next.js/pnpm-workspace.yaml at canary · vercel/next.js · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
packages:
  - 'apps/*'
  - 'packages/*'
  - 'bench/*'
  - 'crates/*/js'
  - 'turbopack/crates/*/js'
  - 'turbopack/crates/turbopack-tests/tests/execution'
updateNotifier: false
linkWorkspacePackages: true
saveExact: true
provenance: true
tagVersionPrefix: ''
# pnpm 11+ defaults this to `install`, which makes `pnpm run` (including the
# script invocations turbo makes) install dependencies first if it considers
# them stale. CI jobs that only run Rust tasks intentionally skip the install.
# TODO: Fix the CI jobs, and remove this line.
verifyDepsBeforeRun: false
publicHoistPattern:
  - '*eslint*'
allowBuilds:
  '@ast-grep/cli': true
  '@datadog/native-appsec': false
  '@datadog/native-metrics': false
  '@datadog/pprof': false
  '@swc/core': false
  '@tailwindcss/oxide': false
  core-js: false
  cpu-features: false
  dd-trace: false
  esbuild: false
  msw: false
  nx: false
  playwright-chromium: false
  protobufjs: false
  sharp: false
  ssh2: false
  unrs-resolver: false
  wasm-pack: false

# - Keep security related settings in sync with pnpm-workspace.yaml written to
#   temporary fixture dirs in `file://./scripts/install-native.mjs`
# - `file://./test/lib/pnpm-security-settings.js` reads and copies these values for
#   isolated test dirs
blockExoticSubdeps: true
minimumReleaseAge: 2880 # 48 hrs
minimumReleaseAgeExclude:
  - '@mswjs/interceptors@0.42.6'
  - '@next/*'
  - '@turbo/*'
  - '@types/react@19.2.18'
  - '@types/react-dom@19.2.4'
  - '@vercel/*'
  - '@workflow/*'
  - babel-plugin-react-compiler
  - httpxy@0.5.5
  - next
  - react
  - react-dom
  - react-is
  - react-server-dom-*
  - satori@0.33.5
  - scheduler
  - turbo

# Caution: `file://./scripts/sync-react.js` updates the React entries in place using a regex as part
# of a GH Action. If you update this section, make sure you also update that script.
overrides:
  postcss: 8.5.23
  webpack: 5.98.0
  browserslist: 4.28.1
  caniuse-lite: 1.0.30001746
  '@types/node': 20.17.7
  '@babel/core': 7.26.10
  '@babel/parser': 7.27.0
  '@babel/types': 7.27.0
  '@babel/traverse': 7.27.0
  '@types/react': 19.2.18
  '@types/react-dom': 19.2.4
  '@types/retry': 0.12.0
  jest-snapshot: 30.0.0-alpha.6
  react: 'npm:react@19.3.0-canary-ba39b32a-20261019'
  react-dom: 'npm:react-dom@19.3.0-canary-ba39b32a-20261019'
  react-is: 'npm:react-is@19.3.0-canary-ba39b32a-20261019'
  scheduler: 'npm:scheduler@0.28.0-canary-ba39b32a-20261019'

packageExtensions:
  # alex requires supports-color from its CLI but does not declare it. v9 is ESM-only.
  alex@9.1.0:
    dependencies:
      supports-color: 8.1.1
  eslint-plugin-react-hooks@0.0.0-experimental-6de32a5a-20250822:
    dependencies:
      '@babel/plugin-proposal-private-methods': ^7.18.6

patchedDependencies:
  webpack-sources@3.2.3: patches/webpack-sources@3.2.3.patch
  stacktrace-parser@0.1.10: patches/stacktrace-parser@0.1.10.patch
  taskr@1.1.0: patches/taskr@1.1.0.patch
  minizlib@3.1.0: patches/minizlib@3.1.0.patch
  '@rspack/core@1.6.7': patches/@rspack__core@1.6.7.patch
  '@modelcontextprotocol/sdk': patches/@modelcontextprotocol__sdk.patch
  '@vercel/blob': patches/@vercel__blob.patch
  postcss-scss: patches/postcss-scss.patch
  playwright-core@1.61.0: patches/playwright-core@1.61.0.patch
  '@types/node@20.17.7': patches/@types__node@20.17.7.patch
  '@vercel/agent-eval@2.2.1': patches/@vercel__agent-eval@2.2.1.patch
  '@vercel/og@1.0.1': patches/@vercel__og@1.0.1.patch