pnpm-workspace.yaml

packages:
  - 'libs/**'
  - 'apps/**'
# pnpm 11 defaults `verifyDepsBeforeRun` to "install": before any script/`pnpm exec`
# it auto-installs when node_modules looks out of sync, and that reconcile can prune
# devDeps — which needs a modules-dir purge. In non-TTY contexts (the husky pre-commit
# hook, CI) the purge aborts with ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY. "warn"
# keeps the "node_modules out of sync — run pnpm install" heads-up without ever
# auto-installing or failing in non-interactive runs. (This setting is read from
# pnpm-workspace.yaml in pnpm 11, not .npmrc.)
verifyDepsBeforeRun: warn
onlyBuiltDependencies:
  - '@swc/core'
  - 'esbuild'
  - 'nx'
  - 'protobufjs'
  - 'ssh2'
  - 'unrs-resolver'
# Security floors for vulnerable transitive deps with no parent fix available
# (mostly dev tooling). Direct runtime deps are bumped in the catalog instead.
# Each entry maps to a Dependabot/`pnpm audit` finding — prune once it clears.
overrides:
  '@tanstack/start-server-core': '>=1.167.30'
  esbuild: '>=0.28.1'
  form-data: '>=4.0.6'
  # h3's only consumers are the Nitro v2 subtree (nitropack/listhen/unstorage),
  # which require h3 1.x (Nitro v2 imports `send`, removed in h3 2.x). Floor at
  # the patched 1.x line — 1.15.11 clears GHSA-4hxc-9384-m385 (fixed in 1.15.9).
  # The earlier `>=2.0.1` floor was inert (nothing pulled h3) and would force
  # the wrong major onto Nitro. Revisit if anything ever needs h3 2.x.
  h3: '^1.15.11'
  js-yaml: '>=4.1.2'
  tmp: '>=0.2.7'
  # Dedupe commitlint's loose TS resolution onto the workspace TS; cap <6.1 to
  # stay within typescript-eslint@8's `typescript <6.1.0` peer range.
  typescript: '~6.0.3'
  uuid: '>=11.1.1'
catalog:
  '@commitlint/cli': '^21.0.2'
  '@commitlint/config-conventional': '^21.0.2'
  '@eslint/js': '^10.0.1'
  '@nx/esbuild': '23.0.0'
  '@nx/eslint': '23.0.0'
  '@nx/eslint-plugin': '23.0.0'
  '@nx/js': '23.0.0'
  '@nx/node': '23.0.0'
  '@nx/vitest': '23.0.0'
  # Pure-TS FIPS 204 (ML-DSA) signing backend for the PQC roadmap (ADR-005,
  # #243). EXACT pin (pre-1.0 signing-path dependency): security fixes do NOT
  # flow automatically — upgrade only via a deliberate, reviewed bump.
  '@noble/post-quantum': '0.6.1'
  '@swc-node/register': '~1.11.1'
  '@swc/core': '~1.15.43'
  '@swc/helpers': '~0.5.23'
  '@tanstack/nitro-v2-vite-plugin': '^1.155.0'
  # Keep the Start/Router suite in lockstep: react-start 1.168.26 pins exact
  # tanstack deps including start-server-core 1.169.15 (the security floor below)
  # and react-router 1.170.16. Mismatched lines load two router-cores and crash
  # SSR dehydrate, so bump these together.
  '@tanstack/react-start': '^1.168.26'
  '@tanstack/react-router': '^1.170.16'
  '@testcontainers/postgresql': '^11.12.0'
  '@testcontainers/redis': '^11.12.0'
  '@types/node': '^26.0.0'
  '@types/nodemailer': '^7.0.4'
  '@types/pg': '^8.16.0'
  '@types/react': '^19.2.7'
  '@types/react-dom': '^19.2.3'
  '@types/supertest': '^7.2.0'
  '@types/zxcvbn': '^4.4.5'
  '@vitest/coverage-v8': '^4.1.9'
  '@vitest/ui': '^4.1.9'
  drizzle-kit: '^0.31.8'
  esbuild: '^0.28.1'
  eslint: '^10.5.0'
  eslint-config-prettier: '^10.1.8'
  eslint-plugin-import: '^2.32.0'
  eslint-plugin-jsx-a11y: '^6.10.2'
  eslint-plugin-prettier: '^5.5.6'
  eslint-plugin-react: '^7.37.5'
  eslint-plugin-react-hooks: '^7.1.1'
  eslint-plugin-simple-import-sort: '^13.0.0'
  husky: '^9.1.7'
  lint-staged: '^17.0.8'
  nx: '23.0.0'
  prettier: '^3.8.4'
  prettier-plugin-tailwindcss: '^0.8.0'
  supertest: '^7.1.4'
  tslib: '^2.8.1'
  tsx: '^4.21.0'
  typescript: '~6.0.3'
  typescript-eslint: '^8.62.0'
  vitest: '^4.1.9'
  '@fastify/autoload': '^6.3.1'
  '@fastify/cors': '^11.2.0'
  '@fastify/formbody': '^8.0.2'
  '@fastify/helmet': '^13.0.2'
  '@fastify/rate-limit': '^10.3.0'
  '@fastify/swagger': '^9.7.0'
  '@fastify/swagger-ui': '^5.2.5'
  '@node-rs/argon2': '^2.0.2'
  '@react-email/components': '^1.0.3'
  dotenv: '^17.2.3'
  drizzle-orm: '^0.45.2'
  drizzle-seed: '^0.3.1'
  fastify: '^5.8.5'
  fastify-plugin: '^5.1.0'
  fastify-type-provider-zod: '^6.1.0'
  ioredis: '^5.8.2'
  jose: '^6.1.3'
  nodemailer: '^9.0.1'
  pg: '^8.16.3'
  pino-pretty: '^13.1.3'
  prom-client: '^15.1.3'
  react: '^19.2.4'
  react-dom: '^19.2.4'
  resend: '^6.6.0'
  zod: '^4.2.1'
  zxcvbn: '^4.4.2'
  vite: '8.0.16'
  '@vitejs/plugin-react': '6.0.2'
  '@nx/vite': '23.0.0'
  '@nx/web': '23.0.0'
  jiti: '^2.7.0'
  jsdom: '^29.1.1'
  tailwindcss: '^4.2.1'
  '@tailwindcss/vite': '^4.2.1'
  '@nx/react': '23.0.0'
  tailwind-merge: '^3.5.0'
  clsx: '^2.1.1'
  class-variance-authority: '^0.7.1'
# pnpm 11 requires an explicit build decision per dependency with a postinstall
# script (it no longer infers them from onlyBuiltDependencies). Mirror the
# approved set; cpu-features is an optional ssh2 native accel we don't build.
allowBuilds:
  # Nitro's dev file-watcher; ships prebuilt binaries, so skip the native build.
  '@parcel/watcher': false
  '@swc/core': true
  cpu-features: false
  esbuild: true
  nx: true
  protobufjs: true
  ssh2: true
  unrs-resolver: true