mirror of
https://github.com/vercel/workflow.git
synced 2026-09-14 19:59:43 +08:00
Nathan Colosimo
7a46a81a53
Co-authored-by: VaguelySerious <mittgfu@gmail.com> Co-authored-by: Peter Wielander <peter.wielander@vercel.com>
91 lines
2.7 KiB
YAML
91 lines
2.7 KiB
YAML
packages:
|
|
- workbench/*
|
|
- "!workbench/nitro"
|
|
- packages/*
|
|
- docs
|
|
- tarballs
|
|
|
|
catalog:
|
|
"@biomejs/biome": ^2.4.4
|
|
"@swc/core": 1.15.3
|
|
"@types/json-schema": ^7.0.15
|
|
"@types/node": 22.19.0
|
|
"@vercel/functions": ^3.8.0
|
|
"@vercel/oidc": 3.2.0
|
|
"@vercel/queue": 0.5.0
|
|
"@vitest/coverage-v8": ^4.1.10
|
|
"@vitest/runner": ^4.1.10
|
|
ai: 6.0.116
|
|
enhanced-resolve: 5.19.0
|
|
esbuild: ^0.28.1
|
|
nitro: ^3.0.260610-beta
|
|
semver: 7.7.4
|
|
typescript: ^6.0.3
|
|
ulid: ~3.0.1
|
|
undici: 7.29.0
|
|
vitest: ^4.1.10
|
|
zod: ~4.5.4
|
|
|
|
overrides:
|
|
# `@vercel/queue` accepts any `@vercel/oidc` in the 3.x line, and 3.3+ pulls in
|
|
# `@vercel/cli-config`, whose `xdg-app-paths` dependency instantiates itself at
|
|
# module scope and throws `The "path" argument must be of type string` once a
|
|
# bundler inlines it. Pin the queue client's copy to the last dependency-free
|
|
# release so a bundled queue client keeps working.
|
|
'@vercel/queue>@vercel/oidc': 3.2.0
|
|
# Single @opentelemetry/api instance workspace-wide: with two resolved
|
|
# copies (1.9.0 + 1.9.1), the copy that registers the tracer provider and
|
|
# the copy a package imports can differ, and the API's global-registration
|
|
# version check then hands the importer a noop tracer — world-vercel's
|
|
# spans were silently dropped this way while core's flowed (#2900).
|
|
'@opentelemetry/api': 1.9.1
|
|
rfc6902: 5.1.2
|
|
devalue: 5.9.2
|
|
'@sveltejs/acorn-typescript': 1.0.10
|
|
# postcss < 8.5.18 is vulnerable to CVE-2026-45623 and GHSA-r28c-9q8g-f849
|
|
# (arbitrary file read / .map disclosure via attacker-controlled
|
|
# sourceMappingURL). Forces transitive pins (e.g. next.js's postcss@8.4.31)
|
|
# onto a patched version.
|
|
'postcss@<8.5.18': 8.5.22
|
|
|
|
savePrefix: ""
|
|
|
|
# Keep the lockfile single-document for tools such as Turborepo. CI installs
|
|
# the exact packageManager pin through pnpm/setup.
|
|
pmOnFail: ignore
|
|
|
|
# pnpm 11 requires Node.js 22 or newer. This replaces the two project-local
|
|
# engine-strict .npmrc files, which pnpm 11 no longer reads from repositories.
|
|
engineStrict: true
|
|
|
|
minimumReleaseAge: 2880
|
|
|
|
minimumReleaseAgeExclude:
|
|
- '@turbo/*'
|
|
- 'turbo'
|
|
- '@vercel/*'
|
|
- '@workflow/*'
|
|
- 'esbuild'
|
|
- '@esbuild/*'
|
|
- '@sveltejs/load-config'
|
|
- 'quickjs-wasi'
|
|
- 'devalue'
|
|
# The CI canary lanes pin `next` to a fresh canary at install time
|
|
# (see "Setup canary" in .github/workflows/tests.yml); canaries are
|
|
# usually younger than the 48h gate, and next and its @next/* companion
|
|
# packages (published in lockstep) are Vercel-published.
|
|
- 'next'
|
|
- '@next/*'
|
|
allowBuilds:
|
|
'@parcel/watcher': false
|
|
'@swc/core': false
|
|
'@tailwindcss/oxide': false
|
|
better-sqlite3: false
|
|
bun: false
|
|
cbor-extract: false
|
|
cpu-features: false
|
|
esbuild: true
|
|
protobufjs: false
|
|
sharp: false
|
|
ssh2: false
|