pnpm-workspace.yaml

packages:
  - "packages/*"

# pnpm 11 defaults this to false, which means a dependency on a sibling package resolves from the npm registry even when the workspace holds a version satisfying the range — confirmed by direct install here before this setting existed: every internal edge landed in node_modules/.pnpm/<name>@<version> rather than symlinking to packages/<name>. That is not a monorepo; it is a set of independent packages sharing a directory, with turbo unable to see a single topological edge between them. Setting it true links a sibling whenever the declared range is satisfied by the workspace version, and falls back to the registry when it is not (see README.md on the ranges that still need reconciling).
linkWorkspacePackages: true

# Every setting below is carried over from the per-package pnpm-workspace.yaml files this one replaces, reconciled where they disagreed. pnpm reads workspace-level settings only from the workspace root, so a copy sitting in packages/<name>/ would be silently inert — the reconciliation is not a preference, it is the only place these can take effect.

# workerd (the Cloudflare Workers runtime @cloudflare/vitest-pool-workers drives the workers test suites through) and esbuild (its bundler) both ship native binaries installed via a postinstall script — pnpm 11 ignores those by default, so allow them explicitly. Union of every package's own list: every package with a workerd suite allowed both, the web UI allowed esbuild alone (it runs no such suite), and allowing a build script the web UI never triggers costs nothing.
allowBuilds:
  esbuild: true
  workerd: true

# 60 minutes, the value every package but byte-codec carried. byte-codec alone omitted it, deliberately keeping the stricter 7-day global default, but a single workspace cannot hold two values, and the strict default is the one that breaks: minimumReleaseAgeExclude is NOT honoured by `pnpm install --frozen-lockfile` (the mode CI runs) — pnpm's "verify an already-resolved lockfile" pass re-checks every entry's raw publish age against minimumReleaseAge with no exceptions (pnpm/pnpm#10361, #9997, #10438), so only minimumReleaseAge itself can unblock CI after a same-day release of an org-owned dependency. 60 keeps every third-party dependency behind an hour of public availability rather than disabling the freshness gate outright.
minimumReleaseAge: 60

# Bare package names (no @version), per pnpm's own documented syntax (https://pnpm.io/settings#minimumreleaseageexclude — "webpack" exempts every version, not just one). Union of every package's own list. The unscoped names are all workspace members now, which pnpm links locally rather than fetching, so their entries only matter while a member's declared range still resolves from the registry instead of the workspace (see the version-range note in README.md); the @exadev entries are org-owned packages published only by their own semantic-release CI with npm OIDC trusted publishing, so a version-agnostic exemption is a deliberate, low-risk carry-forward rather than an entry needing an edit on every release.
minimumReleaseAgeExclude:
  - archive-codec
  - byte-codec
  - doc-codec
  - document-cli
  - document-compute.js
  - document-mcp
  - document-operations
  - document-outline.js
  - document-rest
  - document-schema.js
  - documents.js
  - epub-codec
  - excel-number-format
  - markdown-codec
  - odf.js
  - ooxml.js
  - pdf-codec
  - pdf-raster-cpu
  - ppt-codec
  - rtf-codec
  - wpd-codec
  - xls-codec
  - "@exadev/eslint-config"
  - "@exadev/semantic-release-workspace"

# fast-uri < 3.1.5 is vulnerable to host confusion via a backslash authority introducer (GHSA-hht2-r2mx-9j9m). It is a transitive devDependency (ajv -> @commitlint/config-validator -> commitlint), several layers below anything declared directly, so there is no direct dependency to bump — only this override forces every resolution of it onto a patched version regardless of what commitlint's own dependency tree asks for. js-yaml carried the same treatment in documents.js's own file.
overrides:
  # fast-uri 3.1.6 patches the host-confusion/SSRF advisory batch (Dependabot alerts on the default branch); reached only transitively (ajv under workbox-build/vite-plugin-pwa and commitlint).
  fast-uri: 3.1.6
  # js-yaml 4.3.2 patches maxTotalMergeKeys not limiting CPU use for empty merge sources; reached only transitively (eslint's eslintrc and commitlint's cosmiconfig).
  js-yaml: 4.3.2
  # sharp 0.35.4 patches the libheif vulnerabilities (GHSA-g89c-p67h-r497, GHSA-2jg2-4ch7-h545); reached only transitively (miniflare under @cloudflare/vitest-pool-workers).
  sharp: 0.35.4
  # qs 6.11.1-6.15.1 crashes with a TypeError on null/undefined array entries when qs.stringify is called with encodeValuesOnly set (GHSA-q8mj-m7cp-5q26). Another transitive devDependency several layers below anything declared directly (typed-rest-client -> @stryker-mutator/core, which every package's own devDependencies pull in for mutation testing), so there is no direct dependency to bump either.
  qs: 6.15.2
  # release-workspace.config.json's generateNotes step uses the conventionalcommits preset, whose templates call a helper that only conventional-changelog-writer@9 or newer provides. @semantic-release/release-notes-generator depends on conventional-changelog-writer@^8, so without this the preset loads and then throws from inside handlebars at render time — the preset itself detects the too-old writer and registers a helper whose only job is to raise "requires conventional-changelog-writer@9 or newer". Scoped to release-notes-generator rather than global because it is the only consumer that renders with the writer at all: @semantic-release/commit-analyzer declares the same dependency but never imports it, using only the preset's whatBump.
  "@semantic-release/release-notes-generator>conventional-changelog-writer": 9.2.1

saveExact: true