frontend/pnpm-workspace.yaml

Rama main · réplica de lectura del repositorio original.

peerDependencyRules:
  allowedVersions:
    typescript: '6'

catalog:
  dompurify: 3.4.17

overrides:
  # `@codingame/monaco-vscode-api` pins an exact dompurify version that lags
  # behind security patches (GHSA-55q2-fjhq-7xh7, fixed in 3.4.13), shipping a
  # second vulnerable copy in the Monaco bundle. The override forces every
  # transitive copy to the catalog version, which the direct dependency also
  # references, so the two can't drift apart again.
  dompurify: 'catalog:'

allowBuilds:
  # code-inspector-plugin v2 adds an optional "terminal mode" backed by the
  # node-pty native module (optionalDependency of @code-inspector/core).
  # We only use the click-to-open-in-IDE flow; both build scripts exist
  # solely for terminal mode — node-pty's node-gyp compile and core's
  # postinstall probe of that binding — and the plugin disables terminal
  # mode gracefully when node-pty is unavailable. Explicit `false` skips
  # the builds without triggering ERR_PNPM_IGNORED_BUILDS.
  '@code-inspector/core': false
  core-js: true
  esbuild: true
  # See the @code-inspector/core comment above.
  node-pty: false