pnpm-workspace.yaml

packages:
  - src
  - admin
  - bin
  - doc
  - ui
allowBuilds:
  '@scarf/scarf': set this to true or false
  esbuild: set this to true or false
# Explicitly ignore build scripts we don't want to run. Listing them here
# stops pnpm from failing with ERR_PNPM_IGNORED_BUILDS when they're
# encountered as transitive deps (e.g. scarf pulled in via swagger-ui-dist).
ignoredBuiltDependencies:
  - '@scarf/scarf'
onlyBuiltDependencies:
  - esbuild
# Belt-and-suspenders: even if a fresh transitive dep slips through with a
# postinstall script, downgrade to a warning so CI doesn't break for
# downstream plugin repos that pull etherpad-lite as their core install.
strictDepBuilds: false
# As of pnpm 11, overrides must live here (root package.json's pnpm.overrides
# is no longer read). Force-bump transitive deps with known CVEs.
overrides:
  basic-ftp: '>=5.3.0'
  brace-expansion@>=2.0.0 <2.0.3: '>=2.0.3'
  diff@>=6.0.0 <8.0.3: '>=8.0.3'
  flatted: '>=3.4.2'
  follow-redirects: '>=1.16.0'
  glob@>=10.2.0 <10.5.0: '>=10.5.0'
  js-yaml@>=4.0.0 <4.1.1: '>=4.1.1'
  lodash: '>=4.18.0'
  minimatch@>=9.0.0 <9.0.7: '>=9.0.7'
  path-to-regexp@>=8.0.0 <8.4.0: '>=8.4.0'
  picomatch@>=4.0.0 <4.0.4: '>=4.0.4'
  qs@>=6.7.0 <6.14.2: '>=6.14.2'
  serialize-javascript@<7.0.5: '>=7.0.5'
  socket.io-parser@>=4.0.0 <4.2.6: '>=4.2.6'
  tar@<7.5.11: '>=7.5.11'
  uuid@<14.0.0: '>=14.0.0'
  vite@>=7.0.0 <7.3.2: '>=7.3.2'