pnpm-workspace.yaml

packages:
  - "apps/*"
  - "packages/*"

# Settings below were migrated from the package.json "pnpm" field — pnpm 11 no
# longer reads that field and takes these from pnpm-workspace.yaml instead.
overrides:
  typescript: "^5"
  source-map: "^0.7.4"
  sass-embedded: "1.93.2"
  "@sentry/core": "^8.55.0"
  "@sentry/types": "^8.55.0"
  "@sentry/utils": "^8.55.0"
  # Security advisories (pnpm audit --prod). In-major bumps of transitive deps only —
  # low regression risk. Runtime-relevant ones first (markdown/linkify process user
  # content in the TipTap editor; form-data rides axios), then build-chain patches.
  # Each override is scoped to the vulnerable major so it can't downgrade an unrelated
  # major — e.g. rollup@3 is the vulnerable Sentry path; tsup stays on its rollup 4.x.
  "linkify-it@5": "^5.0.2"
  "markdown-it@14": "^14.3.2"
  "form-data@4": "^4.0.6"
  "tmp@0.2": "^0.2.6"
  "rollup@3": "^3.30.0"
  "postcss@8": "^8.5.29"
  "brace-expansion@1": "^1.1.21"
  "brace-expansion@2": "^2.1.7"
  "@babel/core@7": "^7.29.1"
  "brace-expansion@5": "^5.0.12"
  # 2026-10 batch, same rule: floor each vulnerable transitive dep at its first fixed
  # release inside the major it already resolves to.
  "seroval@1": "^1.6.3"
  "seroval-plugins@1": "^1.6.3"
  "follow-redirects@1": "^1.16.1"
  "qs@6": "^6.16.0"
  "undici@6": "^6.28.1"
  "dompurify@3": "^3.4.16"
  "sharp@0.35": "^0.35.5"
  "immutable@5": "^5.1.8"
  "js-yaml@3": "^3.15.2"
  "js-yaml@4": "^4.3.2"
  "browserslist@4": "^4.28.7"
  "fast-uri@3": "^3.1.8"
  "source-map-js@1": "^1.2.2"
  "@humanfs/node@0.16": "^0.16.8"
  # Previously-deferred advisories that need a cross-major bump of the vulnerable dep.
  # Validated via install + build:packages + typecheck + CI's full web build.
  serialize-javascript: "^7.0.5"
  js-cookie: "^3.0.6"
  uuid: "^11.1.1"
  esbuild: "^0.28.1"
  # Crash fix, not an advisory: 1.41.2's updateDraggedNode resolved a drag position
  # captured against the PREVIOUS doc against the new one with no upper bound, so a
  # paste that shrinks the doc threw "Position N outside of fragment" out of the
  # publish editor (ECENCY-NEXT-1GK1, issue #1431). Upstream added both bounds checks.
  # Transitive via @tiptap/pm, so an override is the only place to pin it forward.
  # prosemirror-model rides along: 1.42.2 wants a newer patch than the 1.25.3 the rest
  # of the ProseMirror graph resolved to, and without this it installs a SECOND copy —
  # two prosemirror-model instances mean nodes and schemas fail cross-copy identity
  # checks inside the editor. Both must stay single-version.
  # TipTap 3's @tiptap/pm asks for newer prosemirror-state/-transform than other
  # packages in the graph, which left two copies of each, so they are pinned too.
  prosemirror-view: "^1.42.3"
  prosemirror-model: "^1.25.11"
  prosemirror-state: "^1.4.4"
  prosemirror-transform: "^1.12.2"
  # NOTE: @opentelemetry/core is intentionally NOT overridden — forcing 2.8.x breaks
  # @sentry/nextjs' pinned OpenTelemetry graph (undefined `AlwaysOn`). Its advisory stays
  # until @sentry/nextjs is bumped.

# pnpm 11 removed onlyBuiltDependencies / ignoredBuiltDependencies in favour of
# allowBuilds (a per-package true/false map), enforced by strictDepBuilds.
# true  = previously-allowlisted deps that genuinely need their native/build step.
# false = sharp (unused: images run unoptimized) and the optional ws native
#         addons (JS fallback is used, so building them is unnecessary).
# A new dependency that ships a build script will fail CI until it's reviewed
# and added here — that's the intended supply-chain guard.
allowBuilds:
  "@firebase/util": true
  "@parcel/watcher": true
  "@sentry/cli": true
  "@sentry/profiling-node": true
  "bigint-buffer": true
  "core-js": true
  "esbuild": true
  "keccak": true
  "protobufjs": true
  "scryptlib": true
  "secp256k1": true
  "unrs-resolver": true
  "sharp": false
  "bufferutil": false
  "utf-8-validate": false

# Supply-chain guard: refuse to install package versions published less than a
# day ago, so a compromised version that's published and yanked within hours is
# never pulled in. Trade-off: `pnpm install --frozen-lockfile` (CI) will fail
# for ~24h after a same-day dependency bump lands in the lockfile — re-run CI
# once the version has aged, or add the package to minimumReleaseAgeExclude.
minimumReleaseAge: 1440

patchedDependencies:
  '@tooni/iconscout-unicons-react@1.0.1': patches/@tooni__iconscout-unicons-react@1.0.1.patch