pnpm-workspace.yaml

# pnpm 11+ moved install/resolution settings out of `.npmrc` (which it now
# ignores for everything except registry/auth/Node settings like node-options)
# and into this file. Settings here govern the install behaviour in this
# project root.

packages:
  - 'packages/*'

catalog:
  '@analogjs/vite-plugin-angular': 2.7.0
  '@analogjs/vitest-angular': 2.7.0
  '@arethetypeswrong/cli': 0.18.5
  '@angular-devkit/architect': 0.2201.4
  '@angular-devkit/core': 22.1.4
  '@angular/build': 22.1.4
  '@angular/cdk': 22.1.2
  '@angular/cli': 22.1.4
  '@angular/common': 22.1.2
  '@angular/compiler': 22.1.2
  '@angular/compiler-cli': 22.1.2
  '@angular/core': 22.1.2
  '@angular/forms': 22.1.2
  '@angular/localize': 22.1.2
  '@angular/platform-browser': 22.1.2
  '@fortawesome/angular-fontawesome': 5.1.0
  '@fortawesome/fontawesome-svg-core': 7.3.1
  '@fortawesome/free-solid-svg-icons': 7.3.1
  '@compodoc/compodoc': 2.0.0
  '@playwright/test': 1.62.1
  '@storybook/addon-a11y': 10.5.8
  '@storybook/addon-docs': 10.5.8
  '@storybook/addon-themes': 10.5.8
  '@storybook/addon-vitest': 10.5.8
  '@storybook/angular-vite': 10.5.8
  '@tailwindcss/postcss': 4.3.3
  '@types/node': 24.13.3
  '@types/react': 19.2.18
  '@vitest/browser': 4.1.10
  '@vitest/browser-playwright': 4.1.10
  '@vitest/coverage-istanbul': 4.1.10
  '@vitest/coverage-v8': 4.1.10
  chokidar: 5.0.0
  concurrently: 10.0.4
  cross-env: 10.1.0
  dayjs: 1.11.21
  eslint: 10.8.1
  eslint-plugin-storybook: 10.5.8
  jsdom: 30.0.1
  lodash-es: 4.18.1
  ng-packagr: 22.1.1
  postcss: 8.5.26
  publint: 0.3.23
  playwright: 1.62.1
  react: 19.2.8
  rxjs: 7.8.2
  sass: 1.102.0
  semver: 7.8.5
  storybook: 10.5.8
  stylelint: 17.14.1
  tailwindcss: 4.3.3
  tslib: 2.8.1
  typescript: 6.0.3
  vite: 8.1.5
  vitest: 4.1.10
  yaml: 2.9.0
  zone.js: 0.16.2

# No hoist shim: rely on pnpm's default isolated layout. Every package the
# project imports is declared as a direct dependency in package.json; patches
# go through pnpm.patchedDependencies (which works on the .pnpm symlink store
# directly, without requiring transitive deps at top-level node_modules).

# Auto-install peer dependencies (default in pnpm 10, opt-in in pnpm 11).
# Without this, peer deps are not installed, and the Angular esbuild bundle
# fails with "Could not resolve ..." errors.
autoInstallPeers: true

# Treat the lockfile as authoritative; never silently update it during install.
preferFrozenLockfile: true

# Allow our own pre/post lifecycle scripts (postinstall, prepare) to run.
enablePrePostScripts: true

# Tell pnpm that Angular 22 is an acceptable peer for packages whose published
# peerDependencies range still lists only older majors ("18.x || 19.x || 20.x || 21.x").
# We already pin every relevant @angular/* dep under ng-mocks
# to ^22.0.0 via the `overrides:` block below; this block just suppresses
# the cosmetic peer-range warning that overrides do not silence on their own.
# ng-mocks 14.15.3 already declares Angular 22 in its peer range, so this block
# is largely redundant for ng-mocks; it is kept as a safety net for any other
# transitive package whose range still trails the Angular release train.
peerDependencyRules:
  allowedVersions:
    '@angular/animations': '22'
    '@angular/cdk': '22'
    '@angular/common': '22'
    '@angular/compiler': '22'
    '@angular/core': '22'
    '@angular/forms': '22'
    '@angular/platform-browser': '22'
    '@angular/platform-browser-dynamic': '22'
    '@angular/router': '22'

# Dependency overrides. pnpm 11 reads overrides from this file in preference to
# the legacy `pnpm.overrides` block in package.json. We pin a handful of
# transitive packages to CVE-patched versions and force the current Angular major
# across the ng-mocks subtree (its peer range trails the Angular release train).
#
# Do NOT add a `vite` override here, and do not reintroduce one when
# `supporting_scripts/check_client_override_version_updates.sh` reports a newer release.
# `@angular/build` depends on one exact vite version and configures the dev server's
# dependency pre-bundling in a format only that version understands (22.1 moved the plugin
# that runs the Angular linker to `optimizeDeps.rolldownOptions`, which Vite 7 silently
# ignores). An override that resolves to anything else leaves pre-bundled Angular libraries
# unlinked, and `pnpm start` serves a blank page with "The injectable '_PlatformLocation'
# needs to be compiled using the JIT compiler" — while the production build stays green,
# because it never uses Vite. Without an override, @angular/build's own exact pin governs
# and the mismatch cannot happen. `pnpm run check:vite-override` fails the build if it does.
overrides:
  'ng-mocks>@angular/common': '^22.0.0'
  'ng-mocks>@angular/core': '^22.0.0'
  'ng-mocks>@angular/forms': '^22.0.0'
  'ng-mocks>@angular/platform-browser': '^22.0.0'
  'ng-mocks>@angular/platform-browser-dynamic': '^22.0.0'
  'ng-mocks>@angular/router': '^22.0.0'
  'ng-mocks>rxjs': '^7.8.2'
  # @angular/localize is only pulled in transitively (e.g. via @ng-bootstrap/ng-bootstrap,
  # whose peer range requires ^22.0.0). Without this pin it resolves to an older 21.x
  # straggler that violates that peer range; force it to match the @angular/core version.
  '@angular/localize': '22.1.2'
  'babel-plugin-istanbul>test-exclude': '8.0.0'
  '@babel/core': '7.29.7'
  '@babel/runtime': '7.29.7'
  '@babel/plugin-transform-modules-systemjs': '7.29.7'
  '@primeuix/styled': '0.7.4'
  '@primeuix/utils': '0.7.2'
  '@sinonjs/fake-timers': '15.4.0'
  ajv: '8.20.0'
  brace-expansion: '5.0.9'
  braces: '3.0.3'
  cookie: '1.1.1'
  debug: '4.4.3'
  diff: '9.0.0'
  dompurify: '3.4.13'
  esbuild: '0.28.2'
  express: '5.2.1'
  # Kept on the 3.x line (ajv/fast-json-stringify require ^3).
  fast-uri: '3.1.5'
  globals: '17.11.0'
  http-proxy-middleware: '3.0.7'
  immutable: '5.1.9'
  ip-address: '10.5.0'
  # Kept on the 4.x line (consumers require ^4; 5.x is an API break).
  js-yaml: '4.3.1'
  jsdom: '30.0.1'
  katex: '0.18.4'
  minimatch: '10.2.6'
  # Reached dev-side via postcss, whose range allows the patched 3.3.18
  # (GHSA: custom generators can loop indefinitely when size is zero).
  nanoid: '3.3.18'
  piscina: '5.3.0'
  postcss: '8.5.26'
  punycode: '2.3.1'
  # @tumaet/apollon's react/react-dom peer requires react 19. Artemis embeds
  # Apollon but has no direct React code, so force the whole React subtree to 19
  # (matches the version used in the documentation/ project).
  react: '19.2.8'
  react-dom: '19.2.8'
  semver: '7.8.5'
  serialize-javascript: '7.1.0'
  shell-quote: '1.10.0'
  tar: '7.5.22'
  tmp: '0.2.7'
  tough-cookie: '6.0.2'
  undici: '7.29.0'
  uuid: '14.0.1'
  # Vite 8 leaves decorators in external spec helpers untransformed. Keep the Vitest toolchain on
  # Vite 7 until @analogjs/vite-plugin-angular handles those helpers; Angular and Storybook use Vite 8.
  'vitest>vite': '7.3.6'
  '@vitest/mocker>vite': '7.3.6'
  '@analogjs/vite-plugin-angular>vite': '7.3.6'
  'vite-tsconfig-paths>vite': '7.3.6'
  webpack: '5.109.2'
  webpack-dev-middleware: '7.4.5'
  # Kept on the 5.x line (Angular build tooling requires ^5; 6.x is an API break).
  webpack-dev-server: '5.2.6'
  word-wrap: '1.2.5'
  ws: '8.21.3'
  yargs-parser: '22.0.0'

# Patch files applied by pnpm to specific transitive dependencies during install
# (the pnpm-native replacement for the old patch-package/postinstall flow).
patchedDependencies:
  'eslint@10.8.1': 'patches/eslint+10.8.1.patch'
  y-monaco@0.1.6: patches/y-monaco@0.1.6.patch

# Allowlist of dependencies permitted to run install-time build / lifecycle scripts.
# pnpm 11 blocks build scripts by default; these are needed for native bindings
# (@swc/core, esbuild, @parcel/watcher, lmdb, msgpackr-extract, unrs-resolver),
# polyfill setup (core-js), or our own dev-time hooks (husky).
allowBuilds:
  '@parcel/watcher': true
  '@swc/core': true
  core-js: true
  esbuild: true
  husky: true
  lmdb: true
  msgpackr-extract: true
  unrs-resolver: true

# Acknowledged audit advisories that `pnpm audit` should not flag.
# GHSA-8988-4f7v-96qf (@opentelemetry/core < 2.8.0, moderate: unbounded memory
# allocation in W3C Baggage propagation) reaches us only through the dev-only
# chain lighthouse > @sentry/node@9 > @opentelemetry/core@1.30.1. It is never
# bundled into the production WAR and processes no untrusted baggage in our usage.
# The fix exists only in @opentelemetry/core >= 2.8.0 (the OTel 2.x train), which
# requires @sentry/node >= 10; lighthouse (latest 13.4.0) still pins @sentry/node@^9,
# so there is no in-range upgrade. Revisit when lighthouse moves to @sentry/node 10.
# (The server-side Java equivalent, GHSA-rcgg-9c38-7xpx, is already handled via
# opentelemetry_version=1.65.0 in gradle.properties.)
auditConfig:
  ignoreGhsas:
    - 'GHSA-8988-4f7v-96qf'