ansari/pnpm-workspace.yaml at develop · MachineWisdomAI/ansari · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
packages:
  - apps/*
  - packages/*

# Refuse installs on a Node/pnpm outside the `engines` range instead of only
# warning. Set here (not in .npmrc) because .npmrc's engine-strict stops being
# enforced on pnpm >=11 — pnpm-workspace.yaml hard-fails on every pnpm version.
engineStrict: true

# Single source of truth for toolchain versions shared across packages.
# Packages reference these as "catalog:" so versions cannot drift.
catalog:
  typescript: ~6.0.3
  eslint: ^9.39.5
  typescript-eslint: ^8.70.1

# pnpm 10 blocks dependency postinstall scripts unless allowlisted here.
# These all ran their scripts under npm and need them: native addons
# (bcrypt), platform binaries (sharp, esbuild, @sentry/cli, unrs-resolver),
# and codegen (protobufjs, @google/genai).
onlyBuiltDependencies:
  - "@google/genai"
  - "@sentry/cli"
  - bcrypt
  - esbuild
  - protobufjs
  - sharp
  - unrs-resolver

# Dependencies a package requires at runtime but does not declare. Without
# them it resolves only through pnpm's hoisting, which shifts whenever an
# unrelated package leaves the lockfile.
packageExtensions:
  # react-native-worklets 0.10.1's Babel plugin (plugin/index.js, run by
  # babel-preset-expo for every frontend build) requires @babel/traverse and
  # @babel/generator, but declares only @babel/types and the transforms. It
  # resolved them through the hidden hoist of copies that react-email's chain
  # pulled in; when apps/api dropped react-email, an incremental install lost
  # that hoist and the frontend build failed (spec 300 review).
  react-native-worklets@*:
    dependencies:
      "@babel/traverse": ^7.27.1
      "@babel/generator": ^7.27.1

# Dependency overrides. Security fixes below cover TRANSITIVE deps we cannot bump
# directly. pnpm reads overrides ONLY from here (or root package.json `pnpm.overrides`);
# an `overrides` key inside an app's package.json is npm syntax and is silently
# ignored by pnpm — that is how these alerts stayed open after the npm→pnpm move.
# Each entry names the consumer that pins the vulnerable range; drop an entry
# once that consumer resolves a patched version on its own.
overrides:
  # Compatibility: A2UI React 0.13 needs adapter 0.2.1 (0.2.2 requires web_core 0.14).
  "@a2ui/react@0.13.0>@a2ui/markdown-it": "0.2.1"

  # Security overrides for transitive Dependabot alerts.
  # next@15.5 declares optionalDependencies.sharp ^0.34.3 — GHSA-f88m-g3jw-g9cj
  sharp: ^0.35.0
  # next@15.5 pins postcss 8.4.31 exactly — GHSA-6g55-p6wh-862q, GHSA-r28c-9q8g-f849,
  # GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93
  postcss: ^8.5.23
  # @esbuild-kit/core-utils (via drizzle-kit) pins ~0.18.20 (GHSA-67mh-4wv8-2f99);
  # react-email@5 pins ^0.27 (GHSA-g7r4-m6w7-qqqr)
  esbuild: ^0.28.1
  # xcode@3 (via @expo/config-plugins) declares uuid ^7.0.3 — GHSA-w5hq-g745-h8pq
  uuid: ^11.1.1
  # NOT overridden: decode-uri-component (GHSA-vcc3-ghjq-m6fr). Every patched
  # version (>=0.4.0) is ESM-only, and its sole consumer query-string@7 (via
  # expo-router) is CJS and calls `require('decode-uri-component')(value)`.
  # Under Metro's transform that require yields `{default: fn}` and throws
  # "not a function" on every URL parse — verified. Pending upstream.
  # plist@3 (via xcode) declares ^0.9.10 — GHSA-6gmq-8vp8-gcm6. Range-scoped so
  # @expo/plist's separate, unaffected ^0.8.8 line is left alone (0.8→0.9 is breaking).
  "@xmldom/xmldom@^0.9.0": ^0.9.12