javascript/pnpm-workspace.yaml at main · benperkins/javascript · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
packages:
  - packages/*
  - packages/electron-passkeys/npm/*

catalogs:
  peer-expo:
    expo: '>=54 <59'
  peer-react:
    react: ^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0
    react-dom: ^18.0.0 || ~19.0.3 || ~19.1.4 || ~19.2.3 || ~19.3.0-0
  react:
    '@types/react': 18.3.28
    '@types/react-dom': 18.3.7
    react: 18.3.1
    react-dom: 18.3.1
  repo:
    '@floating-ui/react': 0.27.20
    '@swc/helpers': 0.5.21
    '@tanstack/query-core': ^5.101.4
    core-js: 3.47.0
    rolldown: 1.1.0
    tsdown: 0.22.2
    tslib: 2.8.1
    tsup: 8.5.1
    typescript: 6.0.3
    vue: 3.5.33
    zx: 8.8.5
  rspack:
    '@rspack/cli': 2.0.6
    '@rspack/core': 2.0.6
    '@rspack/dev-server': 2.0.3
    '@rspack/plugin-react-refresh': 2.0.1
  module-manager:
    '@base-org/account': 2.0.1
    '@coinbase/wallet-sdk': 4.3.7
    '@solana/wallet-adapter-base': 0.9.27
    '@solana/wallet-adapter-react': 0.15.39
    '@solana/wallet-standard': 1.1.4
    '@wallet-standard/core': 1.1.1
    '@zxcvbn-ts/core': 3.0.4
    '@zxcvbn-ts/language-common': 3.0.4

overrides:
  '@astrojs/compiler': 2.13.0
  '@babel/plugin-transform-modules-systemjs@<=7.29.3': 7.29.8
  'axios@<0.33.0': 0.33.0
  'chokidar@<5.0.0': 5.0.0
  'fast-uri@<3.1.6': 3.1.6
  'flatted@<=3.4.1': 3.4.2
  'follow-redirects@<=1.15.11': 1.16.0
  'ip-address@<10.3.1': 10.3.1
  'jws@<3.2.3': 3.2.3
  'minimatch@>=9.0.0 <9.0.7': 9.0.7
  'picomatch@>=3.0.0 <3.0.2': 3.0.2
  'picomatch@<2.3.2': 2.3.2
  'preact@>=10.27.0 <10.27.3': 10.27.3
  react: 'catalog:react'
  react-dom: 'catalog:react'
  rolldown: 'catalog:repo'
  'semver@<7.7.3': 7.7.4
  'smol-toml@<1.6.1': 1.6.1
  'socket.io-parser@>=4.0.0 <4.2.7': 4.2.7
  'svgo@>=3.0.0 <3.3.3': 4.0.2
  'tar@<7.5.21': 7.5.21
  'tmp@<0.2.7': 0.2.7
  'undici-types@<7.16.0': 7.24.8
  utf-8-validate: 5.0.10

minimumReleaseAge: 2880
minimumReleaseAgeExclude:
  - '@clerk/*'
  - 'pkglab'
  - 'pkglab-*'

trustPolicy: no-downgrade
trustPolicyExclude:
  # Their 4.x package was published with provenance and this
  # triggers the policy because it's based on publish date and
  # not semver.
  - 'eslint-import-resolver-typescript@3.10.1'
  # Same idea, their 7.1.x publish process is more "trustworthy"
  - 'vite@6.4.1'
  # Same idea, their 1.x publish process is more "trustworthy"
  - 'axios@0.30.2'
  # Same idea, their 7.x publish process is more "trustworthy"
  - 'semver@5.7.2 || 6.3.1'
  # Same idea, their 7.x publish process is more "trustworthy"
  - 'undici@5.29.0 || 6.22.0'
  # Same idea, their 2.x publish process is more "trustworthy"
  - 'ua-parser-js@1.0.41'
  # Same idea, the newer publish has weaker trust metadata than an older release.
  - 'tinyclip@0.1.13'
  # Same idea, their 10.x publish process is more "trustworthy"
  - '@octokit/endpoint@9.0.6'
  # They experimented with provenance for some earlier versions
  # and then disabled it before re-enabling it again later.
  - 'undici-types@6.21.0'
  # Same here
  - 'chokidar@4.0.3'

blockExoticSubdeps: true