-
Notifications
You must be signed in to change notification settings - Fork 1.4k
Expand file tree
/
Copy pathpnpm-workspace.yaml
More file actions
149 lines (133 loc) · 7.31 KB
/
Copy pathpnpm-workspace.yaml
File metadata and controls
149 lines (133 loc) · 7.31 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
packages:
- "packages/*"
- "packages/vite-plugin-cloudflare/playground/*"
- "packages/vite-plugin-cloudflare/playground"
- "fixtures/*"
- "tools"
# We update various dependencies on an infrequent recurring basis.
# This table describes what is updated and how often.
#
# Process | Frequency | Notes
# --------------------|---------------|---------------------------------------
# DevTools update | Every quarter | Update our fork of Chrome DevTools
# Esbuild update | Every quarter | Bump esbuild dependency in workers-sdk
# Node update | Every 2 years | Bump node dependency in workers-sdk
# Quick Editor update | Every quarter | Update VSCode dependency and patches
# ──────────────────────────────────────────────────────────────────────────────
# Settings (migrated from .npmrc in pnpm 10)
# ──────────────────────────────────────────────────────────────────────────────
gitChecks: false
# ──────────────────────────────────────────────────────────────────────────────
# Supply chain security
# See: https://pnpm.io/supply-chain-security
# ──────────────────────────────────────────────────────────────────────────────
# Prevent transitive dependencies from pulling code from git repos or tarball
# URLs. Only direct dependencies may use exotic sources.
blockExoticSubdeps: true
# Require packages to be at least 24 hours old before they can be installed.
# This mitigates supply-chain attacks where a malicious version is published and
# yanked quickly, by ensuring there is a window for detection before adoption.
# Value is in minutes (1440 = 24 hours).
minimumReleaseAge: 1440
# First-party Cloudflare packages are exempt from the cooldown so they can be
# adopted same-day.
minimumReleaseAgeExclude:
# TEMPORARY: vite-plugin-cloudflare + vitest-pool-workers are pinned to the
# published miniflare while the workspace miniflare is mid-migration. Revert
# with the repoint.
- "miniflare"
- "workerd"
# Platform-specific workerd binaries published in lock-step with workerd.
- "@cloudflare/workerd-*"
- "@cloudflare/workers-types"
# The below is to install the rosie-skills package and remove the problematic
# wasm module it brings as soon as possible
# TODO(dario): remove in a few days
- "rosie-skills"
# capnp-es@0.0.15 was released by us on Aug 11, 2026.
- "capnp-es@0.0.15"
# ──────────────────────────────────────────────────────────────────────────────
# Build scripts
# pnpm 10 blocks lifecycle scripts by default. Only the packages listed here
# are allowed to run install/postinstall scripts.
# ──────────────────────────────────────────────────────────────────────────────
allowBuilds:
esbuild: true
workerd: true
# miniflare's direct `sharp` (0.35+) has no install script, but the
# catalog-pinned published @cloudflare/vitest-pool-workers still pulls in
# sharp@0.34.x transitively (via published miniflare), which does. Remove
# once that pin uses a published miniflare built on sharp 0.35+.
sharp: true
playwright-chromium: true
prisma: true
# Explicitly silence warnings for packages whose postinstall scripts are not
# required for correct operation.
"@google/genai": false # preinstall is a no-op
protobufjs: false # version-scheme diagnostic warning only
msw: false # copies mockServiceWorker.js to msw.workerDirectory — unused in this repo
core-js: false # telemetry
core-js-pure: false # telemetry
# ──────────────────────────────────────────────────────────────────────────────
# Dependency resolution (migrated from package.json "pnpm" field in pnpm 10)
# ──────────────────────────────────────────────────────────────────────────────
overrides:
"@types/react-dom@18>@types/react": "^18"
"@types/react-tabs>@types/react": "^18"
"@types/react-transition-group>@types/react": "^18"
"@cloudflare/elements>@types/react": "^18"
"@types/node": "$@types/node"
"@types/node>undici-types": "catalog:default"
peerDependencyRules:
allowedVersions:
react: "18"
react-dom: "18"
"@types/react": "18"
"@types/react-dom": "18"
patchedDependencies:
"@cloudflare/component-listbox@1.10.6": "patches/@cloudflare__component-listbox@1.10.6.patch"
"toucan-js@4.0.0": "patches/toucan-js@4.0.0.patch"
"postal-mime": "patches/postal-mime.patch"
"youch@4.1.0-beta.10": "patches/youch@4.1.0-beta.10.patch"
"@netlify/build-info": "patches/@netlify__build-info.patch"
"buffer-equal-constant-time@1.0.1": "patches/buffer-equal-constant-time@1.0.1.patch"
# ──────────────────────────────────────────────────────────────────────────────
# Catalog
# ──────────────────────────────────────────────────────────────────────────────
catalog:
chalk: "5.3.0"
command-exists: "1.2.9"
dotenv: "16.3.1"
"@hey-api/openapi-ts": "0.94.0"
"@types/node": "22.15.17"
"@vitest/runner": 4.1.0
"@vitest/snapshot": 4.1.0
"@vitest/ui": 4.1.0
typescript: "5.8.3"
undici: "7.29.0"
# Override undici-types from @types/node so that the Cloudflare SDK typings match our installed
# version of Undici
undici-types: "7.29.0"
vitest: "4.1.0"
vite: "8.1.5"
"ws": "8.21.0"
esbuild: "0.28.1"
"@playwright/test": "1.60.0"
playwright-chromium: "1.60.0"
"@cloudflare/workers-types": "^5.20260811.1"
workerd: "1.20260811.1"
jsonc-parser: "3.2.0"
smol-toml: "1.5.2"
msw: 2.12.4
tinyglobby: "0.2.16"
"tree-kill": "1.2.2"
"capnp-es": "0.0.15"
"capnweb": "0.5.0"
zod: "4.4.3"
"ci-info": "4.4.0"
"open": "11.0.0"
"signal-exit": "4.1.0"
# CAUTION: Most usage of @cloudflare/vitest-pool-workers in this monorepo should use workspace:* instead of this catalog version
# However, some packages (pages-shared, workers-shared, etc...) need to be tested using vitest-pool-workers but are themselves
# ultimately included in vitest-pool-workers (through Wrangler), causing a circular dependency.
"@cloudflare/vitest-pool-workers": "0.13.3"