pnpm-workspace.yaml

packages:
  - .meta-updater
  - pnpm11/__typecheck__
  - pnpm11/__typings__
  - pnpm11/__utils__/*
  - '!pnpm11/__utils__/build-artifacts'
  - pnpm11/auth/*
  - pnpm11/building/*
  - pnpm11/cache/*
  - pnpm11/catalogs/*
  - pnpm11/cli/*
  - pnpm11/config/*
  - pnpm11/crypto/*
  - pnpm11/installing/dedupe/*
  - pnpm11/deps/*
  - pnpm11/deps/compliance/*
  - pnpm11/deps/inspection/*
  - pnpm11/deps/security/*
  - pnpm11/engine/*
  - pnpm11/engine/pm/*
  - pnpm11/engine/runtime/*
  - pnpm11/exec/*
  - pnpm11/fetching/*
  - pnpm11/fs/*
  - pnpm11/global/*
  - pnpm11/hooks/*
  - pnpm11/lockfile/*
  - pnpm11/network/*
  - pnpm11/modules-mounter/*
  - pnpm11/object/*
  - pnpm11/core/*
  - pnpm11/bins/*
  - pnpm11/installing/*
  - pnpm11/installing/linking/*
  - pnpm11/pkg-manifest/*
  - pnpm11/patching/*
  - pnpm11/pnpm
  - pnpm11/pnpm/dev
  - pnpm11/testing/*
  - pnpm11/worker
  - pnpm11/pnpm/artifacts/*
  - pnpr/client
  - pnpm11/registry-access/*
  - pnpm11/releasing/*
  - pnpm11/resolving/*
  - pnpm11/resolving/registry/*
  - pnpm11/shell/*
  - pnpm11/store/*
  - pnpm11/text/*
  - pnpm11/workspace/*
  - pnpm11/yaml/*
  - pnpm/npm/napi
  - pnpm/npm/pnpm
  - pnpm/tasks/registry-mock
  - pnpr/npm/pnpr
  - '!**/example/**'
  - '!**/test/**'
  - '!pnpm11/resolving/local-resolver/example-package/**'

# Native workspace release management (consumed by `pnpm change` / `pnpm version -r`).
# The Rust CLI wrapper is the workspace package `pacquet` (published to npm as
# `pnpm`); generate-packages.mjs rewrites the name at pack time.
versioning:
  # @pnpm/logger is a workspace package, but every consumer depends on the
  # published one through the `^1100.0.0` catalog entry (a `catalog:` peer, kept
  # deliberately so Jest loads the published CJS-bole logger — see the `bole`
  # note in the catalog). The release engine would otherwise reject those
  # catalog: peers as internal ranges that must use the workspace: protocol, so
  # freeze @pnpm/logger from the automated release: it is bumped out of band.
  ignore:
    - '@pnpm/logger'
  # The Rust CLI wrapper and its NAPI addon always release in lockstep at one
  # shared version.
  fixed:
    - ['pacquet', '@pnpm/napi']
  # The Rust products release as `X.Y.Z-alpha.N` prereleases (published under the
  # `next` dist-tag) while the TypeScript CLI keeps releasing stable versions on
  # the main lane. `pnpm lane main --filter …` graduates a product to stable.
  lanes:
    pacquet: alpha
    '@pnpm/napi': alpha
    '@pnpm/pnpr': alpha

allowBuilds:
  core-js: false
  esbuild: true
  fuse-native: true
  ghooks: true
  msgpackr-extract: true
  unrs-resolver: true

auditConfig:
  ignoreGhsas:
    - GHSA-2g4f-4pwh-qvx6
    - GHSA-76c9-3jph-rj3q
    - GHSA-ffrw-9mx8-89p8
    - GHSA-mh29-5h37-fv8m
    - GHSA-w5hq-g745-h8pq
    # GHSA-h67p-54hq-rp68: js-yaml quadratic-complexity DoS in merge key handling.
    # Patched only in >=4.1.2 with no v3 fix; @yarnpkg/parsers requires the js-yaml 3
    # API (yaml.safeLoad), so its transitive js-yaml cannot be upgraded.
    - GHSA-h67p-54hq-rp68

catalog:
  '@babel/core': ^7.29.7
  '@babel/plugin-transform-explicit-resource-management': ^7.29.7
  '@commitlint/cli': ^21.0.2
  '@commitlint/config-conventional': ^21.0.2
  '@commitlint/prompt-cli': ^21.0.2
  '@cyclonedx/cyclonedx-library': 10.1.0
  '@eslint/js': ^10.0.1
  '@inquirer/prompts': ^8.4.3
  '@jest/globals': 30.4.1
  '@npm/types': ^2.1.0
  '@pnpm/byline': ^1.0.0
  '@pnpm/colorize-semver-diff': ^2.0.0
  '@pnpm/config.env-replace': ^4.1.0
  '@pnpm/config.nerf-dart': ^2.0.1
  '@pnpm/exec': ^4.0.0
  '@pnpm/log.group': 4.0.1
  '@pnpm/logger': '^1100.0.0'
  '@pnpm/meta-updater': 2.0.6
  '@pnpm/nopt': ^0.3.1
  '@pnpm/npm-lifecycle': ^1100.0.0
  '@pnpm/npm-package-arg': ^2.0.0
  '@pnpm/os.env.path-extender': ^3.0.1
  '@pnpm/patch-package': 0.0.1
  '@pnpm/semver-diff': ^2.0.0
  '@pnpm/tabtab': ^0.5.4
  '@pnpm/tgz-fixtures': 0.0.0
  '@pnpm/util.lex-comparator': ^4.0.1
  '@reflink/reflink': 0.1.19
  '@rushstack/worker-pool': 0.7.18
  '@stylistic/eslint-plugin': ^5.10.0
  '@types/adm-zip': ^0.5.8
  '@types/archy': 0.0.36
  '@types/cross-spawn': ^6.0.6
  '@types/fs-extra': ^11.0.4
  '@types/graceful-fs': ^4.1.9
  '@types/hosted-git-info': ^3.0.5
  '@types/ini': 4.1.1
  '@types/is-gzip': 2.0.2
  '@types/is-windows': ^1.0.2
  '@types/isexe': 2.0.4
  '@types/jest': ^30.0.0
  '@types/js-yaml': ^4.0.9
  '@types/libnpmpublish': ^11.2.0
  '@types/lodash.kebabcase': 4.1.9
  '@types/lodash.throttle': 4.1.9
  '@types/micromatch': ^4.0.10
  # Kept on 22.x to match pnpm's minimum supported Node.js version (>=22.13);
  # newer majors would type APIs that don't exist on the supported floor.
  '@types/node': ^22.19.19
  '@types/normalize-package-data': ^2.4.4
  '@types/normalize-path': ^3.0.2
  '@types/npm-registry-fetch': ^8.0.9
  '@types/object-hash': 3.0.6
  '@types/parse-json': ^7.0.0
  '@types/picomatch': ^4.0.3
  '@types/pnpm__byline': npm:@types/byline@^4.2.36
  '@types/proxyquire': ^1.3.31
  '@types/qrcode-terminal': ^0.12.2
  '@types/ramda': 0.31.1
  '@types/retry': ^0.12.5
  '@types/semver': 7.7.1
  '@types/ssri': ^7.1.5
  '@types/tar-stream': ^3.1.4
  '@types/touch': ^3.1.5
  '@types/validate-npm-package-name': ^4.0.2
  '@types/which': ^3.0.4
  '@types/write-file-atomic': ^4.0.3
  '@types/yarnpkg__lockfile': ^1.1.9
  '@types/zkochan__table': npm:@types/table@6.3.2
  '@typescript-eslint/utils': ^8.61.0
  '@typescript/native-preview': 7.0.0-dev.20260610.1
  '@yarnpkg/core': 4.8.0
  '@yarnpkg/extensions': 2.0.6
  '@yarnpkg/lockfile': ^1.1.0
  '@yarnpkg/nm': 4.0.7
  '@yarnpkg/pnp': ^4.1.6
  '@zkochan/cmd-shim': ^9.0.6
  '@zkochan/retry': ^0.2.0
  '@zkochan/rimraf': ^4.0.0
  '@zkochan/table': ^2.0.1
  adm-zip: ^0.5.17
  amaro: ^1.1.9
  ansi-diff: ^1.2.0
  archy: ^1.0.0
  better-path-resolve: 2.0.0
  bin-links: ^6.0.2
  # bole 6 is ESM-only. Under Jest, the workspace logger's ESM bole and the
  # published @pnpm/logger's CJS bole 5 land in different realms, so the
  # globalThis.$$bole output registry is no longer shared and log events
  # emitted through one logger copy never reach the other's streamParser.
  # Keep bole 5 until the published @pnpm/logger ships with bole 6.
  bole: ^5.0.29
  boxen: npm:@zkochan/boxen@5.1.2
  c8: ^11.0.0
  camelcase: ^9.0.0
  camelcase-keys: ^10.0.2
  can-link: ^3.0.0
  can-write-to-dir: ^2.0.0
  chalk: ^5.6.2
  ci-info: ^4.4.0
  cli-truncate: ^6.0.0
  cmd-extension: ^2.0.0
  comver-to-semver: ^2.0.0
  concurrently: 10.0.3
  cross-env: ^10.1.0
  cross-spawn: ^7.0.6
  # cspell 10.x requires Node.js >=22.18.0, above pnpm's supported floor of
  # Node.js >=22.13.
  cspell: 9.8.0
  deep-require-cwd: 1.0.0
  delay: ^7.0.0
  detect-indent: 7.0.2
  detect-libc: ^2.1.2
  didyoumean2: ^7.0.4
  dint: ^5.1.0
  dir-is-case-sensitive: ^3.0.0
  empathic: ^2.0.0
  encode-registry: ^3.0.1
  esbuild: ^0.28.1
  escape-string-regexp: ^5.0.0
  eslint: ^10.4.0
  eslint-plugin-import-x: ^4.16.2
  eslint-plugin-jest: ^29.15.2
  eslint-plugin-n: ^18.1.0
  eslint-plugin-promise: ^7.3.0
  eslint-plugin-regexp: ^3.1.0
  eslint-plugin-simple-import-sort: ^13.0.0
  execa: npm:safe-execa@0.3.0
  exists-link: 2.0.0
  fast-deep-equal: ^3.1.3
  fast-glob: ^3.3.3
  fs-extra: ^11.3.5
  fuse-native: ^2.2.6
  get-port: ^7.2.0
  ghooks: 2.0.4
  graceful-fs: ^4.2.11
  graceful-git: ^5.0.0
  graph-cycles: 3.0.0
  hosted-git-info: npm:@pnpm/hosted-git-info@1.0.0
  https-proxy-server-express: 0.1.2
  husky: ^9.1.7
  hyperdrive-schemas: ^2.0.0
  # ini 7.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's
  # supported floor of Node.js >=22.13.
  ini: 6.0.0
  is-gzip: 2.0.0
  is-inner-link: ^5.0.0
  is-subdir: ^2.0.0
  is-windows: ^1.0.2
  isexe: 4.0.0
  jest: ^30.4.2
  jest-diff: ^30.4.1
  human-id: ^4.2.0
  js-yaml: npm:@zkochan/js-yaml@0.0.11
  json5: ^2.2.3
  keyv: 5.6.0
  lcov-result-merger: ^6.0.0
  libnpmpublish: ^11.2.0
  load-json-file: ^7.0.1
  lodash.kebabcase: ^4.1.1
  lodash.throttle: 4.1.1
  loud-rejection: ^2.2.0
  lru-cache: ^11.5.0
  make-empty-dir: ^4.0.0
  mdast-util-to-string: ^4.0.0
  memoize: ^11.0.0
  micromatch: ^4.0.8
  msgpackr: 2.0.4
  nm-prune: ^5.0.0
  normalize-newline: 5.0.0
  # normalize-package-data 9.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0,
  # above pnpm's supported floor of Node.js >=22.13.
  normalize-package-data: ^8.0.0
  normalize-path: ^3.0.0
  normalize-registry-url: 2.0.1
  # npm-packlist 11.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above
  # pnpm's supported floor of Node.js >=22.13.
  npm-packlist: 10.0.4
  npm-registry-fetch: ^19.0.0
  object-hash: 3.0.0
  open: ^11.0.0
  openpgp: ^6.3.1
  '@openpgp/web-stream-tools': 0.3.1
  p-defer: ^4.0.1
  p-every: ^2.0.0
  p-filter: ^4.1.0
  p-limit: ^7.3.0
  p-map-values: ^0.1.0
  p-queue: ^9.3.0
  parse-json: ^8.3.0
  parse-npm-tarball-url: ^5.0.0
  path-absolute: ^2.0.0
  path-exists: ^5.0.0
  path-name: ^1.0.0
  path-temp: ^3.0.0
  pidtree: ^1.0.0
  preferred-pm: ^5.0.0
  pretty-bytes: ^7.1.0
  pretty-ms: ^9.3.0
  promise-share: ^2.0.1
  proxyquire: ^2.1.3
  ps-list: ^9.0.0
  qrcode-terminal: ^0.12.0
  ramda: npm:@pnpm/ramda@0.28.1
  read-ini-file: 5.0.0
  read-yaml-file: ^3.0.0
  realpath-missing: ^2.0.0
  remark-parse: ^11.0.0
  remark-stringify: ^11.0.0
  rename-overwrite: ^7.0.1
  render-help: ^2.0.0
  resolve-link-target: ^3.0.0
  rimraf: ^6.1.3
  root-link-target: ^4.0.0
  run-groups: ^5.0.0
  rxjs: ^7.8.2
  safe-buffer: 5.2.1
  safe-execa: ^0.3.0
  safe-promise-defer: ^2.0.0
  sanitize-filename: ^1.6.4
  semver: ^7.8.4
  semver-range-intersect: ^0.3.1
  semver-utils: ^1.1.4
  shlex: ^3.0.0
  shx: ^0.4.0
  socks: ^2.8.9
  sort-keys: ^6.0.0
  split-cmd: ^1.1.0
  split2: ^4.2.0
  # ssri 14.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0, above pnpm's
  # supported floor of Node.js >=22.13.
  ssri: 13.0.1
  stacktracey: ^2.2.0
  string-length: ^7.0.1
  strip-bom: ^5.0.0
  strip-comments-strings: 1.2.0
  symlink-dir: ^10.0.1
  tar: ^7.5.15
  tar-stream: ^3.2.0
  # tempy >=3.1.0 uses temp-dir 3.x which has an async fs.realpath() in its
  # module init. When esbuild bundles this into its __esm lazy-init pattern,
  # the async operation deadlocks and the pnpm binary hangs on startup.
  tempy: 3.0.0
  terminal-link: ^5.0.0
  tinyglobby: ^0.2.16
  touch: 3.1.1
  tree-kill: ^1.2.2
  ts-jest-resolver: 2.0.1
  typescript: 6.0.3
  typescript-eslint: ^8.61.0
  # undici 8.x requires Node.js >=22.19.0, above pnpm's supported floor of
  # Node.js >=22.13.
  undici: ^7.27.2
  unified: ^11.0.5
  # validate-npm-package-name 8.x requires Node.js ^22.22.2 || ^24.15.0 ||
  # >=26.0.0, above pnpm's supported floor of Node.js >=22.13.
  validate-npm-package-name: 7.0.2
  version-selector-type: ^3.0.0
  vfile: ^6.0.3
  which: npm:@pnpm/which@^3.0.1
  # write-file-atomic 8.x requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0,
  # above pnpm's supported floor of Node.js >=22.13.
  write-file-atomic: ^7.0.1
  write-ini-file: 5.0.0
  write-json-file: ^7.0.0
  write-json5-file: ^4.0.0
  write-package: 7.2.0
  write-yaml-file: ^6.0.0
  yaml: ^2.9.0
  yaml-tag: 1.1.0

catalogMode: strict

cleanupUnusedCatalogs: true

enableGlobalVirtualStore: true

enablePrePostScripts: false

engineStrict: true

gitChecks: false

hoistPattern:
  - jest-runner

minimumReleaseAge: 1440 # At least a day

minimumReleaseAgeExclude:
  - '@pnpm/*'
  - '@rushstack/worker-pool@0.7.18'
  - '@zkochan/*'
  - better-path-resolve
  - body-parser@2.2.1
  - can-link
  - can-write-to-dir
  - cmd-extension
  - comver-to-semver
  - dir-is-case-sensitive
  - esbuild@0.28.1
  - '@esbuild/*'
  - express@4.22.1
  - glob@11.1.0
  - graceful-git
  - handlebars@4.7.9
  - is-inner-link
  - is-subdir
  - jws@3.2.3
  - lodash@4.17.23
  - make-empty-dir
  - normalize-registry-url
  - p-map-values
  - parse-npm-tarball-url@5.0.0
  - path-absolute
  - path-temp
  - pnpm
  - preferred-pm
  - promise-share
  - qs@6.14.2
  - read-ini-file
  - read-json5-file
  - read-yaml-file
  - realpath-missing
  - rename-overwrite
  - render-help
  - resolve-link-target
  - root-link-target
  - run-groups
  - safe-execa
  - safe-promise-defer
  - symlink-dir
  - tar@7.5.10
  - which-pm
  - which-pm-runs
  - write-ini-file
  - write-json5-file
  - write-yaml-file
  - qs@6.15.2
  - tmp@0.2.6
  - http-proxy-middleware@3.0.7

nodeVersion: 22.13.0

optimisticRepeatInstall: true

overrides:
  '@cypress/request@3.0.9>qs': ^6.14.1
  '@yarnpkg/fslib@2': '3'
  ajv@>=7.0.0-alpha.0 <8.18.0: '>=8.18.0'
  body-parser@<2.2.1: '^2.2.1'
  brace-expansion@<5.0.5: '>=5.0.5'
  clipanion: 3.2.0-rc.6
  cookie@<0.7.0: '>=0.7.0'
  cross-spawn@<7.0.5: '>=7.0.5'
  debug@<3.1.0: '>=3.1.0'
  diff@<8.0.3: '^8.0.3'
  express@<4.22.1: ^4.22.1
  follow-redirects@<=1.15.5: '>=1.15.6'
  glob-parent@<5.1.2: '>=5.1.2'
  glob@>=10.3.7 <=11.0.3: '^11.1.0'
  handlebars@>=4.0.0 <4.7.9: '>=4.7.9'
  hosted-git-info@1: 'catalog:'
  istanbul-reports: npm:@zkochan/istanbul-reports
  js-yaml@<3.14.2: '^3.14.2'
  js-yaml@^4.0.0: 'catalog:'
  json5@<2.2.2: 'catalog:'
  jsonwebtoken@<=8.5.1: '>=9.0.0'
  jws@<3.2.3: '^3.2.3'
  lodash@<=4.17.23: '>=4.18.0'
  lodash@>=4.0.0 <=4.17.22: '^4.17.23'
  lodash@>=4.0.0 <=4.17.23: '>=4.18.0'
  minimatch@>=7.0.0 <7.4.7: '^7.4.7'
  minimatch@>=9.0.0 <10.0.0: '>=10.2.4'
  nopt@5: npm:@pnpm/nopt@^0.2.1
  on-headers@<1.1.0: '>=1.1.0'
  path-to-regexp@<0.1.13: ^0.1.13
  path-to-regexp@>=4.0.0 <6.3.0: '>=6.3.0'
  path-to-regexp@>=7.0.0 <8.0.0: '>=8.0.0'
  postman-request>qs: ^6.14.1
  qs@>=6.11.1 <=6.15.1: ^6.15.2
  request: npm:postman-request@2.88.1-postman.40
  semver@<7.5.2: 'catalog:'
  send@<0.19.0: ^0.19.0
  shell-quote@<1.8.4: '>=1.8.4'
  serve-static@<1.16.0: ^1.16.0
  # GHSA-w7jw-789q-3m8p / CVE-2026-9277: 1.8.4 patches critical shell-quote vulnerabilities in <=1.8.3.
  shell-quote: 1.8.4
  socks@2: ^2.8.1
  tar@<=7.5.9: '>=7.5.10'
  tmp@<=0.2.3: '>=0.2.4'
  tough-cookie@<4.1.3: '>=4.1.3'
  validator@<13.15.22: '>=13.15.22'
  yaml@<2.2.2: '>=2.2.2'
  http-proxy-middleware@>=0.16.0 <3.0.6: ^3.0.6

packageExtensions:
  '@babel/parser':
    peerDependencies:
      '@babel/types': '*'
  jest-circus:
    dependencies:
      slash: '3'
  remark-parse:
    dependencies:
      vfile: ^6.0.0
    peerDependencies:
      unified: '*'
  remark-stringify:
    dependencies:
      vfile: ^6.0.0
    peerDependencies:
      unified: '*'

patchedDependencies:
  graceful-fs@4.2.11: __patches__/graceful-fs@4.2.11.patch

patchesDir: __patches__

publishBranch: main

resolutionMode: lowest-direct

savePrefix: ''

sharedWorkspaceLockfile: true

trustPolicy: no-downgrade

trustPolicyExclude:
  - '@pnpm/*'
  - '@yarnpkg/libzip@3.2.2'
  - pnpm
  - rxjs@7.8.2
  - tinyexec@1.2.2
  - undici-types@6.21.0

trustPolicyIgnoreAfter: 10080 # 1 week

verifyDepsBeforeRun: install