refarm/pnpm-workspace.yaml at main · aretw0/refarm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
catalog:
  # build tooling
  typescript: "^6.0.3"
  # formatter (oxc ecosystem — Prettier-compatible, arrived with Astro 7's Rolldown-Vite)
  oxfmt: "^0.58.0"
  # wasm runtime
  "@bytecodealliance/jco": "^1.18.0"
  # crypto / identity primitives
  "@noble/ed25519": "^3.1.0"
  nostr-tools: "^2.23.3"
  # sync / storage
  isomorphic-git: "^1.37.5"
  # websocket
  ws: "^8.21.0"
  "@types/ws": "^8.18.1"
  # optional: a light browser driver for a LIVE web-source pull (uses the user's own Chrome,
  # downloads nothing). Only a `--live` run loads it; offline/CI never do.
  puppeteer-core: "^24.10.0"
  # node types
  "@types/node": "^25.6.0"

shamefullyHoist: false
strictPeerDependencies: false
linkWorkspacePackages: true

# GHSA-mp2f-45pm-3cg9 (decompress <=4.2.1, CVE-2026-53486) has NO patched version and
# reaches us only through the build-time WASM toolchain (@bytecodealliance/jco >
# componentize-js > weval > decompress, a devDependency). It never touches shipped runtime
# code or untrusted archives. Re-evaluate when jco/weval drop the decompress transitive.
#
# GHSA-mh99-v99m-4gvg (brace-expansion <=5.0.7, DoS via unbounded expansion) is patched only in
# brace-expansion 5.0.8, which is ESM-only (named `expand`, no default export) and breaks
# style-dictionary's `import expand from "brace-expansion"` — the packages/ds design-token build
# (verified: forcing 5.x fails ds/platforms.test.ts). All 116 paths are dev tooling (glob >
# minimatch > brace-expansion via test-exclude/istanbul/style-dictionary); the DoS needs a crafted
# brace pattern, and dev-time globbing only ever sees the developer's own patterns. Net: forcing the
# fix regresses the build for a negligible dev-only risk, so accept it. Re-evaluate when the
# consumers move to a brace-expansion 5.x that keeps a default export (or drop the transitive).
auditConfig:
  ignoreGhsas:
    - GHSA-mp2f-45pm-3cg9
    - GHSA-mh99-v99m-4gvg

packages:
  - "packages/*"
  - "apps/*"
  - "validations/*"
  - "validations/*/host"
  - "validations/*/browser"
  - "validations/*/hello-world"
  - "templates/*"
  # Per-work POC apps (T1/T2/T3): each its own white-label CLI, extending refarm for
  # ONE persona, independent so a work's registros are generated without touching the
  # others.
  - "examples/devbench-t1"
  - "examples/wallet-t2"
  - "examples/reqbench-t3"
# `allowBuilds` (pnpm 11) is a map of package matchers to `true` (approve build scripts) / `false`
# (disallow). It replaces v10's onlyBuiltDependencies/ignoredBuiltDependencies. Under the pinned pnpm 11
# (strictDepBuilds defaults true), a dependency with build scripts that is NOT listed here is "unreviewed"
# and the frozen/CI install HARD-ERRORS (ERR_PNPM_IGNORED_BUILDS). style-dictionary + its bundled glob
# (dev-only token tooling) are approved so the deterministic CI install stays green.
allowBuilds:
  "@bundled-es-modules/glob": true
  "@loro-crdt/base": true
  "@playwright/test": true
  better-sqlite3: true
  esbuild: true
  playwright: true
  puppeteer: true
  sharp: true
  style-dictionary: true
  unrs-resolver: true
  workerd: true
overrides:
  "@babel/core": 7.29.6
  "@zenuml/core": 3.50.1
  dompurify: 3.4.11
  esbuild: 0.28.1
  # Security bumps. NOTE two audit SCOPES in CI: Release Health/Security Audit run `pnpm audit
  # --prod` (prod deps); Test & Quality runs `pnpm audit --audit-level=high` WITHOUT --prod (dev deps
  # too). brace-expansion is a dev-dep DoS. The two within-major patches below are safe. The 3.x/4.x
  # and <=5.0.7 advisories are patched ONLY by brace-expansion 5.x, which is ESM-only (named `expand`,
  # NO default export) and breaks style-dictionary's `import expand from "brace-expansion"` (the
  # packages/ds design-token build — verified: forcing 5.x fails ds/platforms.test.ts). Forcing 5.x is
  # a net regression, so those ranges are ACCEPTED instead — see `auditConfig.ignoreGhsas` above
  # (GHSA-mh99-v99m-4gvg). js-yaml keeps a blanket pin (4.2.0 → 4.3.0, off the vulnerable line).
  # astro is intentionally EXCLUDED: its patch (>=7.0.10 = 7.1.x) breaks the apps' build (issue #56).
  brace-expansion@<1.1.16: ^1.1.16
  brace-expansion@>=2.0.0 <2.1.2: ^2.1.2
  fast-uri@>=3.0.0 <=3.1.3: ^3.1.4
  js-yaml: 4.3.0
  postcss@<=8.5.17: ^8.5.18
  sharp@<0.35.0: ^0.35.0
  svgo@>=4.0.0 <4.0.2: ^4.0.2
  undici: 7.28.0
  ws: 8.21.0
  yaml: 2.9.0