-
Notifications
You must be signed in to change notification settings - Fork 427
Expand file tree
/
Copy pathpnpm-workspace.yaml
More file actions
104 lines (92 loc) · 4.21 KB
/
Copy pathpnpm-workspace.yaml
File metadata and controls
104 lines (92 loc) · 4.21 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
packages:
- './site'
- './test/cloudflare-workers'
- './test/ts-benchmarks'
# Allow (true) or disallow (false) script execution.
# https://pnpm.io/settings#allowbuilds
allowBuilds:
better-sqlite3@13.0.3: true
core-js: false # site dependency, useless scripts
core-js-pure: false # site dependency, useless scripts
esbuild@0.28.1 || 0.28.2: true # tsx@4.3.1 / docusaurus dependency || direct.
sharp: false # wrangler dependency, useless scripts
workerd@1.20260801.1: true # wrangler@4.120.0 dependency
auditConfig:
# Don't show in `pnpm audit`.
# https://pnpm.io/cli/audit#auditconfigignoreghsas
ignoreGhsas:
- GHSA-h726-x36v-rx45 # prototype-pollution-vulnerable-lodash.merge-dont-upgrade
# Deduplicate peer dependencies.
# see: https://github.com/pnpm/pnpm/issues/11070
dedupePeers: true
# Deny package installs that don't match the supported Node.js version/s.
# https://pnpm.io/settings#enginestrict
engineStrict: true
# avoid having to use `-w` when installing packages at project root.
# https://pnpm.io/settings#ignoreworkspacerootcheck
ignoreWorkspaceRootCheck: true
# fail and don't fallback to "too new" version of packages when none of their other
# versions match `minimumReleaseAge` range (default is 1 day).
# https://pnpm.io/settings#minimumreleaseagestrict
minimumReleaseAgeStrict: true
overrides:
# https://github.com/advisories/GHSA-v422-hmwv-36x6
body-parser@>=1.0.0 <1.20.6: 1.20.6
# https://github.com/advisories/GHSA-3jxr-9vmj-r5cp
# https://github.com/advisories/GHSA-mh99-v99m-4gvg
# https://github.com/advisories/GHSA-rgw5-rvv9-x895
brace-expansion@>=1.0.0 <1.1.18: 1.1.18
brace-expansion@>=5.0.0 <5.0.9: 5.0.9
# https://github.com/advisories/GHSA-73rr-hh4g-fpgx
diff@>=6.0.0 <8.0.3: 8.0.3
# https://github.com/advisories/GHSA-55q2-fjhq-7xh7
# https://github.com/advisories/GHSA-c2j3-45gr-mqc4
dompurify@>=3.0.0 <3.4.13: 3.4.13
# https://github.com/advisories/GHSA-v2hh-gcrm-f6hx
# https://github.com/advisories/GHSA-7p8r-x3mc-p8w7
fast-uri@>=3.0.0 <3.1.5: 3.1.5
# https://github.com/advisories/GHSA-52cp-r559-cp3m
# https://github.com/advisories/GHSA-5p4m-2wfm-xmqj
js-yaml@>=4.0.0 <4.3.1: 4.3.1
# https://github.com/advisories/GHSA-6x64-9x62-f2gx
# https://github.com/advisories/GHSA-3rrr-jr9j-h3q3
# https://github.com/advisories/GHSA-2v8p-3f2j-5mp7
# https://github.com/advisories/GHSA-rhh3-jpg6-66xh
# https://github.com/advisories/GHSA-c4c3-pg64-4m4v
mermaid@>=11.0.0 <11.16.1: 11.16.1
# https://github.com/advisories/GHSA-6g55-p6wh-862q
# https://github.com/advisories/GHSA-r28c-9q8g-f849
# https://github.com/advisories/GHSA-fxqj-rqcc-2cmp
postcss@>=8.0.0 <8.5.23: 8.5.23
# https://github.com/advisories/GHSA-5c6j-r48x-rmvq
# https://github.com/advisories/GHSA-qj8w-gfj5-8c6v
serialize-javascript@>=5.0.0 <7.0.5: 7.0.5
# https://github.com/advisories/GHSA-395f-4hp3-45gv
shell-quote@>=1.0.0 <1.9.0: 1.9.0
# https://github.com/advisories/GHSA-2p49-hgcm-8545
svgo@>=3.0.0 <3.3.4: 3.3.4
# https://github.com/advisories/GHSA-w5hq-g745-h8pq
uuid@>=8.0.0 <11.1.1: 11.1.1
# https://github.com/advisories/GHSA-f5vj-f2hx-8m93
# https://github.com/advisories/GHSA-m28w-2pqf-7qgj
webpack-dev-server@>=5.0.0 <5.2.6: 5.2.6
# how versions get prefixed in `package.json`.
# https://pnpm.io/settings#saveprefix
savePrefix: ''
# Fail if a package's trust level has decreased compared to previous releases.
# https://pnpm.io/settings#trustpolicy
trustPolicy: no-downgrade
# A list of package selectors that should be excluded from the trust policy check.
# https://pnpm.io/settings#trustpolicyexclude
trustPolicyExclude:
- semver@5.7.2 || 6.3.1 # tsd@0.20.0 || @docusaurus/core@3.10.0 dependency - https://socket.dev/npm/package/semver/overview/5.7.2 || https://socket.dev/npm/package/semver/overview/6.3.1
updateConfig:
# Don't show in `pnpm outdated` or update in `pnpm update`.
# https://pnpm.io/settings#updateconfigignoredependencies
ignoreDependencies:
- '@types/prototype-pollution-vulnerable-lodash.merge-dont-upgrade'
- 'prototype-pollution-vulnerable-lodash.merge-dont-upgrade'
- 'typescript-6'
# Prompt before running custom scripts if `node_modules` is out of date.
# https://pnpm.io/settings#verifydepsbeforerun
verifyDepsBeforeRun: prompt