javascript-sdks/pnpm-workspace.yaml at main · janithjay/javascript-sdks · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
packages:
  - packages/*
  - samples/*/*
  - tests/*

allowBuilds:
  '@parcel/watcher': true
  core-js: true
  esbuild: true
  sharp: true
  turbo: true
  unrs-resolver: true

overrides:
  # JUSTIFICATION: Fixes GHSA-v422-hmwv-36x6 — body-parser silently disables its size limit on an
  # invalid `limit` value, allowing a DoS. Transitive via samples/express/quickstart's `express`
  # dependency (express > body-parser). express@4's own body-parser range (~1.20.5) already
  # permits 1.20.6; remove once a fresh install picks it up without the override.
  body-parser: 1.20.6
  # JUSTIFICATION: Fixes GHSA-3jxr-9vmj-r5cp / GHSA-mh99-v99m-4gvg / GHSA-rgw5-rvv9-x895 —
  # brace-expansion DoS via exponential/unbounded expansion of `{}` groups. Three major lines are
  # pulled in transitively, each needing its own pin: v1 via the root `@thunderid/eslint-plugin`
  # toolchain (eslint > minimatch > brace-expansion), v2 via packages/nuxt and packages/vue's
  # `@vue/test-utils` (js-beautify > glob > minimatch > brace-expansion), and v5 via the root
  # `rimraf` clean scripts (rimraf > glob > minimatch > brace-expansion). Upstream minimatch@latest
  # already depends on brace-expansion ^5.0.8, so the v5 pin can likely be dropped on the next
  # `pnpm update` once eslint/js-beautify's own lockfile entries catch up too.
  brace-expansion@1: 1.1.18
  brace-expansion@2: 2.1.4
  brace-expansion@5: 5.0.9
  # JUSTIFICATION: Fixes GHSA-52cp-r559-cp3m / GHSA-5p4m-2wfm-xmqj — js-yaml quadratic CPU
  # consumption via YAML merge-key chains and `!!omap` resolution. Transitive via the root
  # `eslint` > `@eslint/eslintrc` > `js-yaml`. `@eslint/eslintrc`@latest already declares
  # `js-yaml: ^4.3.0`, which permits 4.3.1 — this pin can likely be removed once its lockfile
  # entry is refreshed.
  js-yaml: 4.3.1
  # JUSTIFICATION: Fixes GHSA-28wg-ghj8-5hjv / GHSA-2v37-7h3g-55p8 — nanoid can loop indefinitely
  # given a negative or zero size. Two major lines are pulled in: v3 transitively via
  # packages/nextjs's `next` > `postcss` > `nanoid` (next still pins `postcss@8.4.31`, which pulls
  # an old nanoid — see the `postcss` override below), and v5 via packages/nuxt's
  # `@nuxt/devtools` > `@vue/devtools-core` > `nanoid`.
  nanoid@3: 3.3.18
  nanoid@5: 5.1.16
  # JUSTIFICATION: Fixes GHSA-qx2v-qp2m-jg93 (XSS via unescaped `</style>` in stringify output),
  # GHSA-6g55-p6wh-862q / GHSA-r28c-9q8g-f849 / GHSA-fxqj-rqcc-2cmp (arbitrary file read via
  # attacker-controlled `sourceMappingURL`). Transitive via packages/nextjs and
  # samples/nextjs/quickstart's `next` dependency, which still bundles `postcss@8.4.31` internally
  # even on the latest 15.5.x release — this is a genuine upstream lag, not a stale lockfile; keep
  # the override until Next.js bumps its own postcss pin (https://github.com/vercel/next.js).
  postcss: 8.5.23
  # JUSTIFICATION: Fixes GHSA-f88m-g3jw-g9cj — sharp inherits several libvips CVEs
  # (CVE-2026-33327/33328/35590/35591). Transitive via packages/nextjs and
  # samples/nextjs/quickstart's `next` > `sharp` (Next.js image optimization).
  sharp: 0.35.0
  # JUSTIFICATION: Fixes GHSA-395f-4hp3-45gv — quadratic-complexity DoS in shell-quote's `parse()`.
  # Transitive via packages/nuxt's `@nuxt/devtools` > `launch-editor` > `shell-quote`. Note the
  # advisory's own "patched" floor (>=1.8.5) is stale — 1.8.5 was never published; 1.10.0 is the
  # first published fix.
  shell-quote: 1.10.0
  # JUSTIFICATION: Fixes GHSA-2p49-hgcm-8545 — SVGO's `removeScripts` plugin leaves some executable
  # script content intact. Transitive via packages/nuxt's Vite build pipeline
  # (`@nuxt/vite-builder` > `cssnano` > `cssnano-preset-default` > `postcss-svgo` > `svgo`).
  # `postcss-svgo`@latest already depends on `svgo: ^4.0.2`, so this pin can likely be dropped once
  # nuxt's own lockfile entry for `postcss-svgo` is refreshed.
  svgo: 4.0.2
  # JUSTIFICATION: Fixes 5 node-tar advisories (GHSA-w8wr-v893-vjvp, GHSA-23hp-3jrh-7fpw,
  # GHSA-8x88-c5mf-7j5w, GHSA-gvwx-54wh-qm9j, GHSA-r292-9mhp-454m) — PAX path/NUL-byte parsing
  # crashes, an unbounded-decompression DoS, and a mapHas/filesFilter stack-overflow DoS. Transitive
  # via packages/nuxt and samples/nuxt/quickstart's SSR build tooling
  # (`nuxt` > `@nuxt/nitro-server` > `nitropack` > `@vercel/nft` > `@mapbox/node-pre-gyp` > `tar`).
  # `@mapbox/node-pre-gyp`@latest already depends on `tar: ^7.4.0`, which permits 7.5.21 — this pin
  # can likely be dropped once nitropack/@vercel/nft's own lockfile entries are refreshed.
  tar: 7.5.21

auditConfig:
  ignoreGhsas:
    # JUSTIFICATION: GHSA-g7r4-m6w7-qqqr — esbuild's dev server allows arbitrary file reads, but
    # only when running on Windows with the dev/serve command exposed on the network; it does not
    # affect `vite build`/`vitest run` output. Transitive via `vitest` > `vite` > `esbuild`
    # (pulled into every package that runs vitest). The only patched line is 0.28.x, and
    # overriding to it breaks samples/vue/quickstart's production build: esbuild 0.28 dropped
    # object-destructuring transform support for the sample's configured legacy browser targets
    # (chrome87/edge88/firefox78/safari14). Revisit once esbuild backports the fix to 0.27.x or
    # the sample's target list is modernized.
    - GHSA-g7r4-m6w7-qqqr

catalog:
  '@emotion/css': 11.13.5
  '@floating-ui/react': 0.27.12
  '@playwright/test': 1.60.0
  '@testing-library/react': 16.3.0
  '@thunderid/eslint-plugin': 1.0.0
  '@thunderid/prettier-config': 1.0.0
  '@types/node': 24.7.2
  '@types/react': 19.2.14
  '@types/react-dom': 19.2.3
  '@vitest/browser-playwright': 4.1.10
  base64url: 3.0.1
  buffer: 6.0.3
  core-js: 3.42.0
  cross-fetch: 4.1.0
  dompurify: 3.4.13
  eslint: 9.39.4
  fast-sha256: 1.3.0
  jose: 6.2.3
  jsdom: 27.0.1
  memory-cache: 0.2.0
  playwright: 1.60.0
  prettier: 3.6.2
  process: 0.11.10
  randombytes: 2.1.0
  react: 19.2.3
  react-dom: 19.2.3
  react-router: 7.18.2
  rimraf: 6.1.3
  rolldown: 1.0.0-beta.45
  secure-random-bytes: 5.0.1
  stream-browserify: 3.0.0
  tslib: 2.8.1
  typescript: 5.9.3
  uuid: 11.1.1
  vitest: 4.1.10

minimumReleaseAgeExclude:
  - '@thunderid/*'