-
-
Notifications
You must be signed in to change notification settings - Fork 5
Expand file tree
/
Copy pathpnpm-workspace.yaml
More file actions
43 lines (41 loc) · 2.09 KB
/
Copy pathpnpm-workspace.yaml
File metadata and controls
43 lines (41 loc) · 2.09 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
packages:
- "pkg/@eserstack/*"
allowBuilds:
# false: its only install script is `prepare: node scripts/prepare.js`, but
# scripts/ is not shipped in the published tarball -- that entry is a leftover
# from the source repo. dist/ ships prebuilt and the package imports fine
# (162 exports) with the script never run. Nothing native to compile.
"@google/genai": false
esbuild: true
koffi: true
protobufjs: false
sharp: true
# pnpm 11 enables a default minimum-release-age supply-chain gate that refuses to
# lock just-published versions — which breaks this repo's own pattern of
# publishing the @eserstack/ajan-* platform packages and immediately locking
# them. The current-platform package is dropped even when listed in
# minimumReleaseAgeExclude, so the gate is disabled here (0) rather than excluded.
minimumReleaseAge: 0
# Deno has the same gate (24h by default) and it bit `deno compile` in the
# v4.5.2 release run on a one-day-old @google/genai; deno.json sets
# minimumDependencyAge: 0 for the same reason.
# This repo pulls unusually large platform binaries -- @eserstack/ajan-wasm is
# ~22 MB and sharp's libvips ~8 MB. pnpm's default fetchTimeout is 60s and it does NOT resume partial
# downloads, so on an ordinary connection those tarballs abort mid-transfer
# (error 23) and every retry restarts from zero -- the install never converges.
#
# 10 minutes per request, and fewer parallel sockets so a 75 MB tarball gets
# real bandwidth instead of competing with 16 concurrent small ones.
fetchTimeout: 600000
fetchRetries: 5
networkConcurrency: 6
# Vulnerability-scoped overrides (Dependabot GHSA-g6gw-c38x-mqfc, GHSA-gqvv-2mrq-wpjv,
# GHSA-crvj-82cr-hjcx, GHSA-4mjr-xmp4-gh2g, GHSA-x5fp-wj9c-mxmx, GHSA-jqff-g426-hqxp and
# friends). These are transitive deps (hono via @modelcontextprotocol/sdk and
# @hono/node-server, qs via express/body-parser, fast-uri via ajv); the scoped
# form only rewrites the vulnerable range, so once every dependent moves past
# it the override is inert and can be dropped.
overrides:
"hono@<4.13.5": "^4.13.5"
"qs@<6.16.0": "^6.16.0"
"fast-uri@<3.1.6": "^3.1.6"