pnpm-workspace.yaml

packages:
  - 'packages/*'
  - 'apps/*'

# Moved from package.json "pnpm".overrides — centralized here for pnpm 11
overrides:
  # Was pinned to 5.5.6 for an earlier CVE; bumped past two newer advisories
  # (<5.5.7 entity-expansion bypass, <5.7.0) since parents don't float high enough on their own.
  fast-xml-parser: '>=5.7.0'
  # pnpm audit fixes below: parents' declared ranges permit these floors, but
  # plain `pnpm update` doesn't force re-resolution of nested transitive deps.
  # Pinned exactly (not a floor): typeorm now publishes a 1.x line, and an
  # open-ended '>=' override would drag every resolution up to that major.
  typeorm: '0.3.31'
  axios: '>=1.18.1'
  # Upper-bounded: undici now publishes an 8.x line, and the bare '>=' floor this
  # used to carry silently resolved the CLI onto that major.
  undici: '>=7.29.0 <8.0.0'
  hono: '>=4.12.25'
  piscina: '>=4.9.3'
  shell-quote: '>=1.8.5'
  morgan: '>=1.10.2'
  protobufjs: '>=7.6.5'
  websocket-driver: '>=0.7.5'
  multer: '>=2.2.0'
  ws: '>=8.21.0'
  uuid: '>=11.1.1'
  esbuild: '>=0.28.1'
  # Two coexisting major lines (istanbul chain wants ^3.x, eslint chain wants ^4.x)
  js-yaml@3: 3.15.0
  js-yaml@4: 4.3.0
  # Four coexisting major lines, one per minimatch major version consuming it
  brace-expansion@1: 1.1.18
  brace-expansion@2: 2.1.4
  brace-expansion@5: 5.0.9
  # The 4.x line has no patched release, so redirect it onto the fixed 5.x line
  brace-expansion@4: 5.0.9
  # Two coexisting major lines (pg-mem wants ^4.x, sass wants ^5.x)
  immutable@4: 4.3.9
  immutable@5: 5.1.9
  # packages/ui and packages/frontend declare a deliberately broad '>=18.0.0' React
  # peer, which autoInstallPeers resolves on its own. Without these it settles on a
  # second React beside the app's, and every hook in the ui test suite throws
  # "Invalid hook call". Keep both pinned in step with package.json.
  react: 19.2.8
  react-dom: 19.2.8
  # Upper-bounded to the current major so a future major release can't be dragged in
  postcss: '>=8.5.25 <9.0.0'
  socket.io-parser: '>=4.2.7 <5.0.0'
  valibot: '>=1.4.2 <2.0.0'
  browserslist: '>=4.28.7 <5.0.0'
  dompurify: '>=3.4.13 <4.0.0'
  qs: '>=6.16.0 <7.0.0'
  # Two coexisting major lines (postcss wants ^3.x, @milkdown/utils wants ^5.x),
  # and each line has its own advisory floor
  nanoid@3: '>=3.3.18 <4.0.0'
  nanoid@5: '>=5.1.16 <6.0.0'
  # No override for image-size: its two DoS advisories claim a >=2.0.3 fix that
  # upstream has not published (latest is 2.0.2). Only reachable through
  # less>vite>@react-router/dev, which parses build-time assets, so it is not
  # attacker-facing. Revisit once 2.0.3 ships.

# Converted from package.json "pnpm".onlyBuiltDependencies (list) to the allowBuilds map form
allowBuilds:
  bcrypt: true
  '@swc/core': true
  esbuild: true
  '@nestjs/core': true
  '@swc/cli': true
  # Not built under pnpm 9 either (was absent from onlyBuiltDependencies); kept disabled.
  # Native modules ship prebuilt binaries; their postinstall scripts are not required.
  nx: false
  '@google/genai': false
  '@parcel/watcher': false
  less: false
  msgpackr-extract: false
  protobufjs: false
  unrs-resolver: false

# Moved from .npmrc (pnpm 11 keeps only registry/auth settings in .npmrc)
packageManagerStrict: false
# Fail (not warn) if the active Node version doesn't satisfy package.json "engines.node"
engineStrict: true
autoInstallPeers: true
strictPeerDependencies: false
shamefullyHoist: false
enablePrePostScripts: true
publicHoistPattern:
  - '@types/*'
  - '*eslint*'
  - '*prettier*'