pnpm-workspace.yaml

allowBuilds:
  '@vscode/vsce-sign': true
  esbuild: true
  keytar: false

ignoredBuiltDependencies:
  - keytar

onlyBuiltDependencies:
  - '@vscode/vsce-sign'
  - esbuild

overrides:
  underscore: '>=1.13.8'
  markdown-it: '>=14.2.0'
  linkify-it: '>=5.0.2 <7'
  test-exclude>minimatch: '>=10.2.1'
  qs: '>=6.15.2'
  rollup: '>=4.59.0'
  '@typescript-eslint/typescript-estree>minimatch': '>=9.0.7'
  minimatch>brace-expansion: '>=5.0.8'
  postcss: '>=8.5.18'
  nanoid: '>=3.3.17'
  uuid: '>=11.1.1'
  serialize-javascript: '>=7.0.5'
  # Exact pin (intentional): the patched ajv (>=8.18.0) drops the
  # `missingRefs` option that @eslint/eslintrc depends on, which crashes
  # ESLint. See the matching [[IgnoredVulns]] entry for GHSA-2g4f-4pwh-qvx6
  # in osv-scanner.toml for the full rationale.
  eslint>ajv: 6.15.0
  flatted: '>=3.4.2'
  anymatch>picomatch: 4.0.5
  readdirp>picomatch: 4.0.5
  micromatch>picomatch: 4.0.5
  tinyglobby>picomatch: 4.0.5
  vite>picomatch: 4.0.5
  vitest>picomatch: 4.0.5
  mocha>diff: '>=8.0.3'
  '@textlint/linter-formatter>lodash': '>=4.18.0'
  # >=8.9.0 closes the GHSA-4cwx-7wf7-3272 (high) family of undici
  # advisories pulled in transitively via @vscode/vsce>cheerio. >=8.5.0
  # was insufficient — it accepted the vulnerable 8.5.0 itself.
  undici: '>=8.9.0'
  fast-uri: '>=4.1.1'
  tmp: '>=0.2.6'
  esbuild: '>=0.28.1'
  form-data: '>=4.0.6'
  js-yaml: '>=4.3.0'
  '@babel/core': '>=7.29.6'
  # Force a single version of each CodeMirror package across the workspace.
  # `@codemirror/commands` and `@codemirror/legacy-modes` declare older
  # ranges for these peer deps, which causes pnpm to keep duplicate copies
  # and breaks TypeScript structural typing (TS2345: "Types have separate
  # declarations of a private property ...").
  '@codemirror/language': 6.12.4
  '@codemirror/state': 6.7.1
  '@codemirror/view': 6.43.6