pnpm-workspace.yaml

packages:
  - "apps/*"
  - "packages/*"

# Peer dependency behavior (migrated from .npmrc; pnpm 11 reads it here).
autoInstallPeers: true

# Lifecycle-script permissions. pnpm 10+ blocks dependency build scripts by
# default; pnpm 11 uses `allowBuilds` (replacing onlyBuiltDependencies). These
# are all legitimate native-addon / binary installers that ran under pnpm 9,
# so they are re-enabled here to preserve behavior across the upgrade.
allowBuilds:
  "@swc/core": true
  bigint-buffer: true
  bufferutil: true
  esbuild: true
  keccak: true
  protobufjs: true
  secp256k1: true
  sharp: true
  utf-8-validate: true

# Dependency version overrides (migrated from package.json "pnpm.overrides";
# pnpm 11 no longer reads that field). These pin patched versions to pull in
# security fixes across the transitive dependency tree (see `pnpm audit`).
#
# `name@<range>` selector keys target only the vulnerable version range so an
# unrelated major isn't forced forward. Targets are caret/tilde-capped to the
# vulnerable major wherever a same-major patch exists.
overrides:
  # Long-standing pins (predate the pnpm 11 upgrade).
  "@aptos-labs/aptos-client": "^2.0.0"
  pbkdf2: "^3.1.3"
  sha.js: "^2.4.12"
  devalue: "^5.3.2"
  koa: "^2.16.1"
  vite: "^6.3.6"
  axios: "^1.15.1"
  # --- pnpm audit remediation ---
  form-data: "^4.0.6"
  esbuild: ">=0.28.1"
  protobufjs: "^7.6.4"
  "@protobufjs/utf8": "^1.1.1"
  valibot: "^1.2.0"
  rollup: "^4.59.0"
  happy-dom: "^20.8.9"
  lodash: "^4.17.24"
  turbo-stream: "^3.0.0"
  ajv: "^6.14.0"
  postcss: "^8.5.10"
  uuid: "^11.1.1"
  "glob@>=10.2.0 <10.5.0": "^10.5.0"
  "react-router@7": "^7.15.0"
  "minimatch@3": "^3.1.4"
  "minimatch@9": "^9.0.7"
  "ws@7": "^7.5.11"
  "ws@8": "^8.21.0"
  "bn.js@4": "^4.12.3"
  "bn.js@5": "^5.2.3"
  "yaml@1": "^1.10.3"
  "yaml@2": "^2.8.3"
  "brace-expansion@1": "^1.1.13"
  "brace-expansion@2": "^2.0.3"
  "js-yaml@3": "^3.15.0"
  "picomatch@2": "^2.3.2"

# `pnpm audit` suppressions. Both advisories below have NO published fix — the
# packages are effectively unmaintained and their latest release is still below
# the advisory's patched version. Neither vulnerable code path applies here:
#   - bigint-buffer (GHSA-3gc7-fjrx-p6mg): pulled only via @solana/web3.js; the
#     native toBigIntLE binding never loads (falls back to pure JS at runtime).
#   - elliptic (GHSA-848j-6mx2-7j84): low-severity transitive dependency.
# Revisit and remove these once upstream ships patched releases.
auditConfig:
  ignoreGhsas:
    - GHSA-3gc7-fjrx-p6mg # bigint-buffer <=1.1.5, no fix published
    - GHSA-848j-6mx2-7j84 # elliptic <=6.6.1, no fix published