0 + proxyquire: ^2.1.3 + ps-list: ^9.0.0 + qrcode-terminal: ^0.12.0 + ramda: npm:@pnpm/ramda@0.28.1 + read-ini-file: 5.0.0 + read-yaml-file: ^3.0.0 + realpath-missing: ^2.0.0 + remark-parse: ^11.0.0 + remark-stringify: ^11.0.0 + rename-overwrite: ^7.0.1 + render-help: ^2.0.0 + resolve-link-target: ^3.0.0 + rimraf: ^6.1.3 + root-link-target: ^4.0.0 + rxjs: ^7.8.2 + safe-buffer: 5.2.1 + safe-execa: ^0.3.0 + safe-promise-defer: ^2.0.0 + sanitize-filename: ^1.6.4 + seek-bzip: 2.0.0 + semver: ^7.8.5 + semver-range-intersect: ^0.3.1 + semver-utils: ^1.1.4 + shlex: ^3.0.0 + shx: ^0.4.0 + signal-exit: ^4.1.0 + socks: ^2.8.10 + socks-proxy-agent: ^10.1.0 + sort-keys: ^6.0.1 + spdx-expression-parse: 5.0.0 + split-cmd: ^1.1.0 + split2: ^4.2.0 + # ssri 14.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's + # supported floor of Node.js >=22.13. + ssri: 13.0.1 + stacktracey: ^2.2.0 + string-length: ^7.0.1 + string-width: ^8.3.0 + strip-bom: ^5.0.0 + strip-comments-strings: 1.2.0 + symlink-dir: ^10.0.3 + tar: ^7.5.22 + tar-stream: ^3.2.2 + # tempy >=3.1.0 uses temp-dir 3.x which has an async fs.realpath() in its + # module init. When esbuild bundles this into its __esm lazy-init pattern, + # the async operation deadlocks and the pnpm binary hangs on startup. + tempy: 3.0.0 + terminal-link: ^5.0.0 + tinyglobby: ^0.2.17 + touch: 3.1.1 + tree-kill: ^1.2.2 + ts-jest-resolver: 2.0.1 + # Kept on 6.x because typescript-eslint does not support the TypeScript 7.0 API + # yet (https://github.com/typescript-eslint/typescript-eslint/issues/10940); the + # 7.x compiler ships separately as @typescript/native-preview (tsgo). + typescript: 6.0.3 + typescript-eslint: ^8.72.0 + uid-number: 0.0.6 + # undici 8.x requires Node.js >=22.19.0, above pnpm's supported floor of + # Node.js >=22.13. + undici: ^7.29.1 + unified: ^11.0.5 + # validate-npm-package-name 8.x requires Node.js ^22.22.2 || ^24.15.0 || + # >=26.0.0, above pnpm's supported floor of Node.js >=22.13. + validate-npm-package-name: 7.0.2 + version-selector-type: ^3.0.0 + vfile: ^6.0.3 + which: npm:@pnpm/which@^3.0.1 + # write-file-atomic 8.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, + # above pnpm's supported floor of Node.js >=22.13. + write-file-atomic: ^7.0.1 + write-ini-file: 5.0.0 + write-json-file: ^7.0.0 + write-json5-file: ^4.0.0 + write-package: 7.2.0 + write-yaml-file: ^6.0.0 + yaml: ^2.9.1 + yaml-tag: 1.1.0 + yauzl: ^3.4.0 + enhanced-resolve: 5.26.0 + +catalogMode: strict + +catalogPrune: true + +# Dependencies deliberately held back, which `pnpm update --latest` (run by the +# update-lockfile workflow) would otherwise bump. Most of them are packages +# whose newer versions require a Node.js version above pnpm's supported floor +# (>=22.13); the comment at each catalog entry above records the reason. +# typescript is held on 6.x because typescript-eslint does not support the +# TypeScript 7.0 API yet. +update: + ignoreDeps: + - '@babel/core' + - '@babel/plugin-transform-explicit-resource-management' + - '@jest/globals' + - '@types/node' + - '@yarnpkg/core' + - bin-links + - bole + - cspell + - eslint-plugin-regexp + - ini + - jest + - jest-diff + - libnpmpublish + - node-gyp + - normalize-package-data + - npm-packlist + - npm-registry-fetch + - ssri + - tempy + - typescript + - undici + - validate-npm-package-name + - write-file-atomic diff --git a/__patches__/@tybys__wasm-util@0.10.4.patch b/.config/pnpm/patches/@tybys__wasm-util@0.10.4.patch similarity index 100% rename from __patches__/@tybys__wasm-util@0.10.4.patch rename to .config/pnpm/patches/@tybys__wasm-util@0.10.4.patch diff --git a/__patches__/graceful-fs@4.2.11.patch b/.config/pnpm/patches/graceful-fs@4.2.11.patch similarity index 100% rename from __patches__/graceful-fs@4.2.11.patch rename to .config/pnpm/patches/graceful-fs@4.2.11.patch diff --git a/__patches__/mdast-util-to-string@2.0.0.patch b/.config/pnpm/patches/mdast-util-to-string@2.0.0.patch similarity index 100% rename from __patches__/mdast-util-to-string@2.0.0.patch rename to .config/pnpm/patches/mdast-util-to-string@2.0.0.patch diff --git a/__patches__/normalize-registry-url@2.0.1.patch b/.config/pnpm/patches/normalize-registry-url@2.0.1.patch similarity index 100% rename from __patches__/normalize-registry-url@2.0.1.patch rename to .config/pnpm/patches/normalize-registry-url@2.0.1.patch diff --git a/.config/pnpm/patches/patches.yaml b/.config/pnpm/patches/patches.yaml new file mode 100644 index 0000000000..9988a2d83c --- /dev/null +++ b/.config/pnpm/patches/patches.yaml @@ -0,0 +1,7 @@ +patchedDependencies: + '@tybys/wasm-util@0.10.4': '@tybys__wasm-util@0.10.4.patch' + graceful-fs@4.2.11: graceful-fs@4.2.11.patch + normalize-registry-url@2.0.1: normalize-registry-url@2.0.1.patch + unrs-resolver@1.12.2: unrs-resolver@1.12.2.patch + +patchesDir: . diff --git a/__patches__/unrs-resolver@1.12.2.patch b/.config/pnpm/patches/unrs-resolver@1.12.2.patch similarity index 100% rename from __patches__/unrs-resolver@1.12.2.patch rename to .config/pnpm/patches/unrs-resolver@1.12.2.patch diff --git a/.config/pnpm/policies.yaml b/.config/pnpm/policies.yaml new file mode 100644 index 0000000000..83d2af50c0 --- /dev/null +++ b/.config/pnpm/policies.yaml @@ -0,0 +1,170 @@ +allowBuilds: + '@parcel/watcher': false + core-js: false + esbuild: true + fuse-native: true + ghooks: true + msgpackr-extract: true + unrs-resolver: true + +auditConfig: + ignoreGhsas: + - GHSA-2g4f-4pwh-qvx6 + - GHSA-76c9-3jph-rj3q + - GHSA-ffrw-9mx8-89p8 + - GHSA-mh29-5h37-fv8m + - GHSA-w5hq-g745-h8pq + # GHSA-vwc7-r8mq-g2x9: adm-zip follows pre-existing destination symlinks during + # extraction. No patched adm-zip release exists. It is only a devDependency of + # @pnpm/fetching.binary-fetcher, used to build zip fixtures, and never extracts. + - GHSA-vwc7-r8mq-g2x9 + # GHSA-h67p-54hq-rp68: js-yaml quadratic-complexity DoS in merge key handling. + # Patched only in >=4.1.2 with no v3 fix; @yarnpkg/parsers requires the js-yaml 3 + # API (yaml.safeLoad), so its transitive js-yaml cannot be upgraded. + - GHSA-h67p-54hq-rp68 + # GHSA-vfj7-8cjw-p6xm: braces stack exhaustion on deeply nested patterns. + # No patched braces release exists. pnpm expands patterns from the user's config + # and command line, or from scripts and manifests of dependencies already allowed + # to run code, so a crash gives an attacker nothing new. + - GHSA-vfj7-8cjw-p6xm + # GHSA-ch52-4w7c-c8xp: http-cache-semantics max-stale leaks other users' + # responses from a shared cache. No patched release exists. make-fetch-happen + # uses it for a private, single-user client cache, which has no other users. + - GHSA-ch52-4w7c-c8xp + # GHSA-hp3w-g68c-fv3c: sprintf-js DoS through unbounded precision specifiers. + # No patched release exists. It is reached only through argparse 1, which + # formats its own help text with it, never attacker-controlled formats. + - GHSA-hp3w-g68c-fv3c + +minimumReleaseAge: 1440 # At least a day + +minimumReleaseAgeExclude: + - '@pnpm/*' + - '@zkochan/*' + - better-path-resolve + - can-link + - can-write-to-dir + - cmd-extension + - comver-to-semver + - dir-is-case-sensitive + - '@esbuild/*' + - glob@11.1.0 + - is-inner-link + - is-subdir + - make-empty-dir + - normalize-registry-url + - path-absolute + - path-temp + - pnpm + - preferred-pm + - promise-share + - read-ini-file + - read-yaml-file + - realpath-missing + - rename-overwrite + - render-help + - resolve-link-target + - root-link-target + - safe-execa + - safe-promise-defer + - symlink-dir + - which-pm + - write-ini-file + - write-json5-file + - write-yaml-file + - http-proxy-middleware@3.0.7 + +minimumReleaseAgeExcludePrune: true + +overrides: + '@cypress/request@3.0.9>qs': ^6.14.1 + '@yarnpkg/fslib@2': '3' + '@yarnpkg/nm>@yarnpkg/core': 'catalog:' + adm-zip@<0.6.0: ^0.6.0 + ajv@>=7.0.0-alpha.0 <8.18.0: '>=8.18.0' + body-parser@<2.2.1: '^2.2.1' + brace-expansion@<5.0.5: '>=5.0.5' + clipanion: 3.2.0-rc.6 + cookie@<0.7.0: '>=0.7.0' + cross-spawn@<7.0.5: '>=7.0.5' + debug@<3.1.0: '>=3.1.0' + diff@<8.0.3: '^8.0.3' + express@<4.22.1: ^4.22.1 + follow-redirects@<=1.15.5: '>=1.15.6' + glob-parent@<5.1.2: '>=5.1.2' + glob@>=10.3.7 <=11.0.3: '^11.1.0' + handlebars@>=4.0.0 <4.7.9: '>=4.7.9' + hosted-git-info@1: 'catalog:' + istanbul-reports: npm:@zkochan/istanbul-reports + js-yaml@<3.14.2: '^3.14.2' + js-yaml@^4.0.0: 'catalog:' + json5@<2.2.2: 'catalog:' + jsonwebtoken@<=8.5.1: '>=9.0.0' + jws@<3.2.3: '^3.2.3' + lodash@<=4.17.23: '>=4.18.0' + lodash@>=4.0.0 <=4.17.22: '^4.17.23' + lodash@>=4.0.0 <=4.17.23: '>=4.18.0' + minimatch@>=7.0.0 <7.4.7: '^7.4.7' + minimatch@>=9.0.0 <10.0.0: '>=10.2.4' + nopt@5: npm:@pnpm/nopt@^0.2.1 + on-headers@<1.1.0: '>=1.1.0' + path-to-regexp@<0.1.13: ^0.1.13 + path-to-regexp@>=4.0.0 <6.3.0: '>=6.3.0' + path-to-regexp@>=7.0.0 <8.0.0: '>=8.0.0' + postman-request>qs: ^6.14.1 + qs@>=6.11.1 <=6.15.1: ^6.15.2 + request: npm:postman-request@2.88.1-postman.40 + semver@<7.5.2: 'catalog:' + send@<0.19.0: ^0.19.0 + shell-quote@<1.8.4: '>=1.8.4' + serve-static@<1.16.0: ^1.16.0 + # GHSA-w7jw-789q-3m8p / CVE-2026-9277: 1.8.4 patches critical shell-quote vulnerabilities in <=1.8.3. + shell-quote: 1.8.4 + socks@2: ^2.8.1 + tar@<=7.5.9: '>=7.5.10' + tmp@<=0.2.3: '>=0.2.4' + tough-cookie@<4.1.3: '>=4.1.3' + validator@<13.15.22: '>=13.15.22' + yaml@<2.2.2: '>=2.2.2' + http-proxy-middleware@>=0.16.0 <3.0.6: ^3.0.6 + deepmerge-ts@<8.0.0: ^8.0.0 + +packageExtensions: + '@babel/parser': + peerDependencies: + '@babel/types': '*' + # The shell's declarations import micromatch's, which it does not depend on. + '@yarnpkg/shell': + dependencies: + '@types/micromatch': ^4.0.10 + jest-circus: + dependencies: + slash: '3' + remark-parse: + dependencies: + vfile: ^6.0.0 + peerDependencies: + unified: '*' + remark-stringify: + dependencies: + vfile: ^6.0.0 + peerDependencies: + unified: '*' + +registries: + https://registry.npmjs.org/: + scopes: + - '@pnpm' + +trustPolicy: no-downgrade + +trustPolicyExclude: + - '@pnpm/*' + - '@yarnpkg/libzip@3.2.2' + - pnpm + - rxjs@7.8.2 + - undici-types@6.21.0 + +trustPolicyExcludePrune: true + +trustPolicyIgnoreAfter: 10080 # 1 week diff --git a/.config/pnpm/tasks.yaml b/.config/pnpm/tasks.yaml new file mode 100644 index 0000000000..cf579722c0 --- /dev/null +++ b/.config/pnpm/tasks.yaml @@ -0,0 +1,95 @@ +# Every `ci:*` script lives in the root manifest only, so the workflows run +# these pipelines with `--include-workspace-root --full`; the test runners do +# their own package selection and file sharding. The workflows also pass +# `--no-cache`: no task declares `outputs`, so none is cacheable today, and the +# flag keeps a check from being skipped if one ever does. +pipelines: + ts-check: [ci:compile, ci:lint] + # Named after the scripts they run: the test workflow passes one value as both + # the pipeline name and the `TEST_SCRIPT` the chunk runner re-runs. + ci:test-all: [ci:test-all] + ci:test-branch: [ci:test-branch] + ts-test-chunk: [ci:test-chunk] + rust-test: [ci:rust-test] + pnpr-test: [ci:pnpr-test] + rust-clippy: [ci:rust-clippy] + rust-doc: [ci:rust-doc] + rust-deny: [ci:rust-deny] + rust-format: [ci:rust-fmt, ci:toml-fmt] + rust-dylint: [ci:rust-dylint] + build-pnpr: [ci:build-pnpr] + +# Every entry names a script the root manifest alone defines. A name a +# workspace package also defines must not appear here: the entry would drop +# that task's default `dependsOn: ['^']` ordering, and each project's +# run of it would take a slot of the group, serializing a recursive run. +tasks: + ci:compile: + concurrencyGroup: typescript + ci:lint: + dependsOn: [ci:compile] + concurrencyGroup: typescript + ci:test-all: + concurrencyGroup: typescript + ci:test-branch: + concurrencyGroup: typescript + ci:test-chunk: + concurrencyGroup: typescript + test-all: + concurrencyGroup: typescript + test-branch: + concurrencyGroup: typescript + test-pkgs-all: + concurrencyGroup: typescript + test-pkgs-all-report-summary: + concurrencyGroup: typescript + test-pkgs-branch: + concurrencyGroup: typescript + build:pnpm: + concurrencyGroup: cargo + build:pnpm:wasm: + concurrencyGroup: cargo + build:wasm-runtime-probe: + concurrencyGroup: cargo + check:rust: + concurrencyGroup: cargo + fix:rust: + concurrencyGroup: cargo + lint:rust: + concurrencyGroup: cargo + pre-push:rust: + concurrencyGroup: cargo + priority: 10 + ready:rust: + concurrencyGroup: cargo + test:rust: + concurrencyGroup: cargo + test:rust-affected: + concurrencyGroup: cargo + test:rust-smoke: + concurrencyGroup: cargo + ci:build-pnpr: + concurrencyGroup: cargo + ci:pnpr-test: + concurrencyGroup: cargo + ci:rust-clippy: + concurrencyGroup: cargo + outputs: [] + env: [RUSTFLAGS] + ci:rust-doc: + concurrencyGroup: cargo + outputs: [] + env: [RUSTFLAGS, RUSTDOCFLAGS] + ci:rust-dylint: + concurrencyGroup: cargo + ci:rust-test: + concurrencyGroup: cargo + +# The repository is checked out into many worktrees at once, and a second +# Rust build or TypeScript test run on the same machine only takes cores and +# memory from the first. The TypeScript test scripts also share the +# `../pnpm_tmp` scratch directory across worktrees, which one of them wipes +# on startup. A task past the limit waits for a slot instead of starting. +concurrencyGroups: + cargo: 1 + typescript: 1 diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index c7f6778395..a9bb09aa57 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -6,3 +6,14 @@ /pnpm11/reviewing/license-scanner/* @weyert /pnpm11/reviewing/plugin-commands-licenses/* @weyert /pnpm11/hooks/* @d3lm + +# Supply-chain settings and code that runs on install +/pnpm-workspace.yaml @zkochan +/.config/pnpm/policies.yaml @zkochan +/.pnpmfile.cjs @zkochan +/.config/pnpm/patches/ @zkochan + +# No code owner: pnpm-workspace.yaml lets these files define only the +# catalog settings, the update settings, and the task-runner settings. +/.config/pnpm/catalog.yaml +/.config/pnpm/tasks.yaml diff --git a/.github/scripts/ts-test-scope.test.mjs b/.github/scripts/ts-test-scope.test.mjs index 75bf7f7f45..f7fd7c43b9 100644 --- a/.github/scripts/ts-test-scope.test.mjs +++ b/.github/scripts/ts-test-scope.test.mjs @@ -38,7 +38,7 @@ test('PR scope stays pinned when main advances; global changes and missing bases assert.equal(scope().full_tests, 'false', 'TS code plus release notes remain affected') commit(checkout, 'pnpm/crates/example/src/lib.rs', 'rust') assert.equal(scope().full_tests, 'false', 'TS code plus pacquet sources remain affected') - for (const file of ['package.json', 'pnpm-lock.yaml', '.pnpmfile.cjs', 'pnpm-workspace.yaml', '__patches__/dependency.patch', '.github/scripts/new-helper.mjs', '.changeset/config.json', 'pnpr/crates/example/src/lib.rs', 'pnpr/.fixtures/packages/example/package.json', 'Cargo.lock']) { + for (const file of ['package.json', 'pnpm-lock.yaml', '.pnpmfile.cjs', 'pnpm-workspace.yaml', '.config/pnpm/patches/dependency.patch', '.github/scripts/new-helper.mjs', '.changeset/config.json', 'pnpr/crates/example/src/lib.rs', 'pnpr/.fixtures/packages/example/package.json', 'Cargo.lock']) { commit(checkout, file, 'global input') assert.equal(scope().full_tests, 'true', file) git(checkout, 'reset', '--hard', 'HEAD^') diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index 83e07f49c2..0e0dbda814 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -28,6 +28,7 @@ on: - 'pnpm11/**' - 'package.json' - 'pnpm-workspace.yaml' + - '.config/pnpm/**' - 'pnpm-lock.yaml' - '.github/workflows/benchmark.yml' diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3233ff5603..8729800dce 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -56,7 +56,7 @@ jobs: ts: - 'pnpm11/**' - '.meta-updater/**' - - '__patches__/**' + - '.config/pnpm/**' - 'package.json' - 'pnpm-workspace.yaml' - 'pnpm-lock.yaml' diff --git a/.github/workflows/pacquet-ci.yml b/.github/workflows/pacquet-ci.yml index be07c80f1a..b31543a524 100644 --- a/.github/workflows/pacquet-ci.yml +++ b/.github/workflows/pacquet-ci.yml @@ -89,6 +89,7 @@ jobs: - 'package.json' - 'pnpm-lock.yaml' - 'pnpm-workspace.yaml' + - '.config/pnpm/**' - 'rust-toolchain.toml' - 'rustfmt.toml' - 'deny.toml' diff --git a/.github/workflows/pacquet-integrated-benchmark.yml b/.github/workflows/pacquet-integrated-benchmark.yml index bed3ec102e..6c61d4b3a4 100644 --- a/.github/workflows/pacquet-integrated-benchmark.yml +++ b/.github/workflows/pacquet-integrated-benchmark.yml @@ -23,6 +23,7 @@ on: - 'pnpm/tasks/registry-mock/package.json' - 'pnpm-lock.yaml' - 'pnpm-workspace.yaml' + - '.config/pnpm/**' - 'pnpm/tasks/integrated-benchmark/src/fixtures/**' - '.github/actions/rustup/**' - '.github/actions/binstall/**' @@ -52,6 +53,7 @@ on: - 'pnpm/tasks/registry-mock/package.json' - 'pnpm-lock.yaml' - 'pnpm-workspace.yaml' + - '.config/pnpm/**' - 'pnpm/tasks/integrated-benchmark/src/fixtures/**' - '.github/actions/rustup/**' - '.github/actions/binstall/**' diff --git a/.github/workflows/pnpm-wasm.yml b/.github/workflows/pnpm-wasm.yml index 1c1e18b783..c756942781 100644 --- a/.github/workflows/pnpm-wasm.yml +++ b/.github/workflows/pnpm-wasm.yml @@ -13,7 +13,7 @@ on: - 'Cargo.lock' - 'rust-toolchain.toml' - '.cargo/**' - - '__patches__/**' + - '.config/pnpm/**' - 'package.json' - 'pnpm-lock.yaml' - 'pnpm-workspace.yaml' diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index e2bad2d622..c6cfd3577a 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -65,101 +65,32 @@ packages: - '!**/test/**' - '!pnpm11/resolving/local-resolver/example-package/**' -# Every `ci:*` script lives in the root manifest only, so the workflows run -# these pipelines with `--include-workspace-root --full`; the test runners do -# their own package selection and file sharding. The workflows also pass -# `--no-cache`: no task declares `outputs`, so none is cacheable today, and the -# flag keeps a check from being skipped if one ever does. -pipelines: - ts-check: [ci:compile, ci:lint] - # Named after the scripts they run: the test workflow passes one value as both - # the pipeline name and the `TEST_SCRIPT` the chunk runner re-runs. - ci:test-all: [ci:test-all] - ci:test-branch: [ci:test-branch] - ts-test-chunk: [ci:test-chunk] - rust-test: [ci:rust-test] - pnpr-test: [ci:pnpr-test] - rust-clippy: [ci:rust-clippy] - rust-doc: [ci:rust-doc] - rust-deny: [ci:rust-deny] - rust-format: [ci:rust-fmt, ci:toml-fmt] - rust-dylint: [ci:rust-dylint] - build-pnpr: [ci:build-pnpr] - -# Every entry names a script the root manifest alone defines. A name a -# workspace package also defines must not appear here: the entry would drop -# that task's default `dependsOn: ['^']` ordering, and each project's -# run of it would take a slot of the group, serializing a recursive run. -tasks: - ci:compile: - concurrencyGroup: typescript - ci:lint: - dependsOn: [ci:compile] - concurrencyGroup: typescript - ci:test-all: - concurrencyGroup: typescript - ci:test-branch: - concurrencyGroup: typescript - ci:test-chunk: - concurrencyGroup: typescript - test-all: - concurrencyGroup: typescript - test-branch: - concurrencyGroup: typescript - test-pkgs-all: - concurrencyGroup: typescript - test-pkgs-all-report-summary: - concurrencyGroup: typescript - test-pkgs-branch: - concurrencyGroup: typescript - build:pnpm: - concurrencyGroup: cargo - build:pnpm:wasm: - concurrencyGroup: cargo - build:wasm-runtime-probe: - concurrencyGroup: cargo - check:rust: - concurrencyGroup: cargo - fix:rust: - concurrencyGroup: cargo - lint:rust: - concurrencyGroup: cargo - pre-push:rust: - concurrencyGroup: cargo - priority: 10 - ready:rust: - concurrencyGroup: cargo - test:rust: - concurrencyGroup: cargo - test:rust-affected: - concurrencyGroup: cargo - test:rust-smoke: - concurrencyGroup: cargo - ci:build-pnpr: - concurrencyGroup: cargo - ci:pnpr-test: - concurrencyGroup: cargo - ci:rust-clippy: - concurrencyGroup: cargo - outputs: [] - env: [RUSTFLAGS] - ci:rust-doc: - concurrencyGroup: cargo - outputs: [] - env: [RUSTFLAGS, RUSTDOCFLAGS] - ci:rust-dylint: - concurrencyGroup: cargo - ci:rust-test: - concurrencyGroup: cargo - -# The repository is checked out into many worktrees at once, and a second -# Rust build or TypeScript test run on the same machine only takes cores and -# memory from the first. The TypeScript test scripts also share the -# `../pnpm_tmp` scratch directory across worktrees, which one of them wipes -# on startup. A task past the limit waits for a slot instead of starting. -concurrencyGroups: - cargo: 1 - typescript: 1 +include: + ./.config/pnpm/policies.yaml: + - allowBuilds + - auditConfig + - minimumReleaseAge + - minimumReleaseAgeExclude + - minimumReleaseAgeExcludePrune + - overrides + - packageExtensions + - registries + - trustPolicy + - trustPolicyExclude + - trustPolicyExcludePrune + - trustPolicyIgnoreAfter + ./.config/pnpm/patches/patches.yaml: + - patchedDependencies + - patchesDir + ./.config/pnpm/catalog.yaml: + - catalogMode + - catalogPrune + - catalogs + - update + ./.config/pnpm/tasks.yaml: + - concurrencyGroups + - pipelines + - tasks # Native workspace release management (consumed by `pnpm change` / `pnpm version -r`). # The Rust CLI wrapper is the workspace package `pacquet` (published to npm as @@ -200,353 +131,9 @@ versioning: '@pnpm/pnpr': alpha '@pnpm/pnpr-ui': alpha -allowBuilds: - '@parcel/watcher': false - core-js: false - esbuild: true - fuse-native: true - ghooks: true - msgpackr-extract: true - unrs-resolver: true - -auditConfig: - ignoreGhsas: - - GHSA-2g4f-4pwh-qvx6 - - GHSA-76c9-3jph-rj3q - - GHSA-ffrw-9mx8-89p8 - - GHSA-mh29-5h37-fv8m - - GHSA-w5hq-g745-h8pq - # GHSA-vwc7-r8mq-g2x9: adm-zip follows pre-existing destination symlinks during - # extraction. No patched adm-zip release exists. It is only a devDependency of - # @pnpm/fetching.binary-fetcher, used to build zip fixtures, and never extracts. - - GHSA-vwc7-r8mq-g2x9 - # GHSA-h67p-54hq-rp68: js-yaml quadratic-complexity DoS in merge key handling. - # Patched only in >=4.1.2 with no v3 fix; @yarnpkg/parsers requires the js-yaml 3 - # API (yaml.safeLoad), so its transitive js-yaml cannot be upgraded. - - GHSA-h67p-54hq-rp68 - # GHSA-vfj7-8cjw-p6xm: braces stack exhaustion on deeply nested patterns. - # No patched braces release exists. pnpm expands patterns from the user's config - # and command line, or from scripts and manifests of dependencies already allowed - # to run code, so a crash gives an attacker nothing new. - - GHSA-vfj7-8cjw-p6xm - # GHSA-ch52-4w7c-c8xp: http-cache-semantics max-stale leaks other users' - # responses from a shared cache. No patched release exists. make-fetch-happen - # uses it for a private, single-user client cache, which has no other users. - - GHSA-ch52-4w7c-c8xp - # GHSA-hp3w-g68c-fv3c: sprintf-js DoS through unbounded precision specifiers. - # No patched release exists. It is reached only through argparse 1, which - # formats its own help text with it, never attacker-controlled formats. - - GHSA-hp3w-g68c-fv3c - cargo: enabled: true -catalog: - # @babel/core 8.x (and its plugins) require Node.js ^22.18.0 || >=24.11.0, - # above pnpm's supported floor of Node.js >=22.13. - '@babel/core': ^7.29.7 - '@babel/plugin-transform-explicit-resource-management': ^7.29.7 - '@commitlint/cli': ^21.2.4 - '@commitlint/config-conventional': ^21.2.4 - '@commitlint/prompt-cli': ^21.2.4 - '@cyclonedx/cyclonedx-library': 10.3.0 - '@emnapi/wasi-threads': 2.2.0 - '@eslint/js': ^10.0.1 - '@inquirer/prompts': ^8.7.4 - # Jest 30.5.0 breaks ESM package imports in the Jest runtime. - '@jest/globals': 30.4.1 - '@npm/types': ^2.1.0 - '@pnpm/byline': ^1.0.0 - '@pnpm/colorize-semver-diff': ^2.0.0 - '@pnpm/exec': ^4.0.0 - '@pnpm/logger': '^1100.0.0' - '@pnpm/meta-updater': 2.0.6 - '@pnpm/nopt': ^0.3.1 - '@pnpm/npm-package-arg': ^2.0.0 - '@pnpm/patch-package': 0.0.1 - '@pnpm/semver-diff': ^2.0.0 - '@pnpm/tabtab': ^0.5.4 - '@pnpm/tgz-fixtures': 0.0.0 - '@reflink/reflink': 0.1.19 - '@rushstack/worker-pool': 0.7.30 - '@stylistic/eslint-plugin': ^5.10.0 - '@tybys/wasm-util': 0.10.4 - '@types/adm-zip': ^0.6.0 - '@types/archy': 0.0.36 - '@types/cross-spawn': ^6.0.6 - '@types/fs-extra': ^11.0.4 - '@types/graceful-fs': ^4.1.9 - '@types/hosted-git-info': ^3.0.5 - '@types/ini': 4.1.1 - '@types/is-gzip': 2.0.2 - '@types/is-windows': ^1.0.2 - '@types/isexe': 2.0.4 - '@types/jest': ^30.0.0 - '@types/js-yaml': ^4.0.9 - '@types/libnpmpublish': ^11.2.0 - '@types/lodash.kebabcase': 4.1.9 - '@types/lodash.throttle': 4.1.9 - '@types/micromatch': ^4.0.10 - # Kept on 22.x to match pnpm's minimum supported Node.js version (>=22.13); - # newer majors would type APIs that don't exist on the supported floor. - '@types/node': ^22.19.19 - '@types/normalize-package-data': ^2.4.4 - '@types/normalize-path': ^3.0.2 - '@types/npm-registry-fetch': ^8.0.9 - '@types/object-hash': 3.0.6 - '@types/parse-json': ^7.0.0 - '@types/picomatch': ^4.0.3 - '@types/pnpm__byline': npm:@types/byline@^4.2.36 - '@types/proxyquire': ^1.3.31 - '@types/qrcode-terminal': ^0.12.2 - '@types/ramda': 0.32.0 - '@types/retry': ^0.12.5 - '@types/semver': 7.8.0 - '@types/spdx-expression-parse': 4.0.0 - '@types/ssri': ^7.1.5 - '@types/tar-stream': ^3.1.5 - '@types/touch': ^3.1.5 - '@types/validate-npm-package-name': ^4.0.2 - '@types/which': ^3.0.4 - '@types/write-file-atomic': ^4.0.3 - '@types/yarnpkg__lockfile': ^1.1.9 - '@types/yauzl': ^3.4.0 - '@types/zkochan__table': npm:@types/table@6.3.2 - '@typescript-eslint/utils': ^8.72.0 - '@typescript/native-preview': 7.0.0-dev.20260707.2 - '@webcontainer/api': ^1.6.4 - # @yarnpkg/core 4.9.2 was published with a Yarn `patch:` specifier for its - # `got` dependency, which pnpm resolves to a nonexistent local path. The - # `@yarnpkg/nm` override keeps its transitive copy on this version too. - '@yarnpkg/core': 4.9.1 - '@yarnpkg/extensions': 2.0.7 - '@yarnpkg/fslib': ^3.1.5 - '@yarnpkg/lockfile': ^1.1.0 - '@yarnpkg/nm': 4.1.1 - '@yarnpkg/parsers': 3.1.0 - '@yarnpkg/pnp': ^4.1.7 - '@yarnpkg/shell': 4.1.3 - '@zkochan/retry': ^0.2.0 - '@zkochan/rimraf': ^4.0.0 - '@zkochan/table': ^2.0.1 - adm-zip: ^0.6.1 - agentkeepalive: ^4.6.0 - amaro: ^1.2.1 - ansi-diff: ^1.2.0 - archy: ^1.0.0 - better-path-resolve: 2.0.0 - # bin-links 7.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's - # supported floor of Node.js >=22.13. - bin-links: ^6.0.2 - # bole 6 is ESM-only. Under Jest, the workspace logger's ESM bole and the - # published @pnpm/logger's CJS bole 5 land in different realms, so the - # globalThis.$$bole output registry is no longer shared and log events - # emitted through one logger copy never reach the other's streamParser. - # Keep bole 5 until the published @pnpm/logger ships with bole 6. - bole: ^5.0.29 - boxen: npm:@zkochan/boxen@5.1.2 - c8: ^12.0.0 - camelcase: ^10.0.0 - camelcase-keys: ^10.0.3 - can-link: ^3.0.0 - can-write-to-dir: ^2.0.0 - chalk: ^6.0.1 - ci-info: ^4.4.0 - cli-truncate: ^6.1.1 - cmd-extension: ^2.0.0 - comver-to-semver: ^2.0.0 - cross-env: ^10.1.0 - cross-spawn: ^7.0.6 - # cspell 10.x requires Node.js >=22.18.0, above pnpm's supported floor of - # Node.js >=22.13. - cspell: 9.8.0 - deep-require-cwd: 1.0.0 - delay: ^7.0.0 - detect-indent: 7.0.2 - detect-libc: ^2.1.2 - didyoumean2: ^7.0.4 - dint: ^5.1.0 - dir-is-case-sensitive: ^3.0.0 - empathic: ^2.1.0 - esbuild: ^0.28.2 - escape-string-regexp: ^5.0.0 - eslint: ^10.13.0 - eslint-plugin-import-x: ^4.17.1 - eslint-plugin-jest: ^29.17.0 - eslint-plugin-n: ^18.5.0 - eslint-plugin-promise: ^7.3.0 - eslint-plugin-regexp: ^3.1.1 - eslint-plugin-simple-import-sort: ^14.0.0 - execa: npm:safe-execa@0.3.0 - exists-link: 2.0.0 - fast-deep-equal: ^3.1.3 - fast-glob: ^3.3.3 - fs-extra: ^11.4.1 - fuse-native: ^2.2.6 - # Bundled into the pnpm 12 wrapper's dist/ payload, where the Corepack entry - # point loads it from; see pnpm/npm/pnpm/bin/pnpm.mjs. - get-pnpm: ^0.0.5 - get-port: ^7.2.0 - ghooks: 2.0.4 - graceful-fs: ^4.2.11 - graph-cycles: 3.0.0 - hosted-git-info: npm:@pnpm/hosted-git-info@1.0.0 - http-proxy-agent: ^9.1.0 - https-proxy-agent: ^9.1.0 - https-proxy-server-express: 0.1.2 - husky: ^9.1.7 - hyperdrive-schemas: ^2.0.0 - # ini 7.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's - # supported floor of Node.js >=22.13. - ini: 6.0.0 - is-gzip: 2.0.0 - is-inner-link: ^5.0.0 - is-subdir: ^2.0.1 - is-windows: ^1.0.2 - isexe: 4.0.0 - jest: 30.4.2 - jest-diff: 30.4.1 - human-id: ^4.2.2 - js-yaml: npm:@zkochan/js-yaml@0.0.11 - json5: ^2.2.3 - keyv: 6.1.0 - lcov-result-merger: ^6.0.0 - # libnpmpublish 12.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above - # pnpm's supported floor of Node.js >=22.13. - libnpmpublish: ^11.2.0 - load-json-file: ^7.0.1 - lodash.kebabcase: ^4.1.1 - lodash.throttle: 4.1.1 - loud-rejection: ^2.2.0 - lru-cache: ^11.5.3 - make-empty-dir: ^4.0.0 - mdast-util-to-string: ^4.0.0 - memfs: ^4.80.0 - memoize: ^11.0.0 - micromatch: ^4.0.8 - msgpackr: 2.1.2 - nm-prune: ^5.0.0 - # node-gyp 13 (with its nopt 10 and which 7 dependencies) requires Node.js - # ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's supported floor of >=22.13. - node-gyp: ^12.3.0 - normalize-newline: 5.0.0 - # normalize-package-data 9.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, - # above pnpm's supported floor of Node.js >=22.13. - normalize-package-data: ^8.0.0 - normalize-path: ^3.0.0 - normalize-registry-url: 2.0.1 - # npm-packlist 11.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above - # pnpm's supported floor of Node.js >=22.13. - npm-packlist: 10.0.4 - # npm-registry-fetch 20.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, - # above pnpm's supported floor of Node.js >=22.13. - npm-registry-fetch: ^19.0.0 - object-hash: 3.0.0 - open: ^11.0.4 - openpgp: ^6.3.2 - '@openpgp/web-stream-tools': 0.3.1 - p-defer: ^4.0.1 - p-every: ^2.0.0 - p-filter: ^4.1.0 - p-limit: ^7.3.3 - p-queue: ^10.0.0 - parse-json: ^8.3.0 - path-absolute: ^2.0.0 - path-exists: ^5.0.0 - path-name: ^1.0.0 - path-temp: ^3.0.0 - pidtree: ^1.0.0 - playwright-core: ^1.64.1 - preferred-pm: ^5.0.1 - pretty-bytes: ^7.2.0 - pretty-ms: ^10.0.0 - promise-share: ^2.0.1 - proxy: ^4.1.0 - proxyquire: ^2.1.3 - ps-list: ^9.0.0 - qrcode-terminal: ^0.12.0 - ramda: npm:@pnpm/ramda@0.28.1 - read-ini-file: 5.0.0 - read-yaml-file: ^3.0.0 - realpath-missing: ^2.0.0 - remark-parse: ^11.0.0 - remark-stringify: ^11.0.0 - rename-overwrite: ^7.0.1 - render-help: ^2.0.0 - resolve-link-target: ^3.0.0 - rimraf: ^6.1.3 - root-link-target: ^4.0.0 - rxjs: ^7.8.2 - safe-buffer: 5.2.1 - safe-execa: ^0.3.0 - safe-promise-defer: ^2.0.0 - sanitize-filename: ^1.6.4 - seek-bzip: 2.0.0 - semver: ^7.8.5 - semver-range-intersect: ^0.3.1 - semver-utils: ^1.1.4 - shlex: ^3.0.0 - shx: ^0.4.0 - signal-exit: ^4.1.0 - socks: ^2.8.10 - socks-proxy-agent: ^10.1.0 - sort-keys: ^6.0.1 - spdx-expression-parse: 5.0.0 - split-cmd: ^1.1.0 - split2: ^4.2.0 - # ssri 14.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's - # supported floor of Node.js >=22.13. - ssri: 13.0.1 - stacktracey: ^2.2.0 - string-length: ^7.0.1 - string-width: ^8.3.0 - strip-bom: ^5.0.0 - strip-comments-strings: 1.2.0 - symlink-dir: ^10.0.3 - tar: ^7.5.22 - tar-stream: ^3.2.2 - # tempy >=3.1.0 uses temp-dir 3.x which has an async fs.realpath() in its - # module init. When esbuild bundles this into its __esm lazy-init pattern, - # the async operation deadlocks and the pnpm binary hangs on startup. - tempy: 3.0.0 - terminal-link: ^5.0.0 - tinyglobby: ^0.2.17 - touch: 3.1.1 - tree-kill: ^1.2.2 - ts-jest-resolver: 2.0.1 - # Kept on 6.x because typescript-eslint does not support the TypeScript 7.0 API - # yet (https://github.com/typescript-eslint/typescript-eslint/issues/10940); the - # 7.x compiler ships separately as @typescript/native-preview (tsgo). - typescript: 6.0.3 - typescript-eslint: ^8.72.0 - uid-number: 0.0.6 - # undici 8.x requires Node.js >=22.19.0, above pnpm's supported floor of - # Node.js >=22.13. - undici: ^7.29.1 - unified: ^11.0.5 - # validate-npm-package-name 8.x requires Node.js ^22.22.2 || ^24.15.0 || - # >=26.0.0, above pnpm's supported floor of Node.js >=22.13. - validate-npm-package-name: 7.0.2 - version-selector-type: ^3.0.0 - vfile: ^6.0.3 - which: npm:@pnpm/which@^3.0.1 - # write-file-atomic 8.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, - # above pnpm's supported floor of Node.js >=22.13. - write-file-atomic: ^7.0.1 - write-ini-file: 5.0.0 - write-json-file: ^7.0.0 - write-json5-file: ^4.0.0 - write-package: 7.2.0 - write-yaml-file: ^6.0.0 - yaml: ^2.9.1 - yaml-tag: 1.1.0 - yauzl: ^3.4.0 - enhanced-resolve: 5.26.0 - -catalogMode: strict - -catalogPrune: true - enablePrePostScripts: false engineStrict: false @@ -556,190 +143,17 @@ gitChecks: false hoistPattern: - jest-runner -minimumReleaseAge: 1440 # At least a day - -minimumReleaseAgeExclude: - - '@pnpm/*' - - '@zkochan/*' - - better-path-resolve - - can-link - - can-write-to-dir - - cmd-extension - - comver-to-semver - - dir-is-case-sensitive - - '@esbuild/*' - - glob@11.1.0 - - is-inner-link - - is-subdir - - make-empty-dir - - normalize-registry-url - - path-absolute - - path-temp - - pnpm - - preferred-pm - - promise-share - - read-ini-file - - read-yaml-file - - realpath-missing - - rename-overwrite - - render-help - - resolve-link-target - - root-link-target - - safe-execa - - safe-promise-defer - - symlink-dir - - which-pm - - write-ini-file - - write-json5-file - - write-yaml-file - - http-proxy-middleware@3.0.7 - lockfile: includeResolutionSettings: true -minimumReleaseAgeExcludePrune: true - nodeVersion: 22.13.0 -overrides: - '@cypress/request@3.0.9>qs': ^6.14.1 - '@yarnpkg/fslib@2': '3' - '@yarnpkg/nm>@yarnpkg/core': 'catalog:' - adm-zip@<0.6.0: ^0.6.0 - ajv@>=7.0.0-alpha.0 <8.18.0: '>=8.18.0' - body-parser@<2.2.1: '^2.2.1' - brace-expansion@<5.0.5: '>=5.0.5' - clipanion: 3.2.0-rc.6 - cookie@<0.7.0: '>=0.7.0' - cross-spawn@<7.0.5: '>=7.0.5' - debug@<3.1.0: '>=3.1.0' - diff@<8.0.3: '^8.0.3' - express@<4.22.1: ^4.22.1 - follow-redirects@<=1.15.5: '>=1.15.6' - glob-parent@<5.1.2: '>=5.1.2' - glob@>=10.3.7 <=11.0.3: '^11.1.0' - handlebars@>=4.0.0 <4.7.9: '>=4.7.9' - hosted-git-info@1: 'catalog:' - istanbul-reports: npm:@zkochan/istanbul-reports - js-yaml@<3.14.2: '^3.14.2' - js-yaml@^4.0.0: 'catalog:' - json5@<2.2.2: 'catalog:' - jsonwebtoken@<=8.5.1: '>=9.0.0' - jws@<3.2.3: '^3.2.3' - lodash@<=4.17.23: '>=4.18.0' - lodash@>=4.0.0 <=4.17.22: '^4.17.23' - lodash@>=4.0.0 <=4.17.23: '>=4.18.0' - minimatch@>=7.0.0 <7.4.7: '^7.4.7' - minimatch@>=9.0.0 <10.0.0: '>=10.2.4' - nopt@5: npm:@pnpm/nopt@^0.2.1 - on-headers@<1.1.0: '>=1.1.0' - path-to-regexp@<0.1.13: ^0.1.13 - path-to-regexp@>=4.0.0 <6.3.0: '>=6.3.0' - path-to-regexp@>=7.0.0 <8.0.0: '>=8.0.0' - postman-request>qs: ^6.14.1 - qs@>=6.11.1 <=6.15.1: ^6.15.2 - request: npm:postman-request@2.88.1-postman.40 - semver@<7.5.2: 'catalog:' - send@<0.19.0: ^0.19.0 - shell-quote@<1.8.4: '>=1.8.4' - serve-static@<1.16.0: ^1.16.0 - # GHSA-w7jw-789q-3m8p / CVE-2026-9277: 1.8.4 patches critical shell-quote vulnerabilities in <=1.8.3. - shell-quote: 1.8.4 - socks@2: ^2.8.1 - tar@<=7.5.9: '>=7.5.10' - tmp@<=0.2.3: '>=0.2.4' - tough-cookie@<4.1.3: '>=4.1.3' - validator@<13.15.22: '>=13.15.22' - yaml@<2.2.2: '>=2.2.2' - http-proxy-middleware@>=0.16.0 <3.0.6: ^3.0.6 - deepmerge-ts@<8.0.0: ^8.0.0 - -packageExtensions: - '@babel/parser': - peerDependencies: - '@babel/types': '*' - # The shell's declarations import micromatch's, which it does not depend on. - '@yarnpkg/shell': - dependencies: - '@types/micromatch': ^4.0.10 - jest-circus: - dependencies: - slash: '3' - remark-parse: - dependencies: - vfile: ^6.0.0 - peerDependencies: - unified: '*' - remark-stringify: - dependencies: - vfile: ^6.0.0 - peerDependencies: - unified: '*' - -patchedDependencies: - '@tybys/wasm-util@0.10.4': __patches__/@tybys__wasm-util@0.10.4.patch - graceful-fs@4.2.11: __patches__/graceful-fs@4.2.11.patch - normalize-registry-url@2.0.1: __patches__/normalize-registry-url@2.0.1.patch - unrs-resolver@1.12.2: __patches__/unrs-resolver@1.12.2.patch - -patchesDir: __patches__ - publishBranch: main resolutionMode: lowest-direct savePrefix: '' -trustPolicy: no-downgrade - -trustPolicyExclude: - - '@pnpm/*' - - '@yarnpkg/libzip@3.2.2' - - pnpm - - rxjs@7.8.2 - - undici-types@6.21.0 - -trustPolicyExcludePrune: true - -trustPolicyIgnoreAfter: 10080 # 1 week - -# Dependencies deliberately held back, which `pnpm update --latest` (run by the -# update-lockfile workflow) would otherwise bump. Most of them are packages -# whose newer versions require a Node.js version above pnpm's supported floor -# (>=22.13); the comment at each catalog entry above records the reason. -# typescript is held on 6.x because typescript-eslint does not support the -# TypeScript 7.0 API yet. -update: - ignoreDeps: - - '@babel/core' - - '@babel/plugin-transform-explicit-resource-management' - - '@jest/globals' - - '@types/node' - - '@yarnpkg/core' - - bin-links - - bole - - cspell - - eslint-plugin-regexp - - ini - - jest - - jest-diff - - libnpmpublish - - node-gyp - - normalize-package-data - - npm-packlist - - npm-registry-fetch - - ssri - - tempy - - typescript - - undici - - validate-npm-package-name - - write-file-atomic - virtualStoreType: global autoDedupe: true - -registries: - https://registry.npmjs.org/: - scopes: - - '@pnpm'