pnpm-workspace.yaml

# This is the workspace definition for the build-tools release group. See https://pnpm.io/pnpm-workspace_yaml for more
# information about the format.
#
# Guidelines for updating this file:
#
# 1. Keep the entries alphabetical wherever possible.
# 2. DO NOT end a glob with "**". E.g. "packages/**". Doing so can include unexpected packages. This is especially true
#    of packages for which we build ESM and CJS. Such packages sometimes have package.json files in their source or
#    output directories during compilation.

packages:
  - "packages/*"

# Supply chain security settings - see /DEV.md for documentation
minimumReleaseAge: 0
resolutionMode: highest
blockExoticSubdeps: true
trustPolicy: no-downgrade
# List of packages known to be safe but for whatever reason were published at a date after another version of the same
# package (including later major versions) which had better provenance information.
# ALWAYS REVIEW CAREFULLY BEFORE ADDING SOMETHING TO THIS LIST.
trustPolicyExclude:
  # chokidar@4.0.3 (published 2024-12-18, by paulmillr) — pipeline regression.
  # Prior trusted: chokidar@4.0.1 (provenance, 2024-09-22, by paulmillr).
  # Same publisher (sole maintainer); provenance attestation was dropped after 4.0.1.
  # Pulled in transitively via mocha@11 (chokidar ^4.0.1) and sass@1 (chokidar ^4.0.0).
  # chokidar@5.0.0 has restored provenance but no upstream consumer pins ^5 yet.
  - "chokidar@4.0.3"
  # @octokit/endpoint@9.0.6 (published 2025-02-14, by octokitbot) — pipeline regression.
  # Prior trusted: @octokit/endpoint@10.1.3 (provenance, 2025-02-13, by octokitbot), with
  # verified provenance from octokit/endpoint.js .github/workflows/release.yml @ refs/heads/main.
  # Same publisher account (octokitbot); the v9 maintenance branch publish bypassed release.yml.
  # Pulled in transitively via danger@13 → @octokit/rest@20 → @octokit/core@5 → @octokit/request@8.
  # No reachable direct-dep bump escapes this without overriding @octokit/rest itself.
  - "@octokit/endpoint@9.0.6"
  # semver@5.7.2 (published 2023-07-10, by lukekarrys) — legacy maintenance line.
  # Prior trusted: semver@7.5.4 (provenance, 2023-07-07, by npm-cli-ops).
  # Different publisher account because the 5.x and 6.x maintenance lines are
  # hand-published by lukekarrys (a long-time npm/node-semver maintainer), while the
  # current 7.x line publishes through the npm-cli OIDC/Actions pipeline. The 5.x/6.x
  # lines will not be retroactively re-published with provenance. Pulled in by widely-
  # used legacy tooling that pins ^5 / ^6.
  - "semver@5.7.2"
  # undici-types@6.21.0 (published 2024-11-13, by matteo.collina) — pipeline regression.
  # Prior trusted: undici-types@6.19.2 (provenance, 2024-06-18, by matteo.collina).
  # Same publisher (undici project lead). Type-only package (.d.ts shipped from undici
  # repo); provenance attestation was lost on a subsequent 6.x release.
  - "undici-types@6.21.0"
strictDepBuilds: true

engineStrict: true
frozenLockfile: true
linkWorkspacePackages: true
strictPeerDependencies: true
updateNotifier: false

# pnpm 11 enabled this check by default, which runs a frozen-lockfile install before every `pnpm run <script>`.
# That breaks CI flows that modifies versions via `flub bump` then runs script like `pnpm run format`.
# We may want to enable this in the future, but doing so requires changes to the pipelines, so we restore the pnpm 10 defaults for now.
verifyDepsBeforeRun: false

# Use the number of cores on the machine by default.
workspaceConcurrency: 0

peerDependencyRules:
  # @types/node is only needed for compilation and not needed at runtime.
  # oclif includes some AWS-related features, but we don't use them.
  ignoreMissing:
    - '@types/node'
    - '@aws-sdk/*'

overrides:
  # Resolve known security vulnerabilities in transitive dependencies.
  brace-expansion@>=1 <2: ^1.1.17
  brace-expansion@>=2 <3: ^2.1.3
  brace-expansion@>=5 <6: ^5.0.8
  keyv@>=4 <5: ^5.5.3
  ts-deepmerge@>=7 <8: ^8.0.0
  yaml@>=2 <3: ^2.8.3

  # Resolve a known security vulnerability.
  ws@>=8 <9: ^8.21.0

  # fast-uri CVE-2026-75899 (SSRF via repeated hostname decoding). Fixed in 4.1.3.
  fast-uri: ^4.1.3

  # Resolve a known security vulnerability (no patched 0.0.x/0.1.x release; move to the 0.2.x line).
  tmp: ^0.2.6

  # Resolve a known security vulnerability.
  '@github/copilot': ^1.0.43

  # commitizen@4.3.1 (latest/final) pins lodash to exactly 4.17.21.
  # Override to allow resolution to a newer patched version.
  lodash: ^4.18.1

  # @types/glob@7.x uses minimatch.IOptions/IMinimatch interfaces.
  # Force @types/minimatch@5 which still includes these legacy definitions.
  '@types/glob>@types/minimatch': ~5.1.2

  # Resolve known ReDoS vulnerabilities in diff.
  diff@>=4 <5: ^4.0.4
  diff@>=7 <8: ^8.0.3
  diff@>=8 <9: ^8.0.3

  # Keep a single @types/node version to avoid duplicate oclif dependency trees.
  '@types/node': ~22.19.17

  # jssm-viz-cli brings in ESLint 8.x transitively; force ESLint 9.x workspace-wide.
  eslint: ~9.39.2

  # jssm-viz-cli eagerly loads sharp, but our build:diagrams task only emits SVG and never uses its raster output.
  # Replace sharp with an empty module rather than dropping it so the eager import still succeeds. This produces a net
  # reduction of 26 dependency snapshots, including sharp's native install and platform binaries.
  jssm-viz-cli>sharp: npm:empty-npm-package@1.0.0

  json5@<1.0.2: ^1.0.2
  json5@>=2.0.0 <2.2.2: ^2.2.2

  # mdast-util-gfm@3.1.0 imports ToMarkdownOptions from mdast-util-gfm-footnote;
  # version 2.0.0 does not export it, so pin to a fixed version.
  mdast-util-gfm-footnote: ^2.1.0

  # Resolve known js-yaml vulnerability (prototype pollution via merge keys).
  js-yaml@<4: 3.15.0
  js-yaml@>=4: 4.3.2

  jws: ^3.2.3

  # Fix unsanitized class-attribute injection vulnerability.
  mdast-util-to-hast: ^13.2.1

  # oclif includes AWS features we do not use; drop to reduce lockfile churn.
  oclif>@aws-sdk/client-cloudfront: '-'
  oclif>@aws-sdk/client-s3: '-'

  # Resolve known vulnerabilities in older versions.
  qs: ^6.15.2

  # Resolve a known security vulnerability.
  simple-git: ^3.36.0

  sharp: ^0.34.5

  # Resolve multiple tar vulnerabilities; 6.x line is EOL with no backports.
  tar: ^7.5.11

  minimatch@>=3 <4: ^3.1.5
  minimatch@>=5 <6: ^5.1.9
  minimatch@>=6 <7: ^6.2.3
  minimatch@>=7 <8: ^7.4.9
  minimatch@>=8 <9: ^8.0.7
  minimatch@>=9 <10: ^9.0.9
  minimatch@>=10 <11: ^10.2.4

  # Resolve GHSA-5c6j-r48x-rmvq. No 6.x fix exists.
  serialize-javascript@>=6 <7: ^7.0.4

  # Resolve known vulnerabilities in picomatch.
  picomatch@>=2 <3: ^2.3.2
  picomatch@>=4 <5: ^4.0.4
updateConfig:
  ignoreDependencies:
    - latest-version
    - read-pkg-up
    - type-fest
    - typescript

allowBuilds:
  '@biomejs/biome': true
  core-js: true
  es5-ext: true
  unrs-resolver: true