nicktrn
706a0b88c9
## Summary - Upgrade pnpm from 10.23.0 → 10.33.2 (latest minor) - Enable `blockExoticSubdeps: true` for supply-chain defense - Update all version references across the repo ## Security improvements in 10.28.2+ - Path traversal protection in `directories.bin` - Symlink-escape protection for `file:/git:` dependencies (prevents reading `/etc/passwd`, `~/.ssh/...`) - https://pnpm.io/settings#blockexoticsubdeps ## Files updated - `package.json` — `packageManager` field - `docker/Dockerfile` — 5 `corepack prepare` calls - `apps/supervisor/Containerfile` — 1 `corepack prepare` call - `pnpm-workspace.yaml` — added `blockExoticSubdeps: true` - `CLAUDE.md`, `AGENTS.md`, `CONTRIBUTING.md`, `ai/references/repo.md` — version references ## Verification - `pnpm install --frozen-lockfile` succeeds (no lockfile regen needed) - `pnpm install` (plain) produces zero lockfile diff - All CI checks pass Slack thread: https://triggerdotdev.slack.com/archives/C061L2MHW93/p1777625600974279?thread_ts=1777622248.762639&cid=C061L2MHW93 https://claude.ai/code/session_01G759MUqmjsPh9k1qDxbdjG --------- Co-authored-by: Claude <noreply@anthropic.com>
23 lines
413 B
YAML
23 lines
413 B
YAML
packages:
|
|
- "packages/*"
|
|
- "internal-packages/*"
|
|
- "apps/**"
|
|
- "references/*"
|
|
- "docs"
|
|
- "!packages/cli-v3/e2e/**"
|
|
|
|
minimumReleaseAge: 4320
|
|
minimumReleaseAgeExclude:
|
|
- "@trigger.dev/platform"
|
|
- "next"
|
|
- "@next/*"
|
|
- "agentcrumbs"
|
|
preferOffline: true
|
|
|
|
linkWorkspacePackages: false
|
|
publicHoistPattern:
|
|
- "*prisma*"
|
|
preferWorkspacePackages: true
|
|
sideEffectsCache: false
|
|
blockExoticSubdeps: true
|