pnpm-workspace.yaml

# pnpm-specific settings live here. pnpm v11 no longer reads the package.json
# "pnpm" field, nor non-auth/registry settings from .npmrc.

# Declare ui/ as a workspace member so its install picks up the supply-chain
# policies and merged overrides defined below. Without this, pnpm 11 walking
# up from ui/ finds this workspace but considers ui out-of-tree and does
# nothing (the prior ui/package.json#pnpm.overrides silently no-op'd in v11).
packages:
  - ui

# Supply-chain hardening
# Refuse to install package versions younger than 10 days
minimumReleaseAge: 14400
minimumReleaseAgeExclude:
  # TEMPORARY excludes (~remove once these patched versions clear the 10-day age
  # gate, ~2026-08-20): version-scoped so ONLY these exact security-patched
  # versions bypass minimumReleaseAge — every other version still gets the age
  # check. The `overrides` below are the permanent pins; only these are temporary.
  - brace-expansion@1.1.18 || 2.1.4 || 3.0.6 || 5.0.9
  - fast-uri@3.1.5
  - js-yaml@3.15.1 || 4.3.1 || 5.2.2
  - nanoid@3.3.18 || 5.1.16
  - ip-address@10.3.1
  - socket.io-parser@4.2.7
  - postcss@8.5.23
  - next@15.5.21 || 16.2.11
  - undici@6.28.0 || 8.9.0
  - react-router@7.18.2
  - react-router-dom@7.18.2
# Fail (don't silently downgrade) if a package's publisher trust level drops
trustPolicy: no-downgrade
# Known-benign provenance downgrades, vetted and exempted from no-downgrade.
# Each is a maintainer that stopped publishing with npm provenance (not an
# attack). See nodejs/undici#4666.
trustPolicyExclude:
  - undici-types
  # semver@6.3.1 (npm's own package) published without provenance; benign
  - semver
  - tailwind-merge
  - eslint-import-resolver-typescript
  - chokidar
  - rollup
# Transitive deps must resolve from the registry, not git/tarball sources
blockExoticSubdeps: true

# Security CVE pins migrated from the former package.json#pnpm.overrides at both
# the root AND ui/ (a non-workspace sub-tree). pnpm v11 stops reading any
# package.json#pnpm field, so the ui/-local overrides would silently no-op
# without being moved here — pnpm walking up from ui/ now finds these.
overrides:
  "socket.io-parser@>=4.0.0 <4.2.7": "4.2.7"
  "ip-address@<10.3.1": "10.3.1"
  "nanoid@>=4.0.0 <5.1.16": "5.1.16"
  "nanoid@<3.3.18": "3.3.18"
  # CVE-2026-41907 / GHSA-w5hq-g745-h8pq: uuid buffer bounds (11.x only; 8/9/10 deferred)
  "uuid@>=11.0.0 <11.1.1": "11.1.1"
  # GHSA-f88m-g3jw-g9cj: sharp libvips inherited CVEs (high)
  "sharp@<0.35.0": "0.35.3"
  # Force @noble/curves to a version that HAS npm provenance attestation, so
  # trustPolicy: no-downgrade is preserved (instead of excluding noble crypto
  # libs which would weaken the gate on security-critical packages). Provenance
  # status per `npm view @noble/curves@<v> dist.attestations`:
  #   1.7.5 (none), 1.8.0 (none), 1.8.2 (HAS), 1.9.0 (HAS), 1.9.5 (HAS, latest
  #   1.9.x with provenance), 1.10.0 (none), 2.1.0 (none), 2.2.0 (HAS).
  # Pinned within the 1.9.x line so it remains compatible with viem 2.50.x
  # (which declares "@noble/curves": "1.9.1"). For @noble/hashes, viem wants
  # 1.8.0 (HAS provenance), but a transitive resolves to 1.7.0 (none) — pin
  # @noble/hashes too. Provenance per version: 1.6.0 HAS, 1.7.0 none, 1.8.0 HAS.
  "@noble/curves": "1.9.5"
  "@noble/hashes": "1.8.0"
  # slow-redact: 0.3.1 HAS provenance, 0.3.2 dropped it; pin to last good
  "slow-redact": "0.3.1"
  # From root package.json
  "diff@<4.0.4": ">=4.0.4"
  "diff@>=5.0.0 <8.0.3": ">=8.0.3"
  # GHSA-gcfj-64vw-6mp9: prior redirect target 1.16.0 is itself vulnerable
  # (>=1.15.2 <1.18.0). Keep the 0.30.x pin within that minor line (0.30.3
  # is outside the 0.31.1–0.33.0 affected band for this advisory).
  "axios@>=1.0.0 <1.18.0": "1.18.0"
  "axios@0.30.4": "0.30.3"
  "plain-crypto-js@4.2.1": "0.0.0-security"
  # Migrated from ui/package.json#pnpm.overrides
  "react@19.0.0": ">=19.0.1"
  "react@>=19.1.0 <19.1.2": ">=19.1.2"
  "react@>=19.2.0 <19.2.4": ">=19.2.4"
  "react-dom@19.0.0": ">=19.0.1"
  "react-dom@>=19.1.0 <19.1.2": ">=19.1.2"
  "react-dom@>=19.2.0 <19.2.4": ">=19.2.4"
  "next@>=15.0.0 <15.0.5": ">=15.0.5"
  "next@>=15.1.0 <15.1.9": ">=15.1.9"
  "next@>=15.2.0 <15.2.6": ">=15.2.6"
  "next@>=15.3.0 <15.3.6": ">=15.3.6"
  "next@>=15.4.0 <15.4.10": ">=15.4.10"
  "next@>=15.5.0 <15.5.21": "15.5.21"
  "next@>=16.0.0 <16.0.11": ">=16.0.11"
  "next@>=16.1.0 <16.1.5": ">=16.1.5"
  "next@>=16.2.0 <16.2.11": ">=16.2.11"
  "glob@>=10.2.0 <10.5.0": ">=10.5.0"
  "@babel/runtime@<7.26.10": ">=7.26.10"
  "@metamask/sdk-communication-layer@>=0.16.0 <=0.33.0": ">=0.33.1"
  "@metamask/sdk@>=0.16.0 <=0.33.0": ">=0.33.1"

  "h3@<=1.15.4": ">=1.15.5"
  "preact@>=10.26.5 <10.26.10": ">=10.26.10"
  "preact@>=10.27.0 <10.27.3": ">=10.27.3"
  "preact@>=10.28.0 <10.28.2": ">=10.28.2"
  "@coinbase/wallet-sdk@>=4.0.0-beta.0 <4.3.0": ">=4.3.0"
  "minimatch@<3.1.4": ">=3.1.4"
  "@isaacs/brace-expansion@<=5.0.0": ">=5.0.1"

  # CVE-2026-13149: no patched 3.x/4.x exists — advisory remediates >=3.0.0 via 5.0.7

  "flatted@<3.4.0": ">=3.4.0"
  "ajv@<6.14.0": ">=6.14.0"
  "bn.js@<4.12.3": ">=4.12.3"

  "hono@<4.12.25": ">=4.12.25 <5.0.0"  # CVE-2026-54290 (was <4.12.18 -> 4.12.18, now itself vulnerable)

  # CVE-2026-48779: ws DoS via oversized headers. Only the 8.x line is
  # affected (8.18.0/8.20.1 in-tree); ws@7.5.11 is already patched, leave it.
  "ws@>=8.0.0 <8.21.0": ">=8.21.0 <9.0.0"
  # CVE-2026-12143: form-data predictable multipart boundary
  "form-data@>=4.0.0 <4.0.6": ">=4.0.6 <5.0.0"

  # CVE-2026-69152 patched lines: 1.1.18 / 2.1.4 / 3.0.6 / 5.0.9
  "brace-expansion@<1.1.18": "1.1.18"
  "brace-expansion@>=2.0.0 <2.1.4": "2.1.4"
  "brace-expansion@>=3.0.0 <3.0.6": "3.0.6"
  "brace-expansion@>=4.0.0 <5.0.9": "5.0.9"
  "postcss@<8.5.23": "8.5.23"
  "fast-uri@>=3.0.0 <3.1.5": "3.1.5"
  "js-yaml@>=3.0.0 <3.15.1": "3.15.1"
  "js-yaml@>=4.0.0 <4.3.1": "4.3.1"
  "js-yaml@>=5.0.0 <=5.2.1": "5.2.2"
# Dependencies permitted to run install/build scripts (all known native tools).
allowBuilds:
  bufferutil: true
  keccak: true
  sharp: true
  unrs-resolver: true
  utf-8-validate: true