pnpm-workspace.yaml

# Minimum age for new packages before they can be used (in minutes) – 10080 min = 1 week
minimumReleaseAge: 10080

minimumReleaseAgeExclude:
  - baseline-browser-mapping@2.10.42
  - browserslist@4.28.5
  - caniuse-lite@1.0.30001803
  - electron-to-chromium@1.5.389

# Hoist all dependencies to the root of node_modules because some packages
# (e.g. the draft-js ecosystem) do not work correctly with pnpm's default isolation strategy
shamefullyHoist: true

# Package version overrides to fix vulnerabilities and ensure compatibility
overrides:
  minimatch: '>9.0.7' # ReDoS fix in @typescript-eslint/typescript-estree
  underscore: '1.13.8' # Security fix in testcafe-hammerhead/httpntlm
  immutable: '>=3.8.3' # Prototype Pollution fix in @ardatan/relay-compiler
  tmp: '>=0.2.4' # Security fix in external-editor
  cookie: '^0.7.2' # hds-react compatibility (https://github.com/City-of-Helsinki/palvelutarjotin-ui/security/dependabot/101)
  lodash: '>=4.18.0' # Code Injection & Prototype Pollution fixes in @graphql-codegen

# pnpm 11 requires explicit opt-in for packages that run install scripts.
allowBuilds:
  # @ffmpeg-installer/ffmpeg pulls one platform-specific optional dependency.
  # Allow all supported platform packages so installs work on Linux/macOS/Windows.
  '@ffmpeg-installer/darwin-arm64': true
  '@ffmpeg-installer/darwin-x64': true
  '@ffmpeg-installer/linux-arm': true
  '@ffmpeg-installer/linux-arm64': true
  '@ffmpeg-installer/linux-ia32': true
  '@ffmpeg-installer/linux-x64': true
  '@ffmpeg-installer/win32-ia32': true
  '@ffmpeg-installer/win32-x64': true
  '@parcel/watcher': true # Native module for file system watching (used by sass and vite)
  esbuild: true
  msw: true # Mock Service Worker setup scripts
  unrs-resolver: true # Rust-based module resolver used by eslint-plugin-import-x