pnpm-workspace.yaml

packages:
  - packages/*
  - '!packages/package-builder/build'
  - .claude/hooks/*

# Packages allowed to run build scripts (pnpm v11 strictDepBuilds default).
allowBuilds:
  esbuild: true
  postject: false

# Refuse to run if the pnpm version on PATH differs from the packageManager
# field in package.json. Our setup action pins pnpm via external-tools.json;
# any drift should fail fast, not silently auto-download via @pnpm/exe
# (which in rc.5 leaves a placeholder launcher that errors at runtime).
pmOnFail: error

catalog:
  '@anthropic-ai/claude-code': 2.1.98
  '@babel/core': 7.28.4
  '@babel/generator': 7.28.5
  '@babel/parser': 7.28.4
  '@babel/plugin-proposal-export-default-from': 7.27.1
  '@babel/plugin-transform-export-namespace-from': 7.27.1
  '@babel/plugin-transform-runtime': 7.28.3
  '@babel/preset-react': 7.27.1
  '@babel/preset-typescript': 7.27.1
  '@babel/runtime': 7.28.4
  '@babel/traverse': 7.28.4
  '@babel/types': 7.28.5
  '@gitbeaker/rest': 43.7.0
  '@iarna/toml': 2.2.5
  '@modelcontextprotocol/sdk': 1.29.0
  '@npmcli/arborist': 9.4.2
  '@npmcli/config': 10.4.0
  '@octokit/graphql': 9.0.1
  '@octokit/openapi-types': 25.1.0
  '@octokit/request-error': 7.0.0
  '@octokit/rest': 22.0.0
  '@octokit/types': 14.1.0
  '@pnpm/dependency-path': 1001.1.0
  '@pnpm/lockfile.detect-dep-types': 1001.0.13
  '@pnpm/lockfile.fs': 1001.1.17
  '@pnpm/logger': 1001.0.0
  '@sentry/node': 8.0.0
  '@sinclair/typebox': 0.34.49
  '@socketregistry/hyrious__bun.lockb': 1.0.19
  '@socketregistry/indent-string': 1.0.14
  '@socketregistry/is-interactive': 1.0.6
  '@socketregistry/packageurl-js': 'npm:@socketregistry/packageurl-js@1.4.2'
  # -stable aliases: pnpm `overrides:` can't redirect a package's own
  # name from inside the same package — Node ESM resolves it as a
  # self-reference. The 4 Socket-published packages each need a
  # SECOND name (`<canonical>-stable`) so build/script/hook/config
  # code resolves to the published catalog version regardless of where
  # the importing file lives. See socket-wheelhouse@92cd3e3 for the
  # full rationale.
  '@socketregistry/packageurl-js-stable': 'npm:@socketregistry/packageurl-js@1.4.2'
  '@socketregistry/yocto-spinner': 1.0.25
  '@socketsecurity/lib': 'npm:@socketsecurity/lib@5.28.0'
  '@socketsecurity/lib-stable': 'npm:@socketsecurity/lib@5.28.0'
  '@socketsecurity/registry': 'npm:@socketsecurity/registry@2.0.2'
  '@socketsecurity/registry-stable': 'npm:@socketsecurity/registry@2.0.2'
  '@socketsecurity/sdk': 'npm:@socketsecurity/sdk@4.0.1'
  '@socketsecurity/sdk-stable': 'npm:@socketsecurity/sdk@4.0.1'
  '@types/adm-zip': 0.5.7
  '@types/cmd-shim': 5.0.2
  '@types/js-yaml': 4.0.9
  '@types/mdast': 4.0.4
  '@types/micromatch': 4.0.9
  '@types/mock-fs': 4.13.4
  '@types/node': 24.9.2
  '@types/npm-package-arg': 6.1.4
  '@types/npmcli__arborist': 6.3.1
  '@types/npmcli__config': 6.0.3
  '@types/proc-log': 3.0.4
  '@types/react': 19.2.2
  '@types/semver': 7.7.1
  '@types/which': 3.0.4
  '@types/yargs-parser': 21.0.3
  '@typescript/native-preview': 7.0.0-dev.20260510.1
  '@vitest/coverage-v8': 4.0.3
  '@vitest/ui': 4.1.6
  '@yao-pkg/pkg': 6.8.0
  '@yarnpkg/parsers': 3.0.3
  adm-zip: 0.5.16
  aggregate-error: npm:@socketregistry/aggregate-error@^1.0.15
  ajv-dist: 8.17.1
  ansi-regex: 6.2.2
  brace-expansion: 5.0.5
  browserslist: 4.25.4
  chalk-table: 1.0.2
  cmd-shim: 7.0.0
  compromise: 14.14.4
  del-cli: 6.0.0
  dev-null-cli: 2.0.0
  ecc-agentshield: 1.4.0
  emoji-regex: 10.6.0
  es-define-property: npm:@socketregistry/es-define-property@^1.0.7
  es-set-tostringtag: npm:@socketregistry/es-set-tostringtag@^1.0.10
  esbuild: 0.25.11
  fast-glob: 3.3.3
  fast-xml-parser: 5.5.1
  function-bind: npm:@socketregistry/function-bind@^1.0.7
  globalthis: npm:@socketregistry/globalthis@^1.0.8
  gopd: npm:@socketregistry/gopd@^1.0.7
  graceful-fs: 4.2.11
  has-property-descriptors: npm:@socketregistry/has-property-descriptors@^1.0.7
  has-proto: npm:@socketregistry/has-proto@^1.0.7
  has-symbols: npm:@socketregistry/has-symbols@^1.0.7
  has-tostringtag: npm:@socketregistry/has-tostringtag@^1.0.7
  hasown: npm:@socketregistry/hasown@^1.0.7
  hpagent: 1.2.0
  https-proxy-agent: 7.0.6
  husky: 9.1.7
  ignore: 7.0.5
  indent-string: npm:@socketregistry/indent-string@^1.0.14
  is-core-module: npm:@socketregistry/is-core-module@^1.0.11
  isarray: npm:@socketregistry/isarray@^1.0.8
  js-yaml: npm:@zkochan/js-yaml@0.0.10
  lint-staged: 16.1.6
  lodash: 4.17.21
  magic-string: 0.30.19
  'mdast-util-from-markdown': 2.0.3
  'micromark': 4.0.2
  micromatch: 4.0.8
  mock-fs: 5.5.0
  nanotar: 0.2.1
  nock: 14.0.10
  npm-package-arg: 13.0.0
  npm-run-all2: 9.0.0
  octokit: 5.0.5
  onnxruntime-web: 1.23.0
  open: 10.2.0
  oxfmt: 0.48.0
  oxlint: 1.63.0
  packageurl-js: npm:@socketregistry/packageurl-js@^1.4.2
  path-parse: npm:@socketregistry/path-parse@^1.0.8
  postject: 1.0.0-alpha.6
  react: 19.2.0
  react-reconciler: 0.33.0
  registry-auth-token: 5.1.0
  registry-url: 7.2.0
  safe-buffer: npm:@socketregistry/safe-buffer@^1.0.9
  safer-buffer: npm:@socketregistry/safer-buffer@^1.0.10
  semver: 7.7.2
  set-function-length: npm:@socketregistry/set-function-length@^1.0.10
  shell-quote: 1.8.3
  side-channel: npm:@socketregistry/side-channel@^1.0.10
  ssri: 12.0.0
  string-width: 8.1.0
  string_decoder: 0.10.31
  strip-ansi: 7.1.2
  tar-stream: 3.1.7
  taze: 19.11.0
  terminal-link: 2.1.1
  tiny-colors: 2.1.3
  trash: 10.0.0
  type-coverage: 2.29.7
  typedarray: npm:@socketregistry/typedarray@^1.0.8
  typescript: 5.9.3
  undici: 6.21.3
  unplugin-purge-polyfills: 0.1.0
  vite: 7.3.2
  vitest: 4.0.3
  wrap-ansi: 9.0.2
  xml2js: 0.6.2
  yaml: 2.8.1
  yargs-parser: 21.1.1
  yoctocolors-cjs: 2.1.3
  zod: 4.1.8
# pnpm v11 reads settings from this file; only auth/registry go in .npmrc.
ignoreScripts: true
linkWorkspacePackages: false

# Wait 7 days (10080 minutes) before installing newly published packages.
minimumReleaseAge: 10080
minimumReleaseAgeExclude:
  - '@anthropic-ai/claude-code@2.1.98'
  - '@socketaddon/*'
  - '@socketbin/*'
  - '@socketregistry/*'
  - '@socketsecurity/*'
  # Network-mocking lib used in fleet test suites. v15 betas pre-date
  # npm's `time` field for the major; allow pinned beta until v15 GA.
  - 'nock@15.0.0-beta.11'
  # Security fix for CVE-class CSS injection in JSX SSR + JWT
  # NumericDate validation + cache-leak. Dependabot advisories #140,
  # #141, #142 (all hono <4.12.18). Override forces the patched version
  # via pnpm-workspace.yaml `overrides`; pulling it through the
  # minimum-release-age gate as an explicit security exception.
  - 'hono@4.12.18'
  - 'npm-run-all2@9.0.0'
  # @npmcli/read-package-json-fast 6.0.0 (2026-05-15) is npm-run-all2 9's
  # ESM-only major transitive. Bypassed alongside the parent bump so the
  # lockfile resolves cleanly today rather than waiting 4 days for the
  # natural soak clearance on 2026-05-22.
  - 'read-package-json-fast@6.0.0'

# Refuse transitive dependencies declared via git/tarball/local-tarball
# specs — an npm package shouldn't be allowed to drag in a git URL we
# don't control (bypasses npm registry validation, no provenance, no
# soak window). Direct git deps are still allowed (the test suite at
# pnpm/pkg-manager/core/test/install/blockExoticSubdeps.ts confirms
# this). pnpm's current default is `false`; declared explicitly so a
# future flip can't silently change install behavior.
blockExoticSubdeps: true

# Dependency overrides (migrated from package.json pnpm.overrides).
# Force every consumer of Socket's own packages to resolve through the
# catalog-pinned published versions. The `catalog:` form rewrites
# `workspace:*`, `^x.y.z`, and bare-version specs alike to the version
# in the default `catalog:` block above. This defeats accidental
# local-checkout resolution when a sibling repo is on disk.
overrides:
  '@octokit/graphql': 'catalog:'
  '@octokit/request-error': 'catalog:'
  '@sigstore/sign': '4.1.0'
  '@socketregistry/packageurl-js': 'catalog:'
  '@socketsecurity/lib': 'catalog:'
  '@socketsecurity/registry': 'catalog:'
  '@socketsecurity/sdk': 'catalog:'
  'aggregate-error': 'catalog:'
  'ansi-regex': 'catalog:'
  'brace-expansion': 'catalog:'
  'defu': '>=6.1.7'
  'emoji-regex': 'catalog:'
  'es-define-property': 'catalog:'
  'es-set-tostringtag': 'catalog:'
  'fast-uri': '>=3.1.2'
  'function-bind': 'catalog:'
  'glob': '>=13.0.6'
  'globalthis': 'catalog:'
  'gopd': 'catalog:'
  'graceful-fs': 'catalog:'
  'has-property-descriptors': 'catalog:'
  'has-proto': 'catalog:'
  'has-symbols': 'catalog:'
  'has-tostringtag': 'catalog:'
  'hasown': 'catalog:'
  'hono': '>=4.12.18'
  'https-proxy-agent': 'catalog:'
  'indent-string': 'catalog:'
  'ip-address': '>=10.2.0'
  'is-core-module': 'catalog:'
  'isarray': 'catalog:'
  'lodash': 'catalog:'
  'npm-package-arg': 'catalog:'
  'packageurl-js': 'catalog:'
  'path-parse': 'catalog:'
  'postcss': '>=8.5.13'
  'qs': '>=6.15.1'
  'safe-buffer': 'catalog:'
  'safer-buffer': 'catalog:'
  'semver': 'catalog:'
  'set-function-length': 'catalog:'
  'shell-quote': 'catalog:'
  'side-channel': 'catalog:'
  'signal-exit': '4.1.0'
  'string-width': 'catalog:'
  'string_decoder': 'catalog:'
  'strip-ansi': 'catalog:'
  'tiny-colors': 'catalog:'
  'typedarray': 'catalog:'
  'undici': 'catalog:'
  'vite': 'catalog:'
  'wrap-ansi': 'catalog:'
  'xml2js': 'catalog:'
  'yaml': 'catalog:'
  'yargs-parser': 'catalog:'

# Auto-install missing peer deps (pnpm default). Declared explicitly
# so a future default flip can't silently change install behavior.
autoInstallPeers: true

# Run pre/post lifecycle scripts on the workspace root (e.g.
# prepare -> husky). This is the pnpm default; declared explicitly
# so a future default flip can't silently disable husky setup.
enablePrePostScripts: true

# Patched dependencies (migrated from package.json pnpm.patchedDependencies).
patchedDependencies:
  '@npmcli/run-script@10.0.4': patches/@npmcli__run-script@10.0.4.patch
  '@sigstore/sign@4.1.0': patches/@sigstore__sign@4.1.0.patch
  execa@2.1.0: patches/execa@2.1.0.patch
  execa@5.1.1: patches/execa@5.1.1.patch
  node-gyp@12.2.0: patches/node-gyp@12.2.0.patch
saveExact: true
strictPeerDependencies: true
trustPolicy: no-downgrade
trustPolicyExclude:
  - undici@6.21.3
  - 'compromise@14.15.0'