pnpm-workspace.yaml

# Copyright (c) Meta Platforms, Inc. and affiliates.

packages:
  - 'apps/*'
  # Example apps are standalone templates for the community to copy — they are
  # never built in-repo, so they stay out of the workspace and pin their own
  # dependency versions instead of using workspace protocols like catalog:.
  - '!apps/example-*'
  - 'packages/*'
  - 'packages/themes/*'
  - 'internal/*'
  # Canonical vibe-test fixtures are standalone consumer apps. They carry their
  # own exact dependencies and lockfiles and are copied to sandboxes before use.
  - '!internal/vibe-tests/fixtures/**'

# linkWorkspacePackages is the one setting still carried over from the old
# .npmrc: 64 internal deps are declared as bare "*", and pnpm >= 10 defaults
# this to false, which resolves them from the registry instead of local source.
# Hoisting is deliberately not configured — every package declares what it
# imports, so the default isolated linker resolves it.
linkWorkspacePackages: true

minimumReleaseAge: 10080
minimumReleaseAgeExclude:
  - '@astryxdesign/*'
  - 'dompurify'

# Single source of truth for the workspace's vite version: every consumer
# (root test config, packages/build) declares "vite": "catalog:", so a bump
# lands here once and cannot split the workspace across two vite majors.
# vite 8 requires @vitejs/plugin-react >= 5 (4.x peers stop at vite 7) —
# bump them together. The standalone example apps and the vibe-tests
# preview app pin their own vite; keep them on the same major by hand.
#
# StyleX, prettier, esbuild, the Babel build toolchain, and Testing Library
# are workspace-wide tool pins (formerly pnpm overrides) — every consumer
# declares them as "catalog:" so a bump lands here once. The Babel and
# Testing Library entries are each duplicated across 4-6 packages that must
# stay in lockstep: the four component packages compile with the same
# babel + presets, and the same test suite runs across all of them. Peer
# ranges in packages/* stay loose on purpose; those are consumer contracts,
# not workspace pins.
catalog:
  vite: ^8.1.3
  '@stylexjs/stylex': ^0.19.0
  '@stylexjs/babel-plugin': ^0.19.0
  '@stylexjs/postcss-plugin': ^0.19.0
  # Keep all four on the same Babel major. Dependabot raised cli (#4067) and
  # preset-react (#3839) to 8.x on their own while core and preset-typescript
  # stayed on 7.x, and 8.x peers on `@babel/core: ^8.0.0` — a combination no
  # single core version satisfies. Moving to Babel 8 is a migration of its own.
  '@babel/cli': ^7.29.7
  '@babel/core': ^7.29.7
  '@babel/preset-react': ^7.29.7
  '@babel/preset-typescript': ^7.29.7
  '@testing-library/react': ^16.3.2
  '@testing-library/jest-dom': ^6.6.0
  prettier: ^3.9.3
  esbuild: ^0.28.1

# Moved from package.json's "pnpm" field: pnpm 11 no longer reads
# pnpm.overrides / pnpm.onlyBuiltDependencies from package.json.

# Compatibility pins and security floors that must not float independently.
overrides:
  # Receipt JavaScript bytes mirror shadcn 4.19.0's transform. Keep its floating
  # parser/printer aligned with the exact runtime pins in packages/cli.
  'shadcn@4.19.0>@babel/core': 7.29.7
  'shadcn@4.19.0>@babel/parser': 7.29.8
  'shadcn@4.19.0>@babel/plugin-transform-typescript': 7.29.7
  'shadcn@4.19.0>recast': 0.23.21

  # Every entry below is a LIVE security floor, annotated with the dependent that
  # pins the vulnerable version and the condition for deleting it. To re-verify
  # one: drop the line, run `pnpm install --lockfile-only`, then `pnpm audit`.
  # Entries the graph now reaches on its own get pruned — no alignment or dedup
  # forces.
  # next@15 pins postcss 8.4.31. Drop when Next raises its postcss dep.
  postcss: ^8.5.23
  # monaco-editor@0.55 pins dompurify 3.2.7. Drop when it catches up.
  dompurify: ^3.4.13
  # tsup@8.5 resolves esbuild 0.27.7. Drop when tsup raises its range.
  esbuild: '>=0.28.1'
  # read-yaml-file 1.x is stuck on js-yaml 3.x (`safeLoad`, no CVE-2026-53550
  # fix), so lift the package: 2.x calls `load` and keeps the same CJS surface.
  # Floored at 4.x, not the 5.x line — 5.x had its own DoS (GHSA-pm4m-ph32-ghv5,
  # GHSA-724g-mxrg-4qvm) patched only in 5.2.2, and every other js-yaml
  # consumer in the graph already resolves inside ^4 on its own.
  read-yaml-file: ^2.1.0
  read-yaml-file>js-yaml: ^4.3.1
  # next's optional sharp stays on 0.34.5, inheriting four libvips advisories
  # patched only in 0.35 — out of reach of its own ^0.34 range. Drop when next
  # depends on 0.35 itself.
  sharp: ^0.35.3

# pnpm 11 replaced the onlyBuiltDependencies allowlist with an allowBuilds map
# (managed via `pnpm approve-builds`). These are the same packages previously
# trusted to run install/build scripts under pnpm 10's onlyBuiltDependencies.
allowBuilds:
  '@parcel/watcher': true
  '@swc/core': true
  core-js: true
  esbuild: true
  puppeteer: true
  sharp: true