opencode
186 lines
7.2 KiB
YAML
186 lines
7.2 KiB
YAML
# ============================================================================
|
|
# SECURITY: Minimum release age for npm packages (supply-chain attack defense)
|
|
# ============================================================================
|
|
#
|
|
# This setting requires that any npm package version must have been published
|
|
# for at least 1 day (1440 minutes) before pnpm will allow installing it.
|
|
# This is a critical defense against supply-chain attacks. In most cases,
|
|
# malicious npm releases are discovered and pulled within hours, so a 1-day
|
|
# delay provides a strong safety buffer.
|
|
#
|
|
# DO NOT DISABLE THIS SETTING. Removing or setting it to 0 is considered
|
|
# extremely dangerous and leaves the entire workspace vulnerable to supply-
|
|
# chain attacks, which have been the #1 vector for npm ecosystem compromises.
|
|
#
|
|
# If you absolutely need to install a package before the 1-day window has
|
|
# passed (e.g. an urgent security bugfix), you can add it to the
|
|
# `minimumReleaseAgeExclude` allowlist below. Only consider doing this for
|
|
# packages released by trusted organizations with an impeccable security
|
|
# posture (e.g. Replit packsges, react from Meta, typescript from Microsoft). Even then,
|
|
# remove the exclusion once the 1-day window has passed.
|
|
#
|
|
# Example:
|
|
# minimumReleaseAgeExclude:
|
|
# - react
|
|
# - typescript
|
|
#
|
|
# ============================================================================
|
|
minimumReleaseAge: 1440
|
|
|
|
supportedArchitectures:
|
|
os:
|
|
- current
|
|
- linux
|
|
cpu:
|
|
- current
|
|
- x64
|
|
|
|
minimumReleaseAgeExclude:
|
|
# Exclude @replit scoped packages from the minimum release age check.
|
|
# These are published by Replit and trusted — the supply-chain attack vector
|
|
# this setting guards against does not apply to our own packages.
|
|
- '@replit/*'
|
|
- stripe-replit-sync
|
|
|
|
packages:
|
|
- artifacts/*
|
|
- lib/*
|
|
- lib/integrations/*
|
|
- scripts
|
|
|
|
catalog:
|
|
'@replit/vite-plugin-cartographer': 0.6.1
|
|
'@replit/vite-plugin-dev-banner': 0.1.2
|
|
'@replit/vite-plugin-runtime-error-modal': 0.0.6
|
|
'@tailwindcss/vite': 4.3.3
|
|
'@tanstack/react-query': 5.101.4
|
|
'@tanstack/react-virtual': 3.14.9
|
|
'@types/node': 26.1.2
|
|
'@types/react': 19.2.18
|
|
'@types/react-dom': 19.2.4
|
|
'@vitejs/plugin-react': 6.0.5
|
|
class-variance-authority: 0.7.1
|
|
clsx: 2.1.1
|
|
dompurify: 3.4.12
|
|
drizzle-orm: 0.45.2
|
|
framer-motion: 12.43.0
|
|
lucide-react: 1.28.0
|
|
marked: 18.0.7
|
|
react: 19.2.8
|
|
react-dom: 19.2.8
|
|
tailwind-merge: 3.6.0
|
|
tailwindcss: 4.3.3
|
|
tsx: 4.23.4
|
|
vite: 8.2.0
|
|
wouter: 3.10.0
|
|
yaml: 2.9.0
|
|
zod: 4.4.3
|
|
|
|
autoInstallPeers: false
|
|
|
|
# pnpm 11: allowBuilds (map) replaces onlyBuiltDependencies (list).
|
|
# Build scripts are blocked by default (supply-chain defense). Only allow
|
|
# scripts for packages that genuinely need a postinstall to work.
|
|
allowBuilds:
|
|
'@swc/core': true
|
|
esbuild: true
|
|
msw: true
|
|
unrs-resolver: true
|
|
|
|
overrides:
|
|
# replit uses linux-x64 only, we can exclude all other platforms
|
|
"esbuild>@esbuild/darwin-arm64": "-"
|
|
"esbuild>@esbuild/darwin-x64": "-"
|
|
"esbuild>@esbuild/freebsd-arm64": "-"
|
|
"esbuild>@esbuild/freebsd-x64": "-"
|
|
"esbuild>@esbuild/linux-arm": "-"
|
|
"esbuild>@esbuild/linux-arm64": "-"
|
|
"esbuild>@esbuild/linux-ia32": "-"
|
|
"esbuild>@esbuild/linux-loong64": "-"
|
|
"esbuild>@esbuild/linux-mips64el": "-"
|
|
"esbuild>@esbuild/linux-ppc64": "-"
|
|
"esbuild>@esbuild/linux-riscv64": "-"
|
|
"esbuild>@esbuild/linux-s390x": "-"
|
|
"esbuild>@esbuild/netbsd-arm64": "-"
|
|
"esbuild>@esbuild/netbsd-x64": "-"
|
|
"esbuild>@esbuild/openbsd-arm64": "-"
|
|
"esbuild>@esbuild/openbsd-x64": "-"
|
|
"esbuild>@esbuild/sunos-x64": "-"
|
|
"esbuild>@esbuild/win32-arm64": "-"
|
|
"esbuild>@esbuild/win32-ia32": "-"
|
|
"esbuild>@esbuild/win32-x64": "-"
|
|
"esbuild>@esbuild/aix-ppc64": '-'
|
|
"esbuild>@esbuild/android-arm": '-'
|
|
"esbuild>@esbuild/android-arm64": '-'
|
|
"esbuild>@esbuild/android-x64": '-'
|
|
"esbuild>@esbuild/openharmony-arm64": '-'
|
|
"lightningcss>lightningcss-android-arm64": "-"
|
|
"lightningcss>lightningcss-darwin-arm64": "-"
|
|
"lightningcss>lightningcss-darwin-x64": "-"
|
|
"lightningcss>lightningcss-freebsd-x64": "-"
|
|
"lightningcss>lightningcss-linux-arm-gnueabihf": "-"
|
|
"lightningcss>lightningcss-linux-arm64-gnu": "-"
|
|
"lightningcss>lightningcss-linux-arm64-musl": "-"
|
|
"lightningcss>lightningcss-linux-x64-musl": "-"
|
|
"lightningcss>lightningcss-win32-arm64-msvc": "-"
|
|
"lightningcss>lightningcss-win32-x64-msvc": "-"
|
|
"@tailwindcss/oxide>@tailwindcss/oxide-android-arm64": "-"
|
|
"@tailwindcss/oxide>@tailwindcss/oxide-darwin-arm64": "-"
|
|
"@tailwindcss/oxide>@tailwindcss/oxide-darwin-x64": "-"
|
|
"@tailwindcss/oxide>@tailwindcss/oxide-freebsd-x64": "-"
|
|
"@tailwindcss/oxide>@tailwindcss/oxide-linux-arm-gnueabihf": "-"
|
|
"@tailwindcss/oxide>@tailwindcss/oxide-linux-arm64-gnu": "-"
|
|
"@tailwindcss/oxide>@tailwindcss/oxide-linux-arm64-musl": "-"
|
|
"@tailwindcss/oxide>@tailwindcss/oxide-win32-arm64-msvc": "-"
|
|
"@tailwindcss/oxide>@tailwindcss/oxide-win32-x64-msvc": "-"
|
|
"@tailwindcss/oxide>@tailwindcss/oxide-linux-x64-musl": "-"
|
|
"rollup>@rollup/rollup-android-arm-eabi": "-"
|
|
"rollup>@rollup/rollup-android-arm64": "-"
|
|
"rollup>@rollup/rollup-darwin-arm64": "-"
|
|
"rollup>@rollup/rollup-darwin-x64": "-"
|
|
"rollup>@rollup/rollup-freebsd-arm64": "-"
|
|
"rollup>@rollup/rollup-freebsd-x64": "-"
|
|
"rollup>@rollup/rollup-linux-arm-gnueabihf": "-"
|
|
"rollup>@rollup/rollup-linux-arm-musleabihf": "-"
|
|
"rollup>@rollup/rollup-linux-arm64-gnu": "-"
|
|
"rollup>@rollup/rollup-linux-arm64-musl": "-"
|
|
"rollup>@rollup/rollup-linux-loong64-gnu": "-"
|
|
"rollup>@rollup/rollup-linux-loong64-musl": "-"
|
|
"rollup>@rollup/rollup-linux-ppc64-gnu": "-"
|
|
"rollup>@rollup/rollup-linux-ppc64-musl": "-"
|
|
"rollup>@rollup/rollup-linux-riscv64-gnu": "-"
|
|
"rollup>@rollup/rollup-linux-riscv64-musl": "-"
|
|
"rollup>@rollup/rollup-linux-s390x-gnu": "-"
|
|
"rollup>@rollup/rollup-linux-x64-musl": "-"
|
|
"rollup>@rollup/rollup-openbsd-x64": "-"
|
|
"rollup>@rollup/rollup-openharmony-arm64": "-"
|
|
"rollup>@rollup/rollup-win32-arm64-msvc": "-"
|
|
"rollup>@rollup/rollup-win32-ia32-msvc": "-"
|
|
"rollup>@rollup/rollup-win32-x64-gnu": "-"
|
|
"rollup>@rollup/rollup-win32-x64-msvc": "-"
|
|
"@expo/ngrok-bin>@expo/ngrok-bin-darwin-arm64": "-"
|
|
"@expo/ngrok-bin>@expo/ngrok-bin-darwin-x64": "-"
|
|
"@expo/ngrok-bin>@expo/ngrok-bin-freebsd-ia32": "-"
|
|
"@expo/ngrok-bin>@expo/ngrok-bin-freebsd-x64": "-"
|
|
"@expo/ngrok-bin>@expo/ngrok-bin-linux-arm64": "-"
|
|
"@expo/ngrok-bin>@expo/ngrok-bin-linux-arm": "-"
|
|
"@expo/ngrok-bin>@expo/ngrok-bin-linux-ia32": "-"
|
|
"@expo/ngrok-bin>@expo/ngrok-bin-sunos-x64": "-"
|
|
"@expo/ngrok-bin>@expo/ngrok-bin-win32-ia32": "-"
|
|
"@expo/ngrok-bin>@expo/ngrok-bin-win32-x64": "-"
|
|
# drizzle-kit uses esbuild internally on an older version that's vulnerable, this overrides it
|
|
"@esbuild-kit/esm-loader": "npm:tsx@4.23.1"
|
|
esbuild: "0.28.1"
|
|
# Fix GHSA-q8mj-m7cp-5q26: qs DoS via stringify with null/undefined in comma-format arrays
|
|
qs: ">=6.15.2"
|
|
# Fix GHSA-v422-hmwv-36x6: body-parser DoS via invalid limit value (express dep)
|
|
body-parser: ">=2.3.0"
|
|
# Build-time tooling (orval/typedoc) advisories: force patched versions
|
|
markdown-it: ">=14.1.2"
|
|
linkify-it: ">=5.0.2"
|
|
brace-expansion: ">=5.0.8"
|
|
fast-uri: ">=3.1.4"
|
|
# Fix GHSA-5p4m-2wfm-xmqj: js-yaml (4.x) quadratic CPU in !!omap (via orval)
|
|
# Keep below 5.x since orval depends on the 4.x API.
|
|
js-yaml: ">=4.3.1 <5"
|