zero/pnpm-workspace.yaml at main · wevm/zero · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
packages:
  - 'apps/*'
  - 'packages/*'
  - 'prod/sst'
  - 'scripts'
  - 'tools/*'
allowBuilds:
  '@prisma/engines': true
  '@rocicorp/zero-sqlite3': true
  core-js: false
  core-js-pure: false
  cpu-features: false
  esbuild: true
  prisma: true
  protobufjs: true
  ssh2: false
# `pnpm audit` (run in CI by .github/workflows/audit.yml) fails on any advisory
# not listed here. Only list advisories that have no fixed release to update or
# override to, and remove them once one ships.
auditConfig:
  ignoreGhsas:
    # braces <=3.0.3, via chokidar/micromatch (Docusaurus, metro, Tailwind 3).
    # No 3.0.4 on npm yet.
    - GHSA-vfj7-8cjw-p6xm
    # sprintf-js 1.0.3, via argparse 1 (js-yaml 3 in Docusaurus,
    # @tantaman/api-extractor in zql-viz). No 1.1.4 on npm yet.
    - GHSA-hp3w-g68c-fv3c
    # deepmerge >=4.2.0 <=4.3.1, via @expo/config (Expo devDependencies). No
    # 4.3.2 on npm yet.
    - GHSA-gcqx-w48m-w2h4
    # minimatch <11.0.1 (3.x, 5.x, 9.x and 10.x via glob, Expo, Docusaurus and
    # other dev tooling). Only fixed in minimatch 11, which is not
    # API-compatible with those majors, so it cannot be overridden. The
    # amplification needs attacker-controlled patterns.
    - GHSA-g3hv-75wg-m249
    # glob >=9.0.0 <=14.0.1 (10.x and 13.x via the same dev tooling). Only
    # fixed in glob 14, a new major. The bypass only affects callers that rely
    # on an AbortSignal to bound a walk.
    - GHSA-3g3m-2fjr-6pw4

minimumReleaseAgeExclude:
  - '@rocicorp/zero-virtual@0.7.0'
  - '@badrap/valita@0.5.5'
  - '@rocicorp/zero-sqlite3@1.1.5'
  - '@rocicorp/zero-sqlite3@1.1.7'
  - '@rocicorp/zero@1.12.0'

# docusaurus-plugin-typedoc and typedoc-docusaurus-theme both import typedoc
# without declaring it, so they can only resolve it through pnpm's hoisted
# virtual store. There is more than one typedoc peer variant in the graph
# (replicache-doc is on TypeScript 6, packages/zero is on 7), so which one gets
# hoisted is arbitrary — and typedoc 0.28 throws on import under TypeScript 7,
# which is what broke the replicache-doc build on Vercel. Declaring the peer
# makes pnpm link the importer's own typedoc instead of relying on hoisting.
packageExtensions:
  docusaurus-plugin-typedoc:
    peerDependencies:
      typedoc: 0.28.x
  typedoc-docusaurus-theme:
    peerDependencies:
      typedoc: 0.28.x

overrides:
  '@graphql-tools/utils@<12.0.1': ^12.0.1
  '@hono/node-server@<2.1.3': ^2.1.3
  '@opentelemetry/propagator-jaeger@<2.9.0': ^2.9.0
  '@types/node': ^22.19.19
  '@xmldom/xmldom@>=0.8.0 <0.8.15': ^0.8.15
  '@xmldom/xmldom@>=0.9.0 <0.9.12': ^0.9.12
  ajv@>=7.0.0-alpha.0 <8.18.0: ^8.18.0
  basic-ftp@<6.2.1: ^6.2.1
  body-parser@<1.20.9: ^1.20.9
  body-parser@>=2.0.0 <2.4.0: ^2.4.0
  browserslist@<4.28.7: ^4.28.7
  compression@<1.8.2: ^1.8.2
  deepmerge-ts@<8.0.0: ^8.0.0
  esbuild: '0.28.2'
  fast-uri@>=3.0.0 <3.1.9: ^3.1.9
  fast-uri@>=4.0.0 <4.2.3: ^4.2.3
  fast-xml-parser@<5.11.3: ^5.11.3
  follow-redirects@>=1.16.0 <1.16.2: ^1.16.2
  hono@<4.12.25: ^4.12.25
  image-size@>=2.0.0 <2.0.3: ^2.0.3
  joi@>=17.1.1 <17.13.9: ^17.13.9
  js-yaml@>=4.0.0 <4.3.2: ^4.3.2
  lodash@>=4.0.0 <=4.17.23: ^4.17.24
  minimatch@>=10.0.0 <10.2.1: ^10.2.1
  minimatch@>=10.0.0 <10.2.3: ^10.2.3
  mysql2@<3.22.0: ^3.22.0
  nanoid@<3.3.18: ^3.3.18
  node-forge@<1.4.3: ^1.4.3
  playwright@<1.55.1: ^1.55.1
  postcss-selector-parser@<7.1.6: ^7.1.6
  postcss@<8.5.18: ^8.5.18
  qs@<6.16.0: ^6.16.0
  seroval@<1.6.11: ^1.6.11
  serialize-javascript@<7.1.3: ^7.1.3
  shell-quote@<1.8.4: ^1.8.4
  source-map-js@<1.2.2: ^1.2.2
  systeminformation@<5.33.16: ^5.33.16
  tinypool@<2.1.2: ^2.2.0
  undici@<6.24.0: ^6.24.0
  uuid@<11.1.1: ^11.1.1
  valibot@<1.4.2: ^1.4.2
  webpackbar: ^7.0.0
  # @expo/cli still depends on zod 3, which has no patched release. It only
  # uses zod APIs that are unchanged in zod 4.
  zod@<4.6.6: ^4.6.6
  # @rocicorp/zero-previous (npm:@rocicorp/zero@1.12.0) is only used for its
  # client in zql-integration-tests; align its OpenTelemetry deps with the
  # workspace so it doesn't drag in old, vulnerable instrumentations.
  '@rocicorp/zero@1.12.0>@opentelemetry/api-logs': ^0.223.0
  '@rocicorp/zero@1.12.0>@opentelemetry/auto-instrumentations-node': ^0.81.2
  '@rocicorp/zero@1.12.0>@opentelemetry/exporter-metrics-otlp-http': ^0.223.0
  '@rocicorp/zero@1.12.0>@opentelemetry/resources': ^2.12.0
  '@rocicorp/zero@1.12.0>@opentelemetry/sdk-metrics': ^2.12.0
  '@rocicorp/zero@1.12.0>@opentelemetry/sdk-node': ^0.223.0
  '@rocicorp/zero@1.12.0>@opentelemetry/sdk-trace-node': ^2.12.0

patchedDependencies:
  postgres@3.4.7: packages/zero/patches/postgres@3.4.7.patch