Hephaestus/pnpm-workspace.yaml at main · ls1intum/Hephaestus · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
packages:
  # The root `.` is a workspace package so changesets versions it as the single
  # app version (see .changeset/config.json). No script uses `pnpm -r`, so root
  # is never double-run; `--filter webapp|docs` stays explicit and unaffected.
  - .
  - webapp
  - docs

# Hoist patterns target packages found via Node module resolution from
# directories *outside* a pnpm package boundary. Keep narrow — broad globs
# leak phantom deps that no manifest declares.
publicHoistPattern:
  # React internals reachable from Storybook / vite-plugin-react / React Compiler
  - '*react*'
  # @types/* searched by TypeScript from source files in any subtree
  - '@types/*'

autoInstallPeers: true
strictPeerDependencies: false

# pnpm 11 reads overrides from pnpm-workspace.yaml (was package.json#pnpm.overrides
# in pnpm <= 10; both still work but workspace yaml is the documented home).
# vitest: force a single instance across the workspace so addon-vitest +
#   coverage-v8 share the version we directly depend on.
# Security pins (override transitives that ship known-vulnerable versions):
#   dompurify  – monaco-editor pins 3.2.7 / mermaid ^3.3.1 → XSS bypasses
#                (GHSA-crv5-9vww-q3g8 etc.); 3.4.4 is the patched line.
#   lodash(-es) – java-parser/chevrotain still ride on 4.17.21 with proto-pollution CVEs;
#                4.18.1 ships the patches.
#   serialize-javascript – copy-webpack-plugin (via @docusaurus) pulls older
#                versions with XSS via __proto__ (GHSA-1113686, GHSA-1115723).
#                7.0.5 is the safe baseline.
overrides:
  # @docusaurus/theme-mermaid asks for >=11.6.0 and resolved 11.15.0, whose ER parser rejects a
  # parenthesised column type. That is every NUMERIC(p,s) column, so the generated schema diagram
  # rendered as an error on the docs site. Fixed upstream in 11.16.1; pinned here until Docusaurus
  # floors it, and pinned rather than ranged so the diagram cannot regress on a transitive bump.
  mermaid: 11.16.1
  vitest: 4.1.11
  '@vitest/browser': 4.1.11
  '@vitest/runner': 4.1.11
  dompurify: 3.4.4
  lodash: 4.18.1
  lodash-es: 4.18.1
  serialize-javascript: 7.0.5

peerDependencyRules:
  allowedVersions:
    '@mermaid-js/layout-elk': 0.2.x
    tailwindcss: 4.x
    vite: 8.x

# Record platform-specific optional deps (rolldown/lightningcss/biome native bindings)
# for every OS+arch we run dev or CI on. Without this, a `pnpm install` on macOS
# would silently drop the Linux binaries from the lockfile, breaking CI.
supportedArchitectures:
  os:
    - linux
    - darwin
  cpu:
    - x64
    - arm64
  libc:
    - glibc
    - musl

allowBuilds:
  # Trusted: build is required at runtime
  '@swc/core': true
  esbuild: true
  koffi: true
  '@openapitools/openapi-generator-cli': true
  # Trusted: postinstall is a no-op preinstall shim or transitive build
  '@google/genai': true
  '@nestjs/core': true
  # Denied: postinstall scripts only print ads / collect telemetry
  core-js: false
  protobufjs: false
  # Trusted: msw's postinstall copies the service worker into node_modules; the
  # worker we serve from public/ is generated via `msw init` (see webapp/public).
  msw: true