pnpm-workspace.yaml

packages:
  - 'apps/*'
  # Standalone bun package (own bun.lock, installed by its Docker build stage
  # and dev tooling). Excluded from pnpm because its pinned @earendil-works/pi
  # release is younger than the workspace's 72h minimumReleaseAge cooldown;
  # fold it into the workspace once the pin ages past the window.
  - '!apps/kortix-worker'
  - 'packages/*'
  - 'tests'

# --- supply-chain hardening ---------------------------------------------------
# These mirror pnpm 11 defaults and are duplicated here for clarity / older clients.
# See also .npmrc (same settings as flat keys for non-workspace tooling).

# 72h cooldown before any newly-published version is resolvable. Stops fast-moving
# account-takeover attacks (TanStack 2026-05-11, Shai-Hulud, mini-Shai-Hulud) which
# are typically yanked within hours. 3 days covers Fri-night publish through
# Monday-morning disclosure. Use minimumReleaseAgeExclude for emergency hotfixes.
minimumReleaseAge: 4320
minimumReleaseAgeExclude: []   # add specific packages here for emergency hotfixes

# Block lifecycle scripts everywhere except the allow-list below. The TanStack
# payload was a postinstall — this is the single most important defense.
dangerouslyAllowAllBuilds: false
onlyBuiltDependencies:
  - esbuild
  - "@esbuild/darwin-arm64"
  - "@esbuild/linux-x64"
  - "@esbuild/linux-arm64"
  - sharp
  - "@img/sharp-darwin-arm64"
  - "@img/sharp-linux-x64"
  - "@img/sharp-linux-arm64"
  - "@img/sharp-libvips-darwin-arm64"
  - "@img/sharp-libvips-linux-x64"
  - "@img/sharp-libvips-linux-arm64"
  - "@swc/core"
  - "@parcel/watcher"
  - lightningcss
  - "@tailwindcss/oxide"
  - "@playwright/test"
  - playwright
  - playwright-core
  - next
  - "@next/swc"
  - bufferutil
  - utf-8-validate
  - unrs-resolver
  # @kortix/desktop-electron — Electron's postinstall downloads the platform
  # binary; without this allow-list `electron .` has no runtime to launch.
  - electron

catalog:
  '@tsconfig/bun': ^1.0.7
  'typescript': ^5.4.0
  '@types/bun': ^1.1.0
  '@types/node': ^22.0.0

# Moved from package.json -> pnpm.overrides (pnpm 11 dropped that location).
overrides:
  '@types/react': ^19.1.17
  '@types/react-dom': ^19.2.3
  'import-in-the-middle': 3.0.0
  'shiki': 3.23.0
  'next@>=15.0.0 <15.5.18': '15.5.18'
  'axios@>=1.0.0 <1.16.0': '1.16.0'
  'protobufjs@>=7.0.0 <7.6.3': '7.6.3'
  'protobufjs@>=8.0.0 <8.6.0': '8.6.0'
  '@protobufjs/utf8@>=1.0.0 <1.1.1': '1.1.1'
  'mermaid@>=11.0.0 <11.15.0': '11.15.0'
  '@opentelemetry/sdk-node@>=0.0.0 <0.217.0': '0.217.0'
  '@opentelemetry/exporter-prometheus@>=0.0.0 <0.217.0': '0.217.0'
  'fast-uri@>=3.0.0 <3.1.2': '3.1.2'
  'hono@>=4.0.0 <4.12.34': '4.12.34'
  'next-intl@>=4.0.0 <4.9.2': '4.9.2'
  'icu-minify@>=4.0.0 <4.9.2': '4.9.2'
  'uuid@>=7.0.0 <11.1.1': '11.1.1'
  'uuid@>=13.0.0 <13.0.1': '13.0.1'
  'postcss@>=8.0.0 <8.5.18': '8.5.18'
  'fast-xml-parser@>=5.0.0 <5.7.0': '5.7.0'
  '@xmldom/xmldom@>=0.0.0 <0.8.13': '0.8.13'
  'dompurify@>=3.0.0 <3.4.11': '3.4.11'
  'follow-redirects@>=1.0.0 <1.16.0': '1.16.0'
  '@hono/node-server@>=1.0.0 <1.19.13': '1.19.13'
  'esbuild@>=0.0.0 <0.25.0': '0.25.0'
  'html2pdf.js@>=0.0.0 <0.14.0': '0.14.0'
  'flatted@>=3.0.0 <3.4.2': '3.4.2'
  'socket.io-parser@>=4.0.0 <4.2.6': '4.2.6'
  'undici@>=6.0.0 <6.27.0': '6.27.0'
  'brace-expansion@>=5.0.0 <5.0.8': '5.0.8'
  'brace-expansion@>=1.0.0 <1.1.13': '1.1.13'
  'picomatch@>=2.0.0 <2.3.2': '2.3.2'
  'diff@>=7.0.0 <8.0.3': '8.0.3'
  'js-yaml@>=3.0.0 <4.2.0': '4.2.0'
  '@opentelemetry/core@>=2.0.0 <2.8.0': '2.8.0'
  'brace-expansion@>=2.0.0 <2.0.3': '2.0.3'
  'yaml@>=1.0.0 <1.10.3': '1.10.3'
  'picomatch@>=4.0.0 <4.0.4': '4.0.4'
  'picomatch@>=3.0.0 <3.0.2': '3.0.2'
  'tar@>=7.0.0 <7.5.21': '7.5.21'
  'file-type@>=21.0.0 <21.3.1': '21.3.1'
  'minimatch@>=3.0.0 <3.1.4': '3.1.4'
  'minimatch@>=9.0.0 <9.0.7': '9.0.7'
  'ajv@>=8.0.0 <8.18.0': '8.18.0'
  'markdown-it@>=0.0.0 <14.2.0': '14.2.0'