github-featured/triggerdotdev--trigger.dev

Files

T

nicktrn 706a0b88c9 chore: upgrade pnpm to 10.33.2 with security hardening (#3489 )

## Summary

- Upgrade pnpm from 10.23.0 → 10.33.2 (latest minor)
- Enable `blockExoticSubdeps: true` for supply-chain defense
- Update all version references across the repo

## Security improvements in 10.28.2+

- Path traversal protection in `directories.bin`
- Symlink-escape protection for `file:/git:` dependencies (prevents
reading `/etc/passwd`, `~/.ssh/...`)
- https://pnpm.io/settings#blockexoticsubdeps

## Files updated

- `package.json` — `packageManager` field
- `docker/Dockerfile` — 5 `corepack prepare` calls
- `apps/supervisor/Containerfile` — 1 `corepack prepare` call
- `pnpm-workspace.yaml` — added `blockExoticSubdeps: true`
- `CLAUDE.md`, `AGENTS.md`, `CONTRIBUTING.md`, `ai/references/repo.md` —
version references

## Verification

- `pnpm install --frozen-lockfile` succeeds (no lockfile regen needed)
- `pnpm install` (plain) produces zero lockfile diff
- All CI checks pass

Slack thread:
https://triggerdotdev.slack.com/archives/C061L2MHW93/p1777625600974279?thread_ts=1777622248.762639&cid=C061L2MHW93

https://claude.ai/code/session_01G759MUqmjsPh9k1qDxbdjG

---------

Co-authored-by: Claude <noreply@anthropic.com>

2026-05-01 16:24:26 +01:00

2.8 KiB

Raw Blame History

Guidance for Coding Agents

This repository is a pnpm monorepo managed with Turbo. It contains multiple apps and packages that make up the Trigger.dev platform and SDK.

Repository layout

apps/webapp – Remix application that serves as the main API and dashboard.
apps/supervisor – Node application for executing built tasks.
packages/* – Published packages such as @trigger.dev/sdk, the CLI (trigger.dev), and shared libraries.
internal-packages/* – Internal-only packages used by the webapp and other apps.
references/* – Example projects for manual testing and development of new features.
ai/references – Contains additional documentation including an overview (repo.md) and testing guidelines (tests.md).

See ai/references/repo.md for a more complete explanation of the workspaces.

Development setup

Install dependencies with pnpm i (pnpm 10.33.2 and Node.js 20.20.0 are required).
Copy .env.example to .env and generate a random 16 byte hex string for ENCRYPTION_KEY (openssl rand -hex 16). Update other secrets if needed.
Start the local services with Docker:
```
pnpm run docker
```
Run database migrations:
```
pnpm run db:migrate
```

Build the webapp, CLI and SDK packages:

pnpm run build --filter webapp && pnpm run build --filter trigger.dev && pnpm run build --filter @trigger.dev/sdk

Launch the development server:
```
pnpm run dev --filter webapp
```
The webapp runs on http://localhost:3030.

For full setup instructions see CONTRIBUTING.md.

Running tests

Unit tests use vitest. Run all tests:
```
pnpm run test
```
Run tests for a specific workspace (example for webapp):
```
pnpm run test --filter webapp
```
Prefer running a single test file from within its directory:
```
cd apps/webapp
pnpm run test ./src/components/Button.test.ts
```
If packages in that workspace need to be built first, run pnpm run build --filter webapp.

Refer to ai/references/tests.md for details on writing tests. Tests should avoid mocks or stubs and use the helpers from @internal/testcontainers when Redis or Postgres are needed.

Coding style

Formatting is enforced using Prettier. Run pnpm run format before committing.
Follow the existing project conventions. Test files live beside the files under test and use descriptive describe and it blocks.
Do not commit directly to the main branch. All changes should be made in a separate branch and go through a pull request.

Additional docs

The root README.md describes Trigger.dev and links to documentation.
The docs workspace contains our documentation site, which can be run locally with:
```
pnpm run dev --filter docs
```
references/README.md explains how to create new reference projects for manual testing.

2.8 KiB Raw Blame History Unescape Escape