91 lines
2.7 KiB
YAML
91 lines
2.7 KiB
YAML
packages:
|
|
- platform/*
|
|
- extensions/*
|
|
- modes/*
|
|
|
|
# Mirror the cornerstone3D pnpm setup (libs/@cornerstonejs) which is known-good.
|
|
nodeLinker: hoisted
|
|
strictPeerDependencies: false
|
|
linkWorkspacePackages: true
|
|
preferWorkspacePackages: true
|
|
minimumReleaseAge: 2880
|
|
# Exempt the cornerstone3D packages from the release-age check: they are pinned
|
|
# to an exact version (5.0.0) that may be newer than the cutoff. Mirrors the
|
|
# bunfig.toml `minimumReleaseAgeExcludes` list (pnpm supports glob patterns).
|
|
minimumReleaseAgeExclude:
|
|
- '@cornerstonejs/*'
|
|
frozenLockfile: true
|
|
|
|
# Skip the pre-`pnpm run` frozen deps-check; installs set freshness explicitly.
|
|
verifyDepsBeforeRun: false
|
|
|
|
# Equivalent of the bun `audit --ignore=...` flags. These GHSAs are accepted
|
|
# risk: minimatch/picomatch advisories reached only via build/CI tooling, never
|
|
# fed user-supplied expressions. Kept in sync with the .circleci SECURITY_AUDIT
|
|
# job and the root `audit` script.
|
|
auditConfig:
|
|
ignoreGhsas: []
|
|
|
|
allowBuilds:
|
|
'@scarf/scarf': true
|
|
'@swc/core': true
|
|
core-js: true
|
|
core-js-pure: true
|
|
cypress: true
|
|
protobufjs: true
|
|
sharp: true
|
|
overrides:
|
|
# Synced from origin/master's package.json `resolutions` block during the
|
|
# merge. Keep this list aligned with master so security/version pins from
|
|
# upstream PRs land here too.
|
|
commander: 8.3.0
|
|
cross-env: 7.0.3
|
|
cross-spawn: 7.0.6
|
|
dcmjs: 0.49.4
|
|
path-to-regexp: 0.1.13
|
|
nth-check: 2.1.1
|
|
trim-newlines: 5.0.0
|
|
glob-parent: 6.0.2
|
|
trim: 1.0.1
|
|
package-json: 8.1.1
|
|
rollup: 2.80.0
|
|
body-parser: 1.20.3
|
|
axios: 1.17.0
|
|
core-js: 3.45.1
|
|
'@babel/runtime-corejs2': 7.26.10
|
|
tapable: 2.2.2
|
|
'@cornerstonejs/codec-openjpeg': 1.3.0
|
|
node-forge: 1.4.0
|
|
qs: 6.14.1
|
|
lodash: 4.18.1
|
|
lodash-es: 4.18.1
|
|
diff: 5.2.2
|
|
webpack: 5.105.0
|
|
tar: 7.5.11
|
|
serialize-javascript: 7.0.4
|
|
svgo: 3.3.3
|
|
flatted: 3.4.2
|
|
handlebars: 4.7.9
|
|
protobufjs: 7.6.1
|
|
tmp: 0.2.7
|
|
shell-quote: 1.8.4
|
|
# fast-uri <=3.1.1 reaches the tree only via platform/docs
|
|
# (@docusaurus/plugin-pwa > workbox-build > ajv). 3.1.2 patches both
|
|
# GHSA-q3j6-qgpj-74h6 (path traversal) and GHSA-v39h-62p7-jpjc (host confusion).
|
|
fast-uri: 3.1.2
|
|
'@babel/plugin-transform-modules-systemjs': 7.29.4
|
|
# pnpm-branch-only overrides (kept across merges from master).
|
|
sharp: 0.34.5
|
|
# Force a single modern tslib for the whole workspace. Without this, rxjs@6
|
|
# pulls in tslib@1, which gets hoisted to root node_modules and shadows the
|
|
# tslib@2 that modern packages (e.g. react-remove-scroll) need for
|
|
# __spreadArray.
|
|
tslib: 2.8.1
|
|
'ws@>=7.0.0 <7.5.11': 7.5.11
|
|
'ws@>=8.0.0 <8.21.0': 8.21.0
|
|
form-data: 4.0.6
|
|
'minimatch@<3.1.4': 3.1.5
|
|
'minimatch@>=10.0.0 <10.2.3': 10.2.5
|
|
'picomatch@<2.3.2': 2.3.2
|
|
'picomatch@>=4.0.0 <4.0.4': 4.0.4
|