pnpm-workspace.yaml

packages:
  - "apps/*"
  - "packages/*"

# Settings below were migrated from the package.json "pnpm" field — pnpm 11 no
# longer reads that field and takes these from pnpm-workspace.yaml instead.
overrides:
  typescript: "^5"
  source-map: "^0.7.4"
  sass-embedded: "1.93.2"
  "@sentry/core": "^8.55.0"
  "@sentry/types": "^8.55.0"
  "@sentry/utils": "^8.55.0"
  # Security advisories (pnpm audit --prod). In-major bumps of transitive deps only —
  # low regression risk. Runtime-relevant ones first (markdown/linkify process user
  # content in the TipTap editor; form-data rides axios), then build-chain patches.
  # Each override is scoped to the vulnerable major so it can't downgrade an unrelated
  # major — e.g. rollup@3 is the vulnerable Sentry path; tsup stays on its rollup 4.x.
  "linkify-it@5": "^5.0.1"
  "markdown-it@14": "^14.1.2"
  "form-data@4": "^4.0.6"
  "tmp@0.2": "^0.2.6"
  "rollup@3": "^3.30.0"
  "postcss@8": "^8.5.10"
  "brace-expansion@1": "^1.1.13"
  "brace-expansion@2": "^2.0.3"
  "@babel/core@7": "^7.29.1"
  # Previously-deferred advisories that need a cross-major bump of the vulnerable dep.
  # Validated via install + build:packages + typecheck + CI's full web build.
  serialize-javascript: "^7.0.5"
  js-cookie: "^3.0.6"
  uuid: "^11.1.1"
  esbuild: "^0.28.1"
  # NOTE: @opentelemetry/core is intentionally NOT overridden — forcing 2.8.x breaks
  # @sentry/nextjs' pinned OpenTelemetry graph (undefined `AlwaysOn`). Its advisory stays
  # until @sentry/nextjs is bumped.

# pnpm 11 removed onlyBuiltDependencies / ignoredBuiltDependencies in favour of
# allowBuilds (a per-package true/false map), enforced by strictDepBuilds.
# true  = previously-allowlisted deps that genuinely need their native/build step.
# false = sharp (unused: images run unoptimized) and the optional ws native
#         addons (JS fallback is used, so building them is unnecessary).
# A new dependency that ships a build script will fail CI until it's reviewed
# and added here — that's the intended supply-chain guard.
allowBuilds:
  "@firebase/util": true
  "@parcel/watcher": true
  "@sentry/cli": true
  "@sentry/profiling-node": true
  "bigint-buffer": true
  "core-js": true
  "esbuild": true
  "keccak": true
  "protobufjs": true
  "scryptlib": true
  "secp256k1": true
  "unrs-resolver": true
  "sharp": false
  "bufferutil": false
  "utf-8-validate": false

# Supply-chain guard: refuse to install package versions published less than a
# day ago, so a compromised version that's published and yanked within hours is
# never pulled in. Trade-off: `pnpm install --frozen-lockfile` (CI) will fail
# for ~24h after a same-day dependency bump lands in the lockfile — re-run CI
# once the version has aged, or add the package to minimumReleaseAgeExclude.
minimumReleaseAge: 1440

patchedDependencies:
  '@tooni/iconscout-unicons-react@1.0.1': patches/@tooni__iconscout-unicons-react@1.0.1.patch