pnpm-workspace.yaml

packages:
  - packages/*
  # The six per-platform binary packages for @cipherstash/protect-ffi. The
  # `packages/*` glob above already covers the wrapper itself; these are nested
  # a level deeper and need their own entry.
  - packages/protect-ffi/platforms/*
  # @cipherstash/eql, from the encrypt-query-language subtree. The subtree is
  # imported at a VERBATIM prefix so its repo-root-relative paths keep resolving
  # (mise tasks, Doxyfile, sync-generated.mjs), which puts the npm package two
  # levels down. `packages/*` matches the subtree ROOT, which carries no
  # package.json by design — the private @cipherstash/eql-workspace manifest was
  # deleted so this glob contributes exactly one member.
  - packages/eql/packages/*
  # The protect-ffi live integration suite. Nested a level deeper than
  # `packages/*` reaches, like the two entries above, and named literally
  # rather than globbed because `packages/protect-ffi/*` would also select
  # `crates/`, `docs/`, `lib/`, `scripts/` and `src/` — directories with no
  # package.json, which pnpm rejects rather than skips.
  #
  # It kept its own `package-lock.json` and installed with `npm ci` until
  # CIP-3744. That was the last registry pin of `@cipherstash/eql` in the tree:
  # the suite's `tests/postgres-v3.test.ts` queried SQL installed from the
  # published bundle while the payloads under test came from the in-tree
  # `eql-bindings` — exactly the skew the subtree import exists to make
  # unrepresentable.
  - packages/protect-ffi/integration-tests
  - examples/*
  - e2e

catalogs:
  repo:
    # @cipherstash/auth ships per-platform native bindings as optional
    # peerDependencies. pnpm does not auto-install platform-matched
    # optional peer deps, so the consuming packages (stack, cli, wizard)
    # declare them as `optionalDependencies` via `catalog:repo`.
    #
    # LOCKSTEP IS LOAD-BEARING, not tidiness: auth pins its bindings as
    # EXACT-version optional peer deps, so a skewed set makes npm nest
    # per-consumer binding copies that the hoisted auth package cannot
    # resolve — every project-local install of the CLI/SDK then dies with
    # "Failed to load native binding" (the 1.0.0-rc.2 B1 bug). Enforced by
    # e2e/tests/supply-chain.e2e.test.ts; Dependabot ignores all seven
    # names — bump them together, manually.
    '@cipherstash/auth': 0.44.0
    '@cipherstash/auth-darwin-arm64': 0.44.0
    '@cipherstash/auth-darwin-x64': 0.44.0
    '@cipherstash/auth-linux-arm64-gnu': 0.44.0
    '@cipherstash/auth-linux-x64-gnu': 0.44.0
    '@cipherstash/auth-linux-x64-musl': 0.44.0
    '@cipherstash/auth-win32-x64-msvc': 0.44.0
    '@types/node': 22.20.1
    tsup: 8.5.1
    tsx: 4.23.12
    typescript: 5.9.3
    vitest: 3.2.7
    # Must track `vitest` exactly: the coverage provider is versioned in
    # lockstep with the runner, and vitest refuses to start against a mismatched
    # one ("Vitest failed to load @vitest/coverage-v8"). Catalogued for the same
    # reason the auth bindings are, and enforced the same way — by a test rather
    # than by this comment: see `e2e/tests/supply-chain.e2e.test.ts`. Dependabot
    # groups both under `dev-dependencies` and will otherwise move one alone.
    '@vitest/coverage-v8': 3.2.7
  security:
    '@clerk/nextjs': 7.7.7
    next: 15.5.23
    vite: 8.2.1

# Security overrides for Dependabot alerts on transitive deps that Dependabot
# cannot PR against (it only PRs direct dependencies). Each selector is scoped
# to the advisory's vulnerable range, and each entry names its alert + advisory
# so it can be retired once the parent dependency moves past the range.
# NOTE: pnpm only reads overrides from here (or package.json `pnpm.overrides`);
# a top-level npm-format `overrides` block is silently ignored.
#
# Related, but NOT fixable as an override: @anthropic-ai/sdk (alert #128,
# GHSA-p7fg-763f-g4gf) is an auto-installed *peer* of claude-agent-sdk, and
# pnpm overrides rewrite peer ranges, not peer resolutions. It is fixed by an
# explicit dependency in packages/wizard — that dep is a peer-resolution pin
# (wizard never imports the sdk directly); do not remove it as "unused".
overrides:
  # #96, #115-#127 — Next.js middleware bypass / SSRF / DoS / XSS batch
  # (GHSA-267c-6grr-h53f, GHSA-26hh-7cqf-hhc6, GHSA-36qx-fr4f-26g5, et al.)
  'next@<15.5.18': '~15.5.18'
  # #87 GHSA-f23m-r3pf-42rh, #88 GHSA-r5fr-rjxr-66jc — lodash _.unset / _.template
  'lodash@<4.18.0': '^4.18.0'
  # #133 GHSA-qjx8-664m-686j — js-cookie attribute injection
  'js-cookie@<3.0.7': '^3.0.7'
  # #102 GHSA-qx2v-qp2m-jg93 — postcss XSS via unescaped </style>
  # #167 GHSA-r28c-9q8g-f849 / CVE-2026-73646 (HIGH) — path traversal reading
  # arbitrary .map files via attacker-controlled sourceMappingURL when `from`
  # is unset. #176 GHSA-fxqj-rqcc-2cmp / CVE-2026-69153 is its incomplete-fix
  # follow-up (patched 8.5.23).
  #
  # THE SELECTOR IS THE LESSON. `postcss@<8.5.10` stopped matching once the tree
  # resolved 8.5.14, so the override went inert and a vulnerable version
  # installed with the entry still sitting here looking like a fix. Keep the
  # ceiling AHEAD of the patched floor, not at it.
  'postcss@<8.5.26': '^8.5.26'
  # #145 GHSA-fx2h-pf6j-xcff, #146 GHSA-v6wh-96g9-6wx3 — vite dev server (Windows)
  'vite@>=7.0.0 <7.3.5': '~7.3.5'
  # #142 GHSA-g7r4-m6w7-qqqr — esbuild dev server. 0.28.1 is the FIRST patched
  # release and sits outside tsup@8.5.1's declared ^0.27.0 (esbuild 0.x minors
  # are breaking). Exercised builds pass; retire by bumping tsup once a release
  # declares ^0.28.
  'esbuild@>=0.27.3 <0.28.1': '^0.28.1'
  # GHSA-3jxr-9vmj-r5cp / CVE-2026-13149 (exponential-time expand(), fix
  # >=5.0.7), GHSA-mh99-v99m-4gvg / CVE-2026-14257 (unbounded expansion length
  # OOM, fix >=5.0.8), GHSA-rgw5-rvv9-x895 / CVE-2026-69152 (fix >=5.0.9) — all
  # three land on the same transitive dep (rimraf>glob>minimatch>brace-expansion).
  # Pinned to the matured 5.0.9 (published 2026-07-30) to close all three at
  # once rather than leaving two open after only clearing the first.
  'brace-expansion@<5.0.9': '5.0.9'
  # #153 GHSA-h67p-54hq-rp68 / CVE-2026-53550 — js-yaml merge-key DoS, 3.x line.
  # #189 GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 (HIGH) — quadratic-CPU DoS in
  # `!!omap` duplicate-key detection; patched in 3.15.1.
  #
  # The previous `<3.15.0` selector had been overtaken by its own fix: the tree
  # resolved exactly 3.15.0, so nothing matched and nothing lifted it to 3.15.1.
  # Reached only through `read-yaml-file`.
  'js-yaml@<3.15.1': '3.15.1'
  # #152 GHSA-h67p-54hq-rp68 / CVE-2026-53550 — js-yaml merge-key DoS, 4.x line.
  # #155 GHSA-52cp-r559-cp3m / CVE-2026-59869 (HIGH, patched 4.3.0) and
  # #188 GHSA-5p4m-2wfm-xmqj / CVE-2026-59870 (HIGH, patched 4.3.1).
  #
  # THIS ENTRY WAS ENFORCING THE VULNERABILITY. Unlike the two overtaken
  # selectors above, `>=4.0.0 <5` kept matching — so an exact pin written to FIX
  # an advisory was holding the tree at 4.2.0 and blocking 4.3.1. An exact pin
  # inside a still-matching range is the worst of the three shapes: it cannot
  # self-heal and it cannot be fixed by Dependabot.
  #
  # The "a past js-yaml upgrade broke changesets" caution is DISCHARGED for this
  # bump, checked rather than assumed: @changesets/parse declares
  # `js-yaml: ^4.1.1`, which 4.3.1 satisfies; 4.2.0 and 4.3.1 have identical
  # `dependencies` (argparse ^2.0.1) and `exports`, no `engines`, no `main`;
  # 4.3.0/4.3.1 are security backports only (a `maxTotalMergeKeys` loader option
  # and the `!!omap` fix), with no API removal on the 4.x line. The breaking
  # churn — grouped constant exports, `MERGE_KEY` removal, mandatory `identify`
  # — is all on 5.x, which the `<5` ceiling already excludes. Verified after the
  # bump with `changeset status` and a `changeset version` dry run.
  #
  # Kept exact so a future 4.x regression cannot arrive silently; the ceiling
  # stays `<5`. Consumers: @changesets/parse and json-schema-to-typescript.
  'js-yaml@>=4.0.0 <5': '4.3.1'
  # Cooldown-regression guard AND two live advisories. Re-resolving the lockfile
  # let minimumReleaseAge demote ajv's fast-uri to 3.1.2, un-fixing
  # GHSA-4c8g-83qw-93j6 / CVE-2026-13676 (host confusion via failed IDN
  # canonicalization) — hence a pin rather than a floor.
  #
  # But 3.1.3 was itself overtaken: #158 (HIGH) needs 3.1.4 and #175 (HIGH)
  # needs 3.1.5, so the exact pin was enforcing a vulnerable version — the same
  # shape as the js-yaml 4.x entry above. Reached through ajv.
  'fast-uri@<3.1.5': '3.1.5'
  # GHSA-f88m-g3jw-g9cj — sharp's vendored libvips carries multiple High
  # libvips CVEs (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590,
  # CVE-2026-35591), fixed >=0.35.0. Pulled in as an optional dependency of
  # next (image optimization), not a direct dependency. Pinned to the matured
  # 0.35.0 (published 2026-06-10).
  'sharp@<0.35.0': '0.35.0'

# Supply-chain hardening — see skills/stash-supply-chain-security/
# 7 days in minutes; mirrors the Dependabot cooldown so manual + automated
# updates have the same community-discovery window.
minimumReleaseAge: 10080
# Forbid git/tarball deps anywhere in the lockfile (pnpm ≥ 10.26).
blockExoticSubdeps: true
# Excluded from the 7-day cooldown: first-party packages we publish or
# integrate against directly. These ship on their own release cadence and
# are not exotic deps.
#   - @prisma/orm-*, prisma-next  first-party Prisma packages the integration is
#                                 built against (the 0.17 publish surface; the
#                                 retired @prisma-next/* scope is kept for
#                                 historical installs while anything still pins
#                                 0.16)
#   - @cipherstash/auth*         CipherStash-published auth strategies (NAPI +
#                                 WASM-inline variant); also tracked in lockstep
#                                 with protect-ffi for the WASM path.
#
# @cipherstash/eql was listed here until the encrypt-query-language subtree
# landed. It is now a workspace package, so no pnpm install ever resolves it
# from the registry and the entry became dead config. The last holdout was
# packages/protect-ffi/integration-tests, which pinned it by version and
# installed with `npm ci` — outside pnpm entirely, so minimumReleaseAge never
# applied there either. That directory is a workspace member as of CIP-3744 and
# resolves `workspace:^`, so there is now nothing in the tree that could.
minimumReleaseAgeExclude:
  - '@prisma-next/*'
  - '@prisma/orm-*'
  - 'prisma-next'
  - '@cipherstash/auth'
  - '@cipherstash/auth-*'