code-backrooms/pnpm-workspace.yaml at main · valuecodes/code-backrooms · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
packages:
  - "apps/*"
  - "packages/*"

# Every external dependency version, referenced as `catalog:` from the
# manifests. Update everything with `pnpm up --latest -r`, which rewrites only
# this file and the lockfile.
#
# Not here: `@repo/*` deps (stay `workspace:*`). Scoped keys must be
# double-quoted.
catalog:
  "@babel/parser": 8.0.7
  "@babel/types": 8.0.6
  "@react-three/drei": 10.7.9
  "@react-three/fiber": 9.8.1
  "@react-three/postprocessing": 3.2.0
  "@tailwindcss/postcss": 4.3.3
  # Held on the Node 24 line to match `.nvmrc` (see `updateConfig` below).
  "@types/node": 24.19.2
  "@types/react": 19.3.0
  "@types/react-dom": 19.3.0
  "@types/three": 0.186.0
  "@vitejs/plugin-react": 6.1.2
  fflate: 0.8.3
  knip: 6.41.0
  n8ao: 2.0.1
  oxfmt: 0.72.0
  oxlint: 1.87.0
  oxlint-tsgolint: 7.0.2004
  pino: 10.4.0
  postprocessing: 6.39.5
  react: 19.3.0
  react-dom: 19.3.0
  tailwindcss: 4.3.3
  three: 0.186.1
  three-mesh-bvh: 0.9.16
  turbo: 2.11.7
  # `typescript` is the native (Go) compiler; its binary is still `tsc`.
  typescript: 7.0.2
  vite: 8.3.4
  vitest: 5.0.3
  wrangler: 4.149.0

# Skipped by `pnpm up --latest`. `@types/node` must track the Node major in
# `.nvmrc`, so bump it by hand within that line.
updateConfig:
  ignoreDependencies:
    - "@types/node"

# Makes `pnpm add` / `pnpm update` use the catalog and reject conflicting
# versions. Plain `pnpm install` never evaluates it, so it is an authoring
# guardrail, not a CI check.
catalogMode: strict

allowBuilds:
  # Installs Tailwind 4's native binary. Without it Tailwind silently emits no
  # styles, and `pnpm build` still passes.
  "@tailwindcss/oxide": true
  # Still used by Vite's dependency pre-bundling and Vitest's transforms.
  esbuild: true
  # Wrangler's local runtime (web app deploy). Its binary ships in the
  # optional @cloudflare/workerd-<platform> package, so the postinstall (a check
  # plus a fallback download) isn't needed, and `wrangler deploy` of static
  # assets never runs workerd. It has to be listed, even as false, or the
  # install fails with ERR_PNPM_IGNORED_BUILDS.
  workerd: false

# 14 days, in minutes: a new release is not resolvable until it is this old.
# So `pnpm up --latest` deliberately skips fresh releases; use
# `minimumReleaseAgeExclude` if one package must move faster.
minimumReleaseAge: 20160

# Fails when a version has weaker trust evidence (provenance, trusted
# publishing) than an earlier one, the usual sign of a hijacked account.
# Also re-checked on `--frozen-lockfile` installs. If a downgrade is
# legitimate, exclude that exact version in `trustPolicyExclude` with a reason,
# never a bare package name.
trustPolicy: no-downgrade