pnpm-workspace.yaml

# Minutes. Matches pnpm's default, set explicitly so it stays in step with
# `minimumReleaseAge: "1 day"` in renovate.json. Change both together.
minimumReleaseAge: 1440

# minimumReleaseAgeExcludePrune, shellEmulator and trustPolicy are required by
# @antfu/eslint-config, which pins them through `pnpm/yaml-enforce-settings`.
# Removing any of them fails `pnpm lint`. The prune setting (pnpm 12+) makes
# `pnpm add|update|remove` drop minimumReleaseAgeExclude entries the lockfile no
# longer resolves, so none are needed right now.
minimumReleaseAgeExcludePrune: true

trustPolicy: no-downgrade

# semver@6.3.1 is Babel's own pinned transitive dep (@babel/core, @babel/generator).
# no-downgrade flags it only because semver 7.x carries newer provenance attestation.
#
# why-is-node-running@3.2.2 (vitest 5 requires ^3.2.1) was published in January 2025
# by the same maintainers without the provenance attestation 3.2.1 carried.
#
# The cssnano monorepo packages below come in through Nuxt 4.6 (@nuxt/vite-builder ->
# cssnano 9). Every release is published from github.com/cssnano/cssnano by GitHub
# trusted publishing with provenance. The 8.0.3-8.0.10 releases also named a human
# approver, and 9.x dropped that step, so no-downgrade flags every 9.x release as a
# possible takeover. They are excluded by name, because each new release would
# otherwise need another entry. Re-check the publisher before you widen this list.
# Revisit on the Nuxt 5 upgrade: Nuxt 5 makes cssnano an optional peer, off by default.
trustPolicyExclude:
  - semver@6.3.1
  - why-is-node-running@3.2.2
  - cssnano
  - cssnano-preset-default
  - cssnano-utils
  - postcss-colormin
  - postcss-convert-values
  - postcss-discard-comments
  - postcss-discard-duplicates
  - postcss-discard-empty
  - postcss-discard-overridden
  - postcss-merge-longhand
  - postcss-merge-rules
  - postcss-minify-font-values
  - postcss-minify-gradients
  - postcss-minify-params
  - postcss-minify-selectors
  - postcss-normalize-charset
  - postcss-normalize-display-values
  - postcss-normalize-positions
  - postcss-normalize-repeat-style
  - postcss-normalize-string
  - postcss-normalize-timing-functions
  - postcss-normalize-unicode
  - postcss-normalize-url
  - postcss-normalize-whitespace
  - postcss-ordered-values
  - postcss-reduce-initial
  - postcss-reduce-transforms
  - postcss-svgo
  - postcss-unique-selectors
  - stylehacks

shellEmulator: true

packages:
  - .

# `pnpm update` does not refresh auto-installed peer dependencies, even at
# `--depth Infinity`, so these sat on versions with open advisories.
#
# webpack was only ever an *optional* peer (of unplugin and terser-webpack-plugin);
# Nuxt 4 builds with Vite/Rolldown and never used it. Pinning it stops pnpm
# auto-installing the stale peer, which drops the whole unused subtree --
# terser-webpack-plugin -> schema-utils -> ajv@8 -> fast-uri -- and the 7 advisories
# that came with it. The ajv and fast-uri pins are belt-and-braces should a future
# dependency pull that subtree back in. `ajv@8` is scoped to the 8.x line so eslint's
# ajv@6, a different and incompatible API, is left alone.
#
# esbuild covers GHSA-g7r4-m6w7-qqqr (path traversal in the esbuild dev server on
# Windows, fixed in 0.28.1). The whole tree already resolved to 0.28.1 except
# @nuxt/fonts -> fontless, which declares `^0.27.0` and so can never reach the fix
# on its own. fontless 1.x drops esbuild, but @nuxt/fonts 0.14 still pins fontless
# `^0.2.1`. fontless imports only `transform` for CSS minification and never starts
# a dev server, so it was not actually exposed -- the override just dedupes the tree
# onto the patched version. Drop it once @nuxt/fonts moves to fontless 1.x.
overrides:
  ajv@8: ^8.20.0
  esbuild: ^0.28.2
  fast-uri: ^4.2.2
  webpack: ^5.112.0

allowBuilds:
  '@parcel/watcher': true
  esbuild: true
  sharp: true
  unrs-resolver: true
  # Pulled in by reka-ui -> @floating-ui/vue (a @nuxt/ui dependency). Its
  # postinstall runs vue-demi-switch, which points the package at the Vue 3
  # entry points; without it the Vue 2 shim is left in place.
  vue-demi: true
  workerd: true