31 lines
1.6 KiB
YAML
31 lines
1.6 KiB
YAML
# This repository's own pnpm settings. Signage is a single standalone package, not part of any other
|
|
# workspace; pnpm reads its settings from this file.
|
|
|
|
# esbuild, which the module UI build and the module packager run, has an install script. pnpm runs
|
|
# none it was not told to.
|
|
allowBuilds:
|
|
esbuild: true
|
|
|
|
# pnpm holds back any package younger than its minimum release age, and refuses a lockfile that names
|
|
# one. A new Ekklesia package train is that young on its release day. These exact versions, and only
|
|
# these, are the train this lockfile pins (published by Ekklesia's release workflow, ADR 0053), so
|
|
# they are exempt by version; a train bump replaces them, and everything else keeps the policy.
|
|
minimumReleaseAgeExclude:
|
|
- '@ekklesia/[email protected]'
|
|
- '@ekklesia/[email protected]'
|
|
- '@ekklesia/[email protected]'
|
|
- '@ekklesia/[email protected]'
|
|
- '@ekklesia/[email protected]'
|
|
- '@ekklesia/[email protected]'
|
|
- '@ekklesia/[email protected]'
|
|
- '@ekklesia/[email protected]'
|
|
- '@ekklesia/[email protected]'
|
|
|
|
# The narrowly scoped advisory remediation Signage had while it was built inside Ekklesia's workspace,
|
|
# kept now that it is not. GHSA-67mh-4wv8-2f99 (moderate): the vulnerable esbuild 0.18.20 is reached
|
|
# only through the deprecated @esbuild-kit/core-utils (drizzle-kit -> @esbuild-kit/esm-loader), whose
|
|
# pinned range predates the fix. Scoped to that one edge, exactly as Ekklesia's own workspace does,
|
|
# so drizzle-kit's direct esbuild and Vite's are not dragged to another version.
|
|
overrides:
|
|
"@esbuild-kit/core-utils>esbuild": "0.25.12"
|