pnpm-workspace.yaml

# Copyright (c) Meta Platforms, Inc. and affiliates.

packages:
  - 'apps/*'
  # Example apps are standalone templates for the community to copy — they are
  # never built in-repo, so they stay out of the workspace and pin their own
  # dependency versions instead of using workspace protocols like catalog:.
  - '!apps/example-*'
  - 'packages/*'
  - 'packages/themes/*'
  - 'internal/*'
  # Canonical vibe-test fixtures are standalone consumer apps. They carry their
  # own exact dependencies and lockfiles and are copied to sandboxes before use.
  - '!internal/vibe-tests/fixtures/**'

# Migrated from .npmrc: pnpm 11 reads these hoisting/linker settings from
# pnpm-workspace.yaml, not .npmrc. Keeps the flat, Yarn-1-style node_modules
# layout that build tools (and some phantom test imports) rely on.
nodeLinker: hoisted
shamefullyHoist: true
linkWorkspacePackages: true

minimumReleaseAge: 10080
minimumReleaseAgeExclude:
  - '@astryxdesign/*'
  - 'dompurify'

# Single source of truth for the workspace's vite version: every consumer
# (root test config, packages/build) declares "vite": "catalog:", so a bump
# lands here once and cannot split the workspace across two vite majors.
# vite 8 requires @vitejs/plugin-react >= 5 (4.x peers stop at vite 7) —
# bump them together. The standalone example apps and the vibe-tests
# preview app pin their own vite; keep them on the same major by hand.
#
# StyleX, prettier, and esbuild are workspace-wide tool pins (formerly pnpm
# overrides) — every consumer declares them as "catalog:" so a bump lands
# here once. Peer ranges in packages/* stay loose on purpose; those are
# consumer contracts, not workspace pins.
catalog:
  vite: ^8.1.3
  '@stylexjs/stylex': ^0.19.0
  '@stylexjs/babel-plugin': ^0.19.0
  '@stylexjs/postcss-plugin': ^0.19.0
  prettier: ^3.9.3
  esbuild: ^0.28.1

# Moved from package.json's "pnpm" field: pnpm 11 no longer reads
# pnpm.overrides / pnpm.onlyBuiltDependencies from package.json.

# Every entry is a LIVE security floor, annotated with the dependent that pins
# the vulnerable version and the condition for deleting it. To re-verify one:
# drop the line, run `pnpm install --lockfile-only`, then `pnpm audit`. Entries
# the graph now reaches on its own get pruned — no alignment or dedup forces.
overrides:
  # next@15 pins postcss 8.4.31. Drop when Next raises its postcss dep.
  postcss: ^8.5.23
  # monaco-editor@0.55 pins dompurify 3.2.7. Drop when it catches up.
  dompurify: ^3.4.13
  # tsup@8.5 resolves esbuild 0.27.7. Drop when tsup raises its range.
  esbuild: '>=0.28.1'
  # read-yaml-file 1.x is stuck on js-yaml 3.x (`safeLoad`, no CVE-2026-53550
  # fix), so lift the package: 2.x calls `load` and keeps the same CJS surface.
  # Floored at 4.x, not the 5.x line — 5.x had its own DoS (GHSA-pm4m-ph32-ghv5,
  # GHSA-724g-mxrg-4qvm) patched only in 5.2.2, and every other js-yaml
  # consumer in the graph already resolves inside ^4 on its own.
  read-yaml-file: ^2.1.0
  read-yaml-file>js-yaml: ^4.3.1
  # next's optional sharp stays on 0.34.5, inheriting four libvips advisories
  # patched only in 0.35 — out of reach of its own ^0.34 range. Drop when next
  # depends on 0.35 itself.
  sharp: ^0.35.3

# pnpm 11 replaced the onlyBuiltDependencies allowlist with an allowBuilds map
# (managed via `pnpm approve-builds`). These are the same packages previously
# trusted to run install/build scripts under pnpm 10's onlyBuiltDependencies.
allowBuilds:
  '@parcel/watcher': true
  '@swc/core': true
  core-js: true
  esbuild: true
  puppeteer: true
  sharp: true