pnpm-workspace.yaml

packages:
  - packages/*
  - '!packages/package-builder/build'
  - .claude/hooks/*

# Packages allowed to run build scripts (pnpm v11 strictDepBuilds default).
allowBuilds:
  esbuild: true
  postject: false

# Refuse to run if the pnpm version on PATH differs from the packageManager
# field in package.json. Our setup action pins pnpm via external-tools.json;
# any drift should fail fast, not silently auto-download via @pnpm/exe
# (which in rc.5 leaves a placeholder launcher that errors at runtime).
pmOnFail: error

catalog:
  '@anthropic-ai/claude-code': 2.1.98
  '@babel/core': 7.28.4
  '@babel/generator': 7.28.5
  '@babel/parser': 7.28.4
  '@babel/plugin-proposal-export-default-from': 7.27.1
  '@babel/plugin-transform-export-namespace-from': 7.27.1
  '@babel/plugin-transform-runtime': 7.28.3
  '@babel/preset-react': 7.27.1
  '@babel/preset-typescript': 7.27.1
  '@babel/runtime': 7.28.4
  '@babel/traverse': 7.28.4
  '@babel/types': 7.28.5
  '@gitbeaker/rest': 43.7.0
  '@iarna/toml': 2.2.5
  '@npmcli/arborist': 9.4.2
  '@npmcli/config': 10.4.0
  '@octokit/graphql': 9.0.1
  '@octokit/openapi-types': 25.1.0
  '@octokit/request-error': 7.0.0
  '@octokit/rest': 22.0.0
  '@octokit/types': 14.1.0
  '@pnpm/dependency-path': 1001.1.0
  '@pnpm/lockfile.detect-dep-types': 1001.0.13
  '@pnpm/lockfile.fs': 1001.1.17
  '@pnpm/logger': 1001.0.0
  '@sentry/node': 8.0.0
  '@sinclair/typebox': 0.34.49
  '@socketregistry/hyrious__bun.lockb': 1.0.19
  '@socketregistry/indent-string': 1.0.14
  '@socketregistry/is-interactive': 1.0.6
  '@socketregistry/packageurl-js': 1.4.2
  '@socketregistry/yocto-spinner': 1.0.25
  '@socketsecurity/config': 3.0.1
  '@socketsecurity/lib': 5.24.0
  '@socketsecurity/registry': 2.0.2
  '@socketsecurity/sdk': 4.0.1
  '@types/adm-zip': 0.5.7
  '@types/cmd-shim': 5.0.2
  '@types/js-yaml': 4.0.9
  '@types/micromatch': 4.0.9
  '@types/mock-fs': 4.13.4
  '@types/node': 24.9.2
  '@types/npm-package-arg': 6.1.4
  '@types/npmcli__arborist': 6.3.1
  '@types/npmcli__config': 6.0.3
  '@types/proc-log': 3.0.4
  '@types/react': 19.2.2
  '@types/semver': 7.7.1
  '@types/which': 3.0.4
  '@types/yargs-parser': 21.0.3
  '@vitest/coverage-v8': 4.0.3
  '@yao-pkg/pkg': 6.8.0
  '@yarnpkg/parsers': 3.0.3
  adm-zip: 0.5.16
  aggregate-error: npm:@socketregistry/aggregate-error@^1.0.15
  ajv-dist: 8.17.1
  ansi-regex: 6.2.2
  brace-expansion: 5.0.5
  browserslist: 4.25.4
  chalk-table: 1.0.2
  cmd-shim: 7.0.0
  compromise: 14.14.4
  del-cli: 6.0.0
  dev-null-cli: 2.0.0
  ecc-agentshield: 1.4.0
  emoji-regex: 10.6.0
  es-define-property: npm:@socketregistry/es-define-property@^1.0.7
  es-set-tostringtag: npm:@socketregistry/es-set-tostringtag@^1.0.10
  esbuild: 0.25.11
  fast-glob: 3.3.3
  fast-xml-parser: 5.5.1
  function-bind: npm:@socketregistry/function-bind@^1.0.7
  globalthis: npm:@socketregistry/globalthis@^1.0.8
  gopd: npm:@socketregistry/gopd@^1.0.7
  graceful-fs: 4.2.11
  has-property-descriptors: npm:@socketregistry/has-property-descriptors@^1.0.7
  has-proto: npm:@socketregistry/has-proto@^1.0.7
  has-symbols: npm:@socketregistry/has-symbols@^1.0.7
  has-tostringtag: npm:@socketregistry/has-tostringtag@^1.0.7
  hasown: npm:@socketregistry/hasown@^1.0.7
  hpagent: 1.2.0
  https-proxy-agent: 7.0.6
  husky: 9.1.7
  ignore: 7.0.5
  indent-string: npm:@socketregistry/indent-string@^1.0.14
  is-core-module: npm:@socketregistry/is-core-module@^1.0.11
  isarray: npm:@socketregistry/isarray@^1.0.8
  js-yaml: npm:@zkochan/js-yaml@0.0.10
  lint-staged: 16.1.6
  lodash: 4.17.21
  magic-string: 0.30.19
  micromatch: 4.0.8
  mock-fs: 5.5.0
  nanotar: 0.2.1
  nock: 14.0.10
  npm-package-arg: 13.0.0
  npm-run-all2: 8.0.4
  octokit: 5.0.5
  onnxruntime-web: 1.23.0
  open: 10.2.0
  oxfmt: 0.37.0
  oxlint: 1.52.0
  packageurl-js: npm:@socketregistry/packageurl-js@^1.4.2
  path-parse: npm:@socketregistry/path-parse@^1.0.8
  postject: 1.0.0-alpha.6
  react: 19.2.0
  react-reconciler: 0.33.0
  registry-auth-token: 5.1.0
  registry-url: 7.2.0
  safe-buffer: npm:@socketregistry/safe-buffer@^1.0.9
  safer-buffer: npm:@socketregistry/safer-buffer@^1.0.10
  semver: 7.7.2
  set-function-length: npm:@socketregistry/set-function-length@^1.0.10
  shell-quote: 1.8.3
  side-channel: npm:@socketregistry/side-channel@^1.0.10
  ssri: 12.0.0
  string-width: 8.1.0
  string_decoder: 0.10.31
  strip-ansi: 7.1.2
  tar-stream: 3.1.7
  taze: 19.6.0
  terminal-link: 2.1.1
  tiny-colors: 2.1.3
  trash: 10.0.0
  type-coverage: 2.29.7
  typedarray: npm:@socketregistry/typedarray@^1.0.8
  typescript: 5.9.3
  undici: 6.21.3
  unplugin-purge-polyfills: 0.1.0
  vite: 7.3.2
  vitest: 4.0.3
  wrap-ansi: 9.0.2
  xml2js: 0.6.2
  yaml: 2.8.1
  yargs-parser: 21.1.1
  yoctocolors-cjs: 2.1.3
  zod: 4.1.8
# pnpm v11 reads settings from this file; only auth/registry go in .npmrc.
ignoreScripts: true
linkWorkspacePackages: false

# Wait 7 days (10080 minutes) before installing newly published packages.
minimumReleaseAge: 10080
minimumReleaseAgeExclude:
  - '@anthropic-ai/claude-code@2.1.98'
  - '@socketaddon/*'
  - '@socketbin/*'
  - '@socketregistry/*'
  - '@socketsecurity/*'

# Dependency overrides (migrated from package.json pnpm.overrides).
overrides:
  '@octokit/graphql': 'catalog:'
  '@octokit/request-error': 'catalog:'
  '@sigstore/sign': '4.1.0'
  '@socketsecurity/lib': 'catalog:'
  aggregate-error: 'catalog:'
  ansi-regex: 'catalog:'
  brace-expansion: 'catalog:'
  defu: '>=6.1.7'
  emoji-regex: 'catalog:'
  es-define-property: 'catalog:'
  es-set-tostringtag: 'catalog:'
  function-bind: 'catalog:'
  glob: '>=13.0.6'
  globalthis: 'catalog:'
  gopd: 'catalog:'
  graceful-fs: 'catalog:'
  has-property-descriptors: 'catalog:'
  has-proto: 'catalog:'
  has-symbols: 'catalog:'
  has-tostringtag: 'catalog:'
  hasown: 'catalog:'
  https-proxy-agent: 'catalog:'
  indent-string: 'catalog:'
  is-core-module: 'catalog:'
  isarray: 'catalog:'
  lodash: 'catalog:'
  npm-package-arg: 'catalog:'
  packageurl-js: 'catalog:'
  path-parse: 'catalog:'
  postcss: '>=8.5.10'
  qs: '>=6.15.1'
  safe-buffer: 'catalog:'
  safer-buffer: 'catalog:'
  semver: 'catalog:'
  set-function-length: 'catalog:'
  shell-quote: 'catalog:'
  side-channel: 'catalog:'
  signal-exit: '4.1.0'
  string-width: 'catalog:'
  string_decoder: 'catalog:'
  strip-ansi: 'catalog:'
  tiny-colors: 'catalog:'
  typedarray: 'catalog:'
  undici: 'catalog:'
  vite: 'catalog:'
  wrap-ansi: 'catalog:'
  xml2js: 'catalog:'
  yaml: 'catalog:'
  yargs-parser: 'catalog:'

# Auto-install missing peer deps (pnpm default). Declared explicitly
# so a future default flip can't silently change install behavior.
autoInstallPeers: true

# Run pre/post lifecycle scripts on the workspace root (e.g.
# prepare -> husky). This is the pnpm default; declared explicitly
# so a future default flip can't silently disable husky setup.
enablePrePostScripts: true

# Patched dependencies (migrated from package.json pnpm.patchedDependencies).
patchedDependencies:
  '@npmcli/run-script@10.0.4': patches/@npmcli__run-script@10.0.4.patch
  '@sigstore/sign@4.1.0': patches/@sigstore__sign@4.1.0.patch
  execa@2.1.0: patches/execa@2.1.0.patch
  execa@5.1.1: patches/execa@5.1.1.patch
  node-gyp@12.2.0: patches/node-gyp@12.2.0.patch
saveExact: true
strictPeerDependencies: true
trustPolicy: no-downgrade
trustPolicyExclude:
  - undici@6.21.3