pnpm-workspace.yaml

packages:
  - packages/npm/*
  - perf/*
  - registry
  - .claude/hooks/*

# Packages allowed to run build scripts (pnpm v11 strictDepBuilds default).
allowBuilds:
  esbuild: true

# Refuse to run if the pnpm version on PATH differs from the packageManager
# field in package.json. Our setup action pins pnpm via external-tools.json;
# any drift should fail fast, not silently auto-download via @pnpm/exe
# (which in rc.5 leaves a placeholder launcher that errors at runtime).
pmOnFail: error

catalog:
  '@anthropic-ai/claude-code': 2.1.98
  '@babel/core': 7.28.4
  '@babel/generator': 7.28.3
  '@babel/parser': 7.28.4
  '@babel/traverse': 7.28.4
  '@babel/types': 7.28.4
  '@biomejs/biome': 2.2.4
  '@biomejs/js-api': 3.0.0
  '@biomejs/wasm-nodejs': 2.2.4
  '@eslint/compat': 1.3.2
  '@eslint/js': 9.35.0
  '@inquirer/checkbox': 4.2.4
  '@inquirer/core': 10.2.2
  '@inquirer/prompts': 7.8.6
  '@mdn/browser-compat-data': 7.1.5
  '@npmcli/package-json': 7.0.0
  '@npmcli/promise-spawn': 8.0.3
  '@sinclair/typebox': 0.34.49
  '@socketregistry/packageurl-js': 1.4.2
  '@socketregistry/packageurl-js-stable': npm:@socketregistry/packageurl-js@1.4.2
  '@socketsecurity/lib': 5.28.0
  '@socketsecurity/lib-stable': npm:@socketsecurity/lib@5.28.0
  '@socketsecurity/registry': 2.0.2
  '@socketsecurity/sdk': 4.0.1
  '@socketsecurity/sdk-stable': npm:@socketsecurity/sdk@4.0.1
  '@types/fs-extra': 11.0.4
  '@types/mdast': 4.0.4
  '@types/node': 24.9.2
  '@types/normalize-package-data': 2.4.4
  '@types/npm-package-arg': 6.1.4
  '@types/npmcli__package-json': 4.0.4
  '@types/npmcli__promise-spawn': 6.0.3
  '@types/picomatch': 4.0.2
  '@types/semver': 7.7.1
  '@types/spdx-correct': 3.1.3
  '@types/spdx-expression-parse': 3.0.5
  '@types/validate-npm-package-name': 4.0.2
  '@types/which': 3.0.4
  '@typescript/native-preview': 7.0.0-dev.20260415.1
  '@vitest/coverage-v8': 4.0.3
  '@vitest/ui': 4.0.3
  '@yarnpkg/extensions': 2.0.6
  '@zkochan/js-yaml': 0.0.10
  brace-expansion: 2.0.2
  browserslist: 4.26.3
  c8: 10.1.3
  cacache: 20.0.1
  clipboardy: 4.0.0
  debug: ^4.4.3
  del: 8.0.1
  del-cli: 6.0.0
  dev-null-cli: 2.0.0
  didyoumean2: 7.0.4
  ecc-agentshield: 1.4.0
  esbuild: 0.25.11
  eslint: 9.35.0
  eslint-import-resolver-typescript: 4.4.4
  eslint-plugin-import-x: 4.16.1
  eslint-plugin-n: 17.23.1
  eslint-plugin-sort-destructure-keys: 2.0.0
  eslint-plugin-unicorn: 56.0.1
  eta: 3.5.0
  fast-glob: 3.3.3
  fast-sort: 3.4.1
  fs-extra: 11.3.1
  get-east-asian-width: 1.3.0
  globals: 16.4.0
  husky: 9.1.7
  iconv-lite: 0.6.3
  js-yaml: npm:@zkochan/js-yaml@0.0.10
  libnpmpack: 9.0.9
  magic-string: 0.30.17
  make-fetch-happen: 15.0.2
  'mdast-util-from-markdown': 2.0.3
  'micromark': 4.0.2
  minimatch: 9.0.5
  normalize-package-data: 8.0.0
  npm-package-arg: 13.0.0
  out-url: 1.2.2
  'oxfmt': 0.37.0
  'oxlint': 1.52.0
  pacote: 21.0.1
  read-yaml-file: 2.1.0
  semver: 7.7.4
  source-map-support: 0.5.21
  spdx-correct: 3.2.0
  spdx-expression-parse: 4.0.0
  streaming-iterables: 8.0.1
  tar: 7.5.1
  taze: 19.6.0
  trash: 10.0.0
  tsx: 4.20.5
  type-coverage: 2.29.7
  typescript: 5.9.2
  typescript-eslint: 8.44.1
  update-browserslist-db: 1.1.3
  validate-npm-package-name: 6.0.2
  vite: 7.3.2
  vitest: 4.0.3
  which: 5.0.0
  yargs-parser: 22.0.0
  yoctocolors-cjs: 2.1.3

# Resolve to the highest version that satisfies the range, fleet-wide.
resolutionMode: highest

# Wait 7 days (10080 minutes) before installing newly published packages.
minimumReleaseAge: 10080
minimumReleaseAgeExclude:
  - '@anthropic-ai/claude-code@2.1.98'
  - '@socketaddon/*'
  - '@socketbin/*'
  - '@socketregistry/*'
  - '@socketsecurity/*'
  # Network-mocking lib used in fleet test suites. v15 betas pre-date
  # npm's `time` field for the major; allow pinned beta until v15 GA.
  - 'nock@15.0.0-beta.11'

# Refuse transitive dependencies declared via git/tarball/local-tarball
# specs — an npm package shouldn't be allowed to drag in a git URL we
# don't control (bypasses npm registry validation, no provenance, no
# soak window). Direct git deps are still allowed (the test suite at
# pnpm/pkg-manager/core/test/install/blockExoticSubdeps.ts confirms
# this). pnpm's current default is `false`; declared explicitly so a
# future flip can't silently change install behavior.
blockExoticSubdeps: true

# Dependency overrides (migrated from package.json pnpm.overrides).
overrides:
  '@types/node': 'catalog:'
  aggregate-error: 'npm:@socketregistry/aggregate-error@1.0.15'
  array-buffer-byte-length: 'npm:@socketregistry/array-buffer-byte-length@1.0.7'
  available-typed-arrays: 'npm:@socketregistry/available-typed-arrays@1.0.8'
  brace-expansion: 'catalog:'
  es-define-property: 'npm:@socketregistry/es-define-property@1.0.7'
  es-get-iterator: 'npm:@socketregistry/es-get-iterator@1.0.8'
  es-set-tostringtag: 'npm:@socketregistry/es-set-tostringtag@1.0.10'
  for-each: 'npm:@socketregistry/for-each@1.0.8'
  function-bind: 'npm:@socketregistry/function-bind@1.0.7'
  gopd: 'npm:@socketregistry/gopd@1.0.7'
  has-property-descriptors: 'npm:@socketregistry/has-property-descriptors@1.0.7'
  has-symbols: 'npm:@socketregistry/has-symbols@1.0.7'
  has-tostringtag: 'npm:@socketregistry/has-tostringtag@1.0.7'
  hasown: 'npm:@socketregistry/hasown@1.0.7'
  iconv-lite: 'catalog:'
  indent-string: 'npm:@socketregistry/indent-string@1.0.14'
  is-arguments: 'npm:@socketregistry/is-arguments@1.0.10'
  is-array-buffer: 'npm:@socketregistry/is-array-buffer@1.0.10'
  is-core-module: 'npm:@socketregistry/is-core-module@1.0.11'
  is-date-object: 'npm:@socketregistry/is-date-object@1.0.10'
  is-generator-function: 'npm:@socketregistry/is-generator-function@1.0.10'
  is-nan: 'npm:@socketregistry/is-nan@1.0.8'
  is-regex: 'npm:@socketregistry/is-regex@1.0.10'
  is-shared-array-buffer: 'npm:@socketregistry/is-shared-array-buffer@1.0.10'
  is-typed-array: 'npm:@socketregistry/is-typed-array@1.0.12'
  isarray: 'npm:@socketregistry/isarray@1.0.8'
  json-stable-stringify: 'npm:@socketregistry/json-stable-stringify@1.0.13'
  jsonify: 'npm:@socketregistry/jsonify@1.0.7'
  minimatch: 'catalog:'
  object-is: 'npm:@socketregistry/object-is@1.0.8'
  object-keys: 'npm:@socketregistry/object-keys@1.0.8'
  object.assign: 'npm:@socketregistry/object.assign@1.0.8'
  path-parse: 'npm:@socketregistry/path-parse@1.0.8'
  regexp.prototype.flags: 'npm:@socketregistry/regexp.prototype.flags@1.0.8'
  safe-regex-test: 'npm:@socketregistry/safe-regex-test@1.0.8'
  safer-buffer: 'npm:@socketregistry/safer-buffer@1.0.10'
  set-function-length: 'npm:@socketregistry/set-function-length@1.0.10'
  shell-quote: 'npm:shell-quote@1.8.3'
  side-channel: 'npm:@socketregistry/side-channel@1.0.10'
  typescript: 'catalog:'
  vite: 'catalog:'
  which-boxed-primitive: 'npm:@socketregistry/which-boxed-primitive@1.0.9'
  which-collection: 'npm:@socketregistry/which-collection@1.0.8'
  which-typed-array: 'npm:@socketregistry/which-typed-array@1.0.9'

patchedDependencies:
  brace-expansion@2.0.2: patches/brace-expansion@2.0.2.patch
  minimatch@9.0.5: patches/minimatch@9.0.5.patch
trustPolicy: no-downgrade
trustPolicyExclude:
  - 'compromise@14.15.0'


# Auto-install missing peer deps (pnpm default). Declared explicitly
# so a future default flip can't silently change install behavior.
autoInstallPeers: true

# Run pre/post lifecycle scripts on the workspace root (e.g.
# prepare -> husky). This is the pnpm default; declared explicitly
# so a future default flip can't silently disable husky setup.
enablePrePostScripts: true

# Pin exact versions on `pnpm add`. Catalog and overrides should
# also be exact pins (5.24.0, not ^5.24.0).
saveExact: true