-
Notifications
You must be signed in to change notification settings - Fork 20
Expand file tree
/
Copy pathpnpm-workspace.yaml
More file actions
379 lines (367 loc) · 16.5 KB
/
Copy pathpnpm-workspace.yaml
File metadata and controls
379 lines (367 loc) · 16.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
loglevel: error
trustPolicy: no-downgrade
trustPolicyExclude:
- 'compromise@14.15.0'
- 'undici@5.29.0'
# Register .claude/hooks/* as workspace packages so taze (run via
# `pnpm run update`) sees and bumps their package.json manifests
# alongside the root. Keeps hook deps in lockstep with the main tree.
packages:
- '.config/fleet/oxlint-plugin'
- '.config/fleet/oxlint-plugin/fleet/*'
- '.claude/hooks/fleet/*'
allowBuilds:
'@anthropic-ai/claude-code': true
# sdk's preinstall is repo-dev bootstrap; the published tarball doesn't
# ship it, so the self-referential dep never needs build scripts.
'@socketsecurity/sdk': false
# @swc/core native binding — vitiate's coverage-guided fuzz lane
# (scripts/repo/fuzz.mts) SWC-instruments src for coverage feedback.
'@swc/core': true
cpu-features: false
protobufjs: false
puppeteer: false
rolldown: true
ssh2: false
# Auto-install missing peer deps (pnpm default). Declared explicitly
# so a future default flip can't silently change install behavior.
autoInstallPeers: true
# Pin pnpm's default of running root pre/post lifecycle scripts.
enablePrePostScripts: true
# Force every consumer of Socket's own packages to resolve through the
# catalog-pinned published versions. The `catalog:` form rewrites
# `workspace:*`, `^x.y.z`, and bare-version specs alike to the version
# in the default `catalog:` block above. This defeats accidental
# local-checkout resolution when a sibling repo is on disk.
overrides:
# Fleet-canonical overrides (managed by socket-wheelhouse sync; do not edit).
'@sinclair/typebox': 'catalog:'
'@socketregistry/packageurl-js': 'catalog:'
'@socketsecurity/lib': 'catalog:'
'@socketsecurity/registry': 'catalog:'
'@socketsecurity/sdk': 'catalog:'
'brace-expansion@>=4': '5.0.9'
'chalk@>=5': '5.6.2'
'es-define-property': 'npm:@socketregistry/es-define-property@1.0.7'
'es-set-tostringtag': 'npm:@socketregistry/es-set-tostringtag@1.0.10'
'function-bind': 'npm:@socketregistry/function-bind@1.0.7'
'glob': '13.0.6'
'gopd': 'npm:@socketregistry/gopd@1.0.7'
'has-symbols': 'npm:@socketregistry/has-symbols@1.0.7'
'has-tostringtag': 'npm:@socketregistry/has-tostringtag@1.0.7'
'hasown': 'npm:@socketregistry/hasown@1.0.7'
'iconv-lite': '0.7.3'
'isexe@>=3': '4.0.0'
'js-yaml@>=5.0.0 <5.2.2': '5.2.2'
'lru-cache@>=10': '11.5.2'
'magic-string': '1.1.0'
'mime-db': '1.54.0'
'mime-types@>=3': '3.0.2'
'minimatch@>=3': '10.2.6'
'minipass@>=4': '7.1.3'
'postcss@>=8': '8.5.24'
'safe-buffer': 'npm:@socketregistry/safe-buffer@1.0.9'
'safer-buffer': 'npm:@socketregistry/safer-buffer@1.0.10'
'semver@>=5.0.0 <7.6.0': '7.8.5'
'side-channel': 'npm:@socketregistry/side-channel@1.0.10'
'ssri@>=12': '13.0.1'
'string-width@>=5': '8.2.2'
'tinyexec': '1.3.0'
'typebox': 'catalog:'
'undici@<6': '6.28.0'
'update-notifier@>=4.0.0': '7.3.1'
'uuid': '11.1.1'
'which': '7.0.0'
'wrap-ansi@>=8': '9.0.2'
'yaml@2': '2.9.0'
# Repo-specific overrides below.
'defu': '>=6.1.7'
'js-yaml': '4.3.0'
'protobufjs': '7.6.5'
# advisories #51 / #54 (medium) — bump to latest 6.x patch
'undici': '6.28.0'
'vite': 'catalog:'
'which@>=4': '7.0.0'
# Refuse to run if the pnpm version on PATH differs from the packageManager
# field in package.json. Our setup action pins pnpm via external-tools.json;
# any drift should fail fast, not silently auto-download via @pnpm/exe
# (which in rc.5 leaves a placeholder launcher that errors at runtime).
pmOnFail: warn
catalog:
'@anthropic-ai/claude-code': 2.1.220
'@redwoodjs/agent-ci': 0.17.1
'@shadscan/cli': 0.7.0
'@sinclair/typebox': 0.34.52
'@socketregistry/packageurl-js': 1.5.2
'@types/semver': 7.7.1
'@types/shell-quote': 1.7.5
'@ultrathink/acorn.rs.wasm': 0.1.1
# -stable aliases: pnpm `overrides:` can't redirect a package's own
# name from inside the same package — Node ESM resolves it as a
# self-reference. Build / hook / script / config code uses the
# -stable name. See socket-wheelhouse@92cd3e3 for full rationale.
'@socketregistry/packageurl-js-stable': 'npm:@socketregistry/packageurl-js@1.5.2'
'@socketsecurity/lib': 6.6.0
'@socketsecurity/lib-stable': 'npm:@socketsecurity/lib@6.6.0'
'@socketsecurity/registry': 2.0.5
'@socketsecurity/registry-stable': 'npm:@socketsecurity/registry@2.0.5'
'@socketsecurity/sdk': 4.1.4
'@socketsecurity/sdk-stable': 'npm:@socketsecurity/sdk@4.1.4'
'@types/mdast': 4.0.4
'@types/node': 26.1.2
'@typescript/native-preview': 7.0.0-dev.20260510.1
'@vitiate/core': 0.3.1
'@vitest/coverage-v8': 4.1.10
'@vitest/ui': 4.1.10
'brace-expansion': 5.0.9
'c8': 12.0.0
'chrome-devtools-mcp': 1.6.0
'compromise': 14.16.0
'dtu-github-actions': 0.17.1
'ecc-agentshield': 1.4.0
'fast-check': 4.9.0
'markdownlint-cli2': 0.23.2
'mdast-util-from-markdown': 2.0.3
'micromark': 4.0.2
'minimatch': 10.2.6
'neosanitize': 0.3.0
# Pinned back 15.0.0 -> 14.0.16 on 2026-07-27: 15.0.0 ships
# @mswjs/interceptors 0.39.8, whose fetch bypass path throws
# TypeError: unusable on any fetch POST-with-body to an
# enableNetConnect-allowed host. Mirrors the fleet canonical pin; bump
# to the stabilized 15.x when it ships.
'nock': 14.0.16
'npm-high-impact': 1.13.0
'npm-run-all2': 9.0.3
'oxfmt': 0.62.0
'oxlint': 1.77.0
# oxlint-tsgolint — the type-aware lint sidecar the fleet lint runner's
# whole-tree gate invokes via `oxlint --type-aware`. Exact-pinned to match
# the wheelhouse catalog; the per-platform binaries are soak-excluded
# transitives (consumers depend on `oxlint-tsgolint` only).
'oxlint-tsgolint': 7.0.2001
# Fleet bundler (replaces esbuild). Single-sourced to match the
# wheelhouse catalog pin + the rolldown vite 8.0.14 bundles natively.
'playwright-core': 1.62.0
'portless': 0.15.4
'regjsparser': 0.13.2
'rolldown': 1.2.3
'semver': 7.8.5
'shell-quote': 1.10.0
'svgo': 4.0.2
'taze': 19.17.1
# vite 8.0.14 swaps esbuild → rolldown natively (bundles rolldown
# 1.0.2), so the override below removes esbuild from the install tree.
'typebox': 1.3.10
'typescript': 7.0.2
'vite': 8.1.5
'vitiate': 0.3.1
'vitest': 4.1.10
# Wait 7 days (10080 minutes) before installing newly published packages.
minimumReleaseAge: 10080
minimumReleaseAgeExclude:
# typescript 7.0.2 — first stable of the native 7.x compiler line, pulled
# ahead of the soak by owner directive (out of RC). The main package + its
# 20-package per-platform binding family are pinned to the exact version
# (a scope glob would blanket-bypass any future @typescript publish).
- '@socketregistry/*'
- '@socketsecurity/*'
# compromise@14.15.1 is the attested re-publish that clears the
# trust-downgrade flag on 14.15.0. The catalog bump cascaded from the
# wheelhouse without its matching soak-exclude, leaving frozen installs
# broken; scoped to the exact tag so a future 14.15.2 still soaks.
# rolldown 1.0.2 is vite 8.0.14's bundled native rolldown release; the
# per-platform bindings share its pin. `@rolldown/pluginutils` versions
# independently — rolldown 1.0.2 depends on `^1.0.0` → resolves to 1.0.1.
# Listed explicitly per the fleet "no scope globs in soak excludes" rule.
- '@rolldown/pluginutils'
- 'sfw'
- '@stuie/*'
- '@ultrathink/*'
- '@socketoverride/*'
- 'socket'
- '@sdxgen/*'
- 'sdxgen'
# oxlint-tsgolint 7.0.2001 — the type-aware lint sidecar the fleet lint
# runner's whole-tree gate needs. The main package + its per-platform binary
# family are pinned to the exact version (a scope glob would blanket-bypass a
# future publish); exact-pinned so a future version re-soaks.
# taze 19.16.0 — the dep updater itself; forced ahead of the soak by owner
# directive so the regenerated single-registry patch (patchedDependencies)
# tracks the current release. Exact-pinned so a future version re-soaks.
# verkit — new dev-only transitive of taze 19.16.0 (same owner directive);
# exact-pinned so future versions re-soak.
# published: 2026-08-05 | removable: 2026-08-12
- '@socketsecurity/lib@6.6.0'
# published: 2026-07-30 | removable: 2026-08-06
- 'brace-expansion@5.0.9'
# published: 2026-08-03 | removable: 2026-08-10
- 'taze@19.17.1'
# tinyexec — the cascade advanced the OVERRIDE to 1.3.0 but propagates
# catalog/catalogOptional/overrides only, never this exclude list, so the
# pair split and every install refused. Exact-pinned so a future version
# re-soaks.
# published: 2026-08-01 | removable: 2026-08-08
- 'tinyexec@1.3.0'
# published: 2026-08-05 | removable: 2026-08-12
- '@socketregistry/packageurl-js@1.5.2'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxc-project/types@0.143.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-android-arm-eabi@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-android-arm64@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-darwin-arm64@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-darwin-x64@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-freebsd-x64@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-linux-arm-gnueabihf@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-linux-arm-musleabihf@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-linux-arm64-gnu@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-linux-arm64-musl@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-linux-ppc64-gnu@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-linux-riscv64-gnu@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-linux-riscv64-musl@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-linux-s390x-gnu@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-linux-x64-gnu@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-linux-x64-musl@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-openharmony-arm64@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-win32-arm64-msvc@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-win32-ia32-msvc@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxfmt/binding-win32-x64-msvc@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-android-arm-eabi@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-android-arm64@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-darwin-arm64@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-darwin-x64@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-freebsd-x64@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-linux-arm-gnueabihf@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-linux-arm-musleabihf@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-linux-arm64-gnu@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-linux-arm64-musl@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-linux-ppc64-gnu@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-linux-riscv64-gnu@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-linux-riscv64-musl@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-linux-s390x-gnu@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-linux-x64-gnu@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-linux-x64-musl@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-openharmony-arm64@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-win32-arm64-msvc@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-win32-ia32-msvc@1.77.0'
# published: 2026-08-03 | removable: 2026-08-10
- '@oxlint/binding-win32-x64-msvc@1.77.0'
# published: 2026-08-05 | removable: 2026-08-12
- '@rolldown/binding-android-arm64@1.2.3'
# published: 2026-08-05 | removable: 2026-08-12
- '@rolldown/binding-darwin-arm64@1.2.3'
# published: 2026-08-05 | removable: 2026-08-12
- '@rolldown/binding-darwin-x64@1.2.3'
# published: 2026-08-05 | removable: 2026-08-12
- '@rolldown/binding-freebsd-x64@1.2.3'
# published: 2026-08-05 | removable: 2026-08-12
- '@rolldown/binding-linux-arm-gnueabihf@1.2.3'
# published: 2026-08-05 | removable: 2026-08-12
- '@rolldown/binding-linux-arm64-gnu@1.2.3'
# published: 2026-08-05 | removable: 2026-08-12
- '@rolldown/binding-linux-arm64-musl@1.2.3'
# published: 2026-08-05 | removable: 2026-08-12
- '@rolldown/binding-linux-ppc64-gnu@1.2.3'
# published: 2026-08-05 | removable: 2026-08-12
- '@rolldown/binding-linux-s390x-gnu@1.2.3'
# published: 2026-08-05 | removable: 2026-08-12
- '@rolldown/binding-linux-x64-gnu@1.2.3'
# published: 2026-08-05 | removable: 2026-08-12
- '@rolldown/binding-linux-x64-musl@1.2.3'
# published: 2026-08-05 | removable: 2026-08-12
- '@rolldown/binding-openharmony-arm64@1.2.3'
# published: 2026-08-05 | removable: 2026-08-12
- '@rolldown/binding-win32-arm64-msvc@1.2.3'
# published: 2026-08-05 | removable: 2026-08-12
- '@rolldown/binding-win32-x64-msvc@1.2.3'
# published: 2026-08-03 | removable: 2026-08-10
- 'oxfmt@0.62.0'
# published: 2026-08-03 | removable: 2026-08-10
- 'oxlint@1.77.0'
# published: 2026-08-05 | removable: 2026-08-12
- 'rolldown@1.2.3'
# published: 2026-08-02 | removable: 2026-08-09
- 'typebox@1.3.10'
patchedDependencies:
# default-export interop (managed by socket-wheelhouse sync; do not edit):
# 5.0.7 dropped the default export from BOTH builds. The CJS half breaks
# minimatch@9's compiled `__importDefault`, which reads `.default` and
# skips the namespace fallback once `__esModule` is set. The ESM half
# breaks any `import x from 'brace-expansion'`, the shape the fleet CI
# cache action resolves through, so an unpatched member throws "does not
# provide an export named default" and dies at setup before a test runs.
# The patch restores `expand` as the default on each build separately;
# patching one build leaves the other broken.
# On a bump, regenerate via `pnpm patch brace-expansion` + `pnpm patch-commit`.
brace-expansion@5.0.9: patches/brace-expansion@5.0.9.patch
# default-export interop (managed by socket-wheelhouse sync; do not edit):
# v10's ESM build ships named exports only, so `import minimatch from
# 'minimatch'` throws "does not provide an export named default". That is
# the shape `@actions/cache` resolves through, so an unpatched member dies
# in the CI cache step at setup, before a single check runs. The patch adds
# the default to BOTH builds; patching one leaves the other broken.
# It also makes the `minimatch@>=3` hoist safe: a v3 consumer
# (`@actions/glob@0.6.1` pulls 3.1.5) default-imports a callable, and the
# patched v10 answers that same shape.
# On a bump, regenerate via `pnpm patch minimatch` + `pnpm patch-commit`.
minimatch@10.2.6: patches/minimatch@10.2.6.patch
# single-registry (managed by socket-wheelhouse sync; do not edit):
# routes taze version resolution through its own bundled direct-registry
# client (getVersionsFromRegistry — full packument, .npmrc/auth-aware) for
# EVERY registry, instead of the fast-npm-meta hosted endpoint it uses
# when the registry is the npm default. That third-party hop leaks
# dependency names, violates the fleet single-registry posture, and is
# blocked by egress policy — every lookup then hits the request timeout
# while taze still exits 0 (false green; update.mts fails loud on it).
# On a taze bump, regenerate via `pnpm patch taze` + `pnpm patch-commit`.
taze@19.17.1: patches/taze@19.17.1.patch
# Refuse transitive dependencies declared via git/tarball/local-tarball
# specs — an npm package shouldn't be allowed to drag in a git URL we
# don't control (bypasses npm registry validation, no provenance, no
# soak window). Direct git deps are still allowed (the test suite at
# pnpm/pkg-manager/core/test/install/blockExoticSubdeps.ts confirms
# this). pnpm's current default is `false`; declared explicitly so a
# future flip can't silently change install behavior.
blockExoticSubdeps: true
confirmModulesPurge: false
managePackageManagerVersions: false
# Pin exact versions on `pnpm add`. Catalog and overrides should
# also be exact pins (5.24.0, not ^5.24.0).
saveExact: true