gsd-pi/pnpm-workspace.yaml at main · open-gsd/gsd-pi · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
packages:
  - 'packages/*'
  - 'extensions/*'
  - 'web'

autoInstallPeers: true
strictPeerDependencies: false
engineStrict: true

# Transitive-dependency security overrides (Dependabot). pnpm 10 reads overrides
# from here, not from package.json's top-level npm "overrides" field.
#   uuid               GHSA-w5hq-g745-h8pq — bounds check in v3/v5/v6; fix only in
#                      the 11.1.1 line, so pin ^11.1.1 to avoid 12.0.0/13.0.0.
#   postcss            GHSA-qx2v-qp2m-jg93 — XSS via unescaped </style> in stringify.
#   @mistralai/mistralai  pin to last known-good release (was in npm overrides).
#   gaxios             pin to last audited release (was in npm overrides).
#   c8>yargs           c8@11 pulls in yargs<18 which has a prototype-pollution vuln.
#   discord.js/@discordjs/rest > undici  GHSA-vxpw-j846-p89q (WS DoS) +
#                      GHSA-p88m-4jfj-68fv (header injection) etc. — both discord.js
#                      and @discordjs/rest pin undici 6.24.1; 6.27.0 is the patched
#                      last-of-6.x. Kept on the 6.x line (they expect 6.x); the safe
#                      root undici@7.x is untouched.
#   protobufjs         GHSA-f38q-mgvj-vph7 — schema-name prototype shadowing via
#                      @google/genai; patched in 7.6.3.
#   hono               GHSA (middleware) — pulled via @modelcontextprotocol/sdk >
#                      @hono/node-server; patched in 4.12.25. Not on an executed
#                      path (gateway uses raw node:http) but clears the audit.
#                      # remove when MCP SDK bumps its @hono/node-server floor >= 4.12.25
overrides:
  uuid: ^11.1.1
  postcss: ^8.5.10
  "@mistralai/mistralai": 2.2.1
  gaxios: 7.1.4
  "c8>yargs": "^18.0.0"
  "discord.js>undici": "6.27.0"
  "@discordjs/rest>undici": "6.27.0"
  protobufjs: "^7.6.3"
  hono: ">=4.12.25"

# npm registry rejects tarballs containing hard-linked files (E415). pnpm hard-links
# by default; copy mode breaks those links so bundledDependencies pack cleanly.
packageImportMethod: copy

# Keep dist-test and compiled workspace imports resolvable from the repo root.
publicHoistPattern:
  - '*'

# Allow lifecycle scripts for native/tooling deps (replaces package.json#pnpm.onlyBuiltDependencies).
onlyBuiltDependencies:
  - '@opengsd/gsd-browser'
  - '@google/genai'
  - canvas
  - esbuild
  - koffi
  - node-pty
  - protobufjs
  - sharp
  - unrs-resolver