ethena_sats_adapters/pnpm-workspace.yaml at main · ethena-labs/ethena_sats_adapters · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
# pnpm-specific settings live here. pnpm v11 no longer reads the package.json
# "pnpm" field, nor non-auth/registry settings from .npmrc.

# Supply-chain hardening
# Refuse to install package versions younger than 10 days
minimumReleaseAge: 14400
# Pre-existing lockfile entry younger than the age gate; exclude so CVE
# override lockfile regeneration can proceed (already present on main).
# TODO(2026-08-10): drop this once ip-address@10.4.0 clears minimumReleaseAge
# (published 2026-07-31; 10-day gate ⇒ ~2026-08-10).
minimumReleaseAgeExclude:
  # TEMPORARY excludes (~remove once these patched versions clear the 10-day age
  # gate, ~2026-08-20): version-scoped so ONLY these exact security-patched
  # versions bypass minimumReleaseAge — every other version still gets the age
  # check. The `overrides` below are the permanent pins; only these are temporary.
  - js-yaml@3.15.1 || 4.3.1 || 5.2.2
  - brace-expansion@1.1.18 || 2.1.4 || 3.0.6 || 5.0.9
  - ip-address@10.4.0
# Fail (don't silently downgrade) if a package's publisher trust level drops
trustPolicy: no-downgrade
# Known-benign provenance downgrades, vetted and exempted from no-downgrade.
# Each is a maintainer that stopped publishing with npm provenance (not an
# attack). See nodejs/undici#4666.
trustPolicyExclude:
  - undici-types
  # semver@6.3.1 (npm's own package) published without provenance; benign
  - semver
# Transitive deps must resolve from the registry, not git/tarball sources
blockExoticSubdeps: true

# Security CVE pins migrated verbatim from the former package.json#pnpm.overrides
overrides:
  "bigint-buffer": "npm:bigint-buffer-fixed@^1.1.5"
  # GHSA-23hp-3jrh-7fpw / CVE-2026-59873 (CRITICAL): every tar <= 7.5.18 is
  # vulnerable to a decompression/parse DoS via unlimited input, so the old
  # `>=7.5.11` floor still resolved into the vulnerable range (7.5.16). Pinned
  # exactly: 7.5.20 is the newest release that clears `minimumReleaseAge` above.
  "tar": "7.5.20"
  "minimatch": ">=3.1.4"
  # GHSA-gcfj-64vw-6mp9: Node HTTP adapter can inherit polluted proxy after
  # interceptor config cloning; floor raised from >=1.16.0 to patched >=1.18.0.
  "axios": ">=1.18.0"
  "axios@1.14.1": ">=1.18.0"
  "axios@0.30.4": "0.30.3"

  # CVE-2026-13149: no patched 3.x/4.x exists — advisory remediates >=3.0.0 via 5.x

  "ip-address@<=10.1.0": "10.1.1"
  "uuid@>=11.0.0 <11.1.1": "11.1.1"
  "ws@>=7.0.0 <7.5.11": "7.5.11"
  "ws@>=8.0.0 <8.21.0": "8.21.0"
  "plain-crypto-js@4.2.1": "0.0.0-security"
  "lodash": ">=4.18.1"
  "bn.js": ">=5.2.3"
  "base-x": "^5.0.1"
  "@tootallnate/once": ">=3.0.1"

  "brace-expansion@<1.1.18": "1.1.18"
  "brace-expansion@>=2.0.0 <2.1.4": "2.1.4"
  "brace-expansion@>=3.0.0 <3.0.6": "3.0.6"
  "brace-expansion@>=4.0.0 <5.0.9": "5.0.9"
  "js-yaml@>=3.0.0 <3.15.1": "3.15.1"
  "js-yaml@>=4.0.0 <4.3.1": "4.3.1"
  "js-yaml@>=5.0.0 <=5.2.1": "5.2.2"
# Dependencies permitted to run install/build scripts.
allowBuilds:
  bigint-buffer-fixed: true # native, replaces bigint-buffer via override
  bufferutil: true # ws perf addon
  utf-8-validate: true # ws perf addon
  es5-ext: false # install script is a donation notice, not functional