-
Notifications
You must be signed in to change notification settings - Fork 7
Expand file tree
/
Copy pathpnpm-workspace.yaml
More file actions
119 lines (114 loc) · 6.92 KB
/
Copy pathpnpm-workspace.yaml
File metadata and controls
119 lines (114 loc) · 6.92 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
# pnpm v11 workspace configuration
# Build-script allow-list: ONLY these packages may run postinstall/preinstall scripts.
# All other dependency build scripts are denied by default under pnpm v11.
# QNBS-v3: TS7 migration - disabled strictPeerDependencies for tsgo preview compatibility
strictPeerDependencies: false
# QNBS-v3: Keep pnpm's dependency-state guard strict; Git hooks run local Node entrypoints so a stale pnpm timestamp cannot bypass checks.
verifyDepsBeforeRun: error
autoInstallPeers: true
ignoreScripts: false
engineStrict: true
preferFrozenLockfile: true
verifyStoreIntegrity: true
sideEffectsCache: true
strictDepBuilds: true
blockExoticSubdeps: true
minimumReleaseAge: 10080
minimumReleaseAgeExclude:
- nanoid@3.3.18
- qs@6.16.0
# QNBS-v3: Migrated from package.json "pnpm" field (deprecated in pnpm v10+)
# Overrides with security justifications:
# - typescript: pin ecosystem TypeScript dependencies/peers to the existing TypeScript 6.0.3
# compatibility compiler while tsgo/native-preview remains the primary repository typechecker
# - serialize-javascript: CVE-2024-XXXX - prototype pollution fix
# - chrome-launcher: CVE-2024-XXXX - command injection fix
# - tmp: GHSA-7c78-jf6q-g5cm - type-confusion _assertPath bypass (fixed 0.2.7)
# - @xmldom/xmldom: GHSA-6gmq-8vp8-gcm6 - XML fragment injection via invalid EntityReference.nodeName (fixed 0.9.12)
# - protobufjs: GHSA-wcpc-wj8m-hjx6 - DoS via unbounded Any expansion in JSON conversion (fixed 8.4.1);
# raised to >=8.6.6 for GHSA-j3f2-48v5-ccww / GHSA-jfj6-75fj-8934 (2026-07)
# - axios: CVE-2024-XXXX - SSRF fix
# - basic-ftp: CVE-2024-XXXX - path traversal fix
# - fast-uri: GHSA-7p8r-x3mc-p8w7 - host confusion via backslash authority parsing (fixed 3.1.5); superseded by GHSA-5jgf-p345-68v8/GHSA-f65p-4m7j-42xc/GHSA-fph4-wmhf-6fwf/GHSA-jqff-g426-hqxp - host confusion / SSRF via percent-encoding and IPv6 normalization (fixed 3.1.6)
# - ip-address: GHSA-mwp4-54f8-5fhr - leading-zero parsing mismatch enabling SSRF / trust-boundary bypass (fixed 10.3.1)
# - ws: GHSA-96hv-2xvq-fx4p - memory-exhaustion DoS from tiny fragments (fixed 8.21.0)
# - form-data: CRLF injection via unescaped boundary (fixed 4.0.6)
# - brace-expansion: GHSA-rgw5-rvv9-x895 - DoS via unbounded intermediate arrays (fixed 5.0.9)
# - uuid: GHSA-w5hq-g745-h8pq / CVE-2026-41907 - missing buffer bounds check in v3/v5/v6 API methods,
# allows silent partial writes with an insufficient output buffer or wrong offset (fixed 11.1.1 /
# 12.0.1 / 13.0.1 per major line; lockfile converges on 14.0.1, which the override floor now pins)
# - qs: GHSA-hrpp-h998-j3pp / CVE-2022-24999 - prototype pollution fix; superseded by GHSA-4mjr-xmp4-gh2g / GHSA-x5fp-wj9c-mxmx - array-limit bypass / isBuffer DoS (fixed 6.16.0; see minimumReleaseAgeExclude above for the release-age exception this specific version needed)
# - fflate: GHSA-px8p-9vwx-vf98 / CVE-2026-45820 - unzipSync() infinite loop on a malformed ZIP64 archive missing its extra-field tag (fixed 0.8.3); transitive via jspdf, whose own ^0.8.1 range already permits it
# - esbuild: GHSA-67mh-4wv8-2f99 - dev-server CORS allowed any origin to read responses;
# GHSA-gv7w-rqvm-qjhr - missing binary integrity verification (Deno module);
# GHSA-g7r4-m6w7-qqqr - Windows path traversal in the dev-server file handler (all fixed 0.28.1)
# - joi: GHSA-q7cg-457f-vx79 - recursive link() schemas can cause an uncaught RangeError (fixed 18.2.1)
# - dompurify: GHSA-55q2-fjhq-7xh7 + prior XSS/nesting fixes (fixed 3.4.13; the no-fix
# GHSA-x4vx-rjvf-j5p4 is accepted in src-tauri/osv-scanner.toml)
# - @babel/core: GHSA-4x5r-pxfx-6jf8 - build-time transpiler advisory (fixed 7.29.6). Bounded to the
# 7.x line (<8): react-docgen@8.0.3 (via storybook/@storybook/react-vite) declares "@babel/core":
# "^7.28.0" and calls the synchronous loadPartialConfig(), removed in Babel 8 in favor of
# loadPartialConfigSync(). An unbounded ">=7.29.6" resolved to 8.0.1 (react-docgen's own range
# notwithstanding) and crashed every Storybook build. Same failure mode the undici override below
# already documents -- keep within 7.x until react-docgen ships real Babel 8 support.
# - undici: GHSA-4cwx-7wf7-3272 (plus prior advisories) - cross-user disclosure and a parse-time crash
# from degenerate private-cache directives; transitive via jsdom (fixed 7.29.0, not 7.28.0).
# Bounded to the 7.x line (<8): undici 8.x removed lib/handler/wrap-handler.js, an internal file
# jsdom@29.1.1 require()s (jsdom declares undici ^7.25.0). An unbounded ">=7.28.0" resolved to 8.5.0
# and broke every jsdom test worker -> coverage collapse -> Quality Gate red. Keep within 7.x.
# - js-yaml: GHSA-5p4m-2wfm-xmqj - parser DoS fix (fixed 4.3.1)
# - playwright / playwright-core: dedup to a single version. @playwright/test bumped to 1.61
# while @axe-core/playwright (peer >=1.0.0) + the transitive `playwright` runner stayed on
# playwright-core@1.60.0, producing two copies whose nominally-distinct Page/ElementHandle
# types break the typecheck in tests/e2e/a11y.spec.ts (TS2322). Pin both to 1.61.0.
overrides:
playwright: "1.61.0"
playwright-core: "1.61.0"
esbuild: ">=0.28.1"
joi: ">=18.2.5 <19" # GHSA-6w3j-5fw6-r9vr + GHSA-gg4h-3hg2-grpc; capped at major 18 (wait-on's own declared range) so a future major can't force-install
typescript: "6.0.3"
serialize-javascript: ">=7.0.3"
chrome-launcher: "^1.2.1"
tmp: ">=0.2.7"
"@xmldom/xmldom": ">=0.9.12"
protobufjs: ">=8.6.6"
axios: ">=1.18.0"
basic-ftp: ">=5.3.1"
fast-uri: ">=3.1.6 <4"
ip-address: "10.3.1"
ws: ">=8.21.0"
form-data: ">=4.0.6"
brace-expansion: ">=5.0.9"
# QNBS-v3: excludes the two exact unpatched releases (12.0.0, 13.0.0) a bare ">=11.1.1" floor would still permit; the resolved 14.0.1 already satisfies this.
uuid: ">=11.1.1 <12.0.0 || >=12.0.1 <13.0.0 || >=13.0.1"
qs: ">=6.16.0"
fflate: ">=0.8.3"
dompurify: ">=3.4.13"
"@babel/core": ">=7.29.6 <8"
undici: ">=7.29.0 <8"
js-yaml: ">=4.3.2 <5" # GHSA-2883-xcg3-v3hh (jest/babel-istanbul transitive, dev-only)
nanoid@^3: "3.3.18"
nanoid@^5: "5.1.16"
# QNBS-v3 (2026-07-26): GHSA batch blocking the CI security gate — transitive-only dev paths.
adm-zip: ">=0.6.0" # GHSA-xcpc-8h2w-3j85 — 4GB memory allocation via crafted ZIP (onnxruntime-node)
postcss: ">=8.5.18" # GHSA — path traversal in previous source map (vite/storybook chain)
sharp: ">=0.35.4" # GHSA-rgj7-g3m4-5g8c + inherited libvips vulnerabilities (@huggingface/transformers, miniflare)
body-parser: ">=1.20.6 <2" # GHSA-v422-hmwv-36x6 — DoS via empty urlencoded body (express via @lhci/cli, dev-only)
peerDependencyRules:
allowedVersions:
vite-plugin-pwa>vite: "8"
patchedDependencies:
zod@4.4.3: patches/zod@4.4.3.patch
packages:
- "packages/*"
allowBuilds:
'@google/genai': false
'@swc/core': true
core-js: false
esbuild: true
onnxruntime-node: false
protobufjs: false
sharp: false
simple-git-hooks: false
unrs-resolver: false
workerd: false