BGforge-MLS/pnpm-workspace.yaml at master · BGforgeNet/BGforge-MLS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
packages:
  - binary
  - binary-editor
  - client
  - format
  - image
  - server
  - compilers/ssl
  - compilers/tssl
  - grammars/*
  - plugins/*
  - transpilers
  - transpilers/common
  - transpilers/tbaf
  - transpilers/td

# Mechanical enforcement for the lockstep dependency groups documented in
# docs/dependencies.md, plus single-version enforcement for deps that several
# workspace packages declare independently. A member manifest references `catalog:`
# instead of a literal range, so an out-of-lockstep bump in one package.json fails
# `pnpm install` rather than silently drifting until noticed by convention.
catalog:
  vscode-languageclient: 10.1.0
  vscode-languageserver: 10.1.0
  vscode-languageserver-protocol: 3.18.2
  ts-morph: ^27.0.2
  typescript: ^5.9.3
  vitest: ^4.1.10
  "@types/node": ^24.13.3
  cac: ^7.0.0
  diff: ^9.0.0
  esbuild-wasm: ^0.28.1
  fast-check: ^4.9.0
  quick-lru: ^7.3.0
  tsdown: ^0.22.4
  web-tree-sitter: ^0.26.10

# Grammars compile to WASM via tree-sitter-cli and load through web-tree-sitter at
# runtime, so the native `tree-sitter` binding is denied. `keytar` is a transitive
# `@vscode/vsce` dep no longer used since vsce 3. `@vscode/vsce-sign` only matters
# when signing the VSIX, which is not done in this build. `lefthook`'s postinstall
# downloads the platform binary used by `pnpm exec lefthook install` (wired via the
# root `prepare` script).
allowBuilds:
  esbuild: true
  tree-sitter-cli: true
  "@vscode/vsce-sign": false
  keytar: false
  tree-sitter: false
  lefthook: true

# Transitive pins addressing security advisories. Each is still load-bearing: with
# it removed, `pnpm install` resolves the dependency back to a vulnerable version
# and `pnpm audit` re-flags the advisory.
#   - mocha's bundled diff (GHSA-73rr-hh4g-fpgx: parsePatch/applyPatch DoS; fixed
#     in 8.0.3) and serialize-javascript (GHSA-5c6j-r48x-rmvq RCE, GHSA-qj8w-gfj5-8c6v
#     DoS; fixed in 7.0.5).
#   - qs via typed-rest-client under @vscode/vsce and the Stryker packages
#     (GHSA-q8mj-m7cp-5q26: qs.stringify DoS; fixed in 6.15.2). Still load-bearing
#     as of 2026-08-04: without it one typed-rest-client copy resolves qs 6.15.1.
# The top-level deps (@vscode/vsce, Stryker) are already at their latest versions,
# so these are transitive pins, not direct bumps. Overrides are dropped once their
# upstreams resolve to a patched version on their own (verified by removing the pin,
# reinstalling, and confirming `pnpm audit` stays clean), leaving the pin redundant.
# Dropped so far: the former brace-expansion pin (minimatch now resolves 5.0.6);
# the tmp (>=0.2.6, GHSA-ph9p-34f9-6g65), esbuild (>=0.28.1,
# GHSA-gv7w-rqvm-qjhr / GHSA-g7r4-m6w7-qqqr), and form-data (>=4.0.6,
# GHSA-hmw2-7cc7-3qxx) pins, all dev/test/packaging-only and now resolving patched
# naturally through @vscode/vsce and the Stryker -> vitest -> vite chain; the
# uuid pin (GHSA-w5hq-g745-h8pq), since msal-node no longer pulls uuid into the tree;
# and the fast-uri pin (^3.1.4, GHSA-v2hh-gcrm-f6hx - its second stint: an earlier
# drop was reversed when the advisory widened to <=3.1.3), since ajv declares ^3.0.1
# and resolves each patched version naturally - most recently 3.1.5, closing
# GHSA-7p8r-x3mc-p8w7 with no pin.
# brace-expansion (GHSA-mh99-v99m-4gvg) needed no override in the end: it was briefly
# an accepted risk while the advisory patched only 5.0.8 - minimatch@9 default-imports
# brace-expansion, 5.x is named-export only, so a ">=5.0.8" override breaks the build -
# but upstream then backported the fix to the 2.x line (2.1.3) and the lockfile
# resolves a patched 2.x within minimatch@9's own range.
# undici under @vscode/vsce -> cheerio (GHSA-4cwx-7wf7-3272 high, plus four moderate)
# needed no override either: cheerio declares ^7.19.0, so re-resolving picked up the
# patched 7.29.0 in range. A stale lockfile entry, not a range that excluded the fix.
overrides:
  mocha>diff: ">=8.0.3"
  mocha>serialize-javascript: ">=7.0.5"
  qs: ">=6.15.2"

# pnpm 11 enables minimumReleaseAge (24h maturity window) by default. The built-in
# SSL compiler ships as a GitHub-release tarball (server/package.json
# sslc-emscripten-noderawfs), not an npm package, so it has no registry publish
# timestamp to check the window against - resolution fails with a 404 on lockfile
# re-verification. The tarball is already integrity-pinned by its lockfile hash, so
# the age window adds nothing here; exclude it so `pnpm install`/`update` resolve.
minimumReleaseAgeExclude:
  - sslc-emscripten-noderawfs