-
Notifications
You must be signed in to change notification settings - Fork 713
Expand file tree
/
Copy pathpnpm-workspace.yaml
More file actions
66 lines (60 loc) · 2.9 KB
/
Copy pathpnpm-workspace.yaml
File metadata and controls
66 lines (60 loc) · 2.9 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
packages:
- 'packages/core/*'
- 'packages/shared/*'
- 'packages/core/auth-js/example/react'
- 'packages/core/realtime-js/example'
# Shared tooling versions referenced as `catalog:` in per-package devDependencies.
# Keep aligned with the root devDependencies entries.
catalog:
typescript: ~5.8.3
typedoc: ^0.27.9
tsdown: ^0.18.0
jest: 30.4.2
ts-jest: ^29.4.9
'@jest/globals': ^30.0.0
'@jest/types': ^30.0.0
'@types/jest': 30.0.0
'@types/node': 20.19.9
vitest: 4.1.6
tsd: ^0.33.0
'@arethetypeswrong/cli': ^0.18.2
prettier: ^3.6.2
# Dependency version overrides applied across the whole workspace.
overrides:
# 0.2.38 was published without dist/ (import fails); 0.2.39 republished the
# working 0.2.37. See https://github.com/Gugustinette/unrun/issues/20.
unrun: '>=0.2.39 <0.3.0'
# Avoid the libvips advisory (GHSA-f88m-g3jw-g9cj) in sharp <0.35.0
sharp: '>=0.35.0'
# Avoid the sourceMappingURL advisories in postcss: file-read
# (GHSA-6g55-p6wh-862q, fixed in 8.5.12) and the follow-up path traversal
# (GHSA-r28c-9q8g-f849, fixed in 8.5.18); next pins the old 8.4.31
# transitively in the realtime example.
postcss: '>=8.5.18'
# Avoid the sourceMappingURL file-read advisory (GHSA-4x5r-pxfx-6jf8) in
# @babel/core <=7.29.0; reached via next>styled-jsx in the realtime example.
# (No 7.29.1 was ever published; 7.29.7 is the first fixed 7.x release.)
'@babel/core': '>=7.29.1 <8'
# Resolver / layout
preferWorkspacePackages: true # prefer the in-tree version over the registry when both satisfy
minimumReleaseAge: 10080 # 7 days
minimumReleaseAgeExclude:
- '@supabase/*'
- supabase # first-party Supabase CLI
blockExoticSubdeps: true
# Whitelist of packages allowed to run install scripts (preinstall/install/postinstall).
# Default-deny: only flip to `true` after auditing the publisher AND confirming the
# postinstall is load-bearing (no JS/WASM fallback, no separate CLI install step).
allowBuilds:
# Required — these do not function without their postinstall:
'@swc/core': true # nx + scripts load TS configs via @swc-node/register
esbuild: true # vite/vitest depend on the esbuild native binary
nx: true # platform-specific Nx daemon binding
supabase: true # downloads the supabase CLI binary used by auth/storage/postgrest tests
# Not allowed — has a working fallback or is installed explicitly elsewhere:
cpu-features: false # ssh2 falls back to pure-JS impl; testcontainers still works
puppeteer: false # CI runs `pnpm exec puppeteer browsers install chrome` after install;
# locally, run the same one-liner before `pnpm nx test:integration:browser supabase-js`
sharp: false # only pulled by next 16 in the realtime example; next falls back to its built-in resizer
ssh2: false # transitive via testcontainers; native bindings are an optional perf optimization
unrs-resolver: false # eslint-import-resolver-typescript + jest-resolve both have WASM/JS fallback