pnpm-workspace.yaml

# Edit this file by hand. Using `pnpm config` reformats the file and removes all comments.

packages:
  - "apps/**"
  - "packages/*"
  - "packages/components-css/*"
  - "packages/components-react/*"
  - "proprietary/*"

# Configure pnpm so peer dependencies are automatically installed.
autoInstallPeers: true

# Configure pnpm so that it will not install any package that claims to not be compatible with the current Node.js
# version.
engineStrict: true

# Configure pnpm so it only installs package versions that have been published on the npm registry for at least 24 hours
# (1440 minutes). This helps mitigate the risk of supply chain attacks by avoiding newly published, potentially
# malicious versions. Keep this in sync with npm-check-updates's `cooldown` configuration.
minimumReleaseAge: 1440

# Make an exception for trusted packages, notably our own
minimumReleaseAgeExclude:
  - "@amsterdam/*"
  - "@gemeente-denhaag/*"
  - "@gemeente-rotterdam/*"
  - "@nl-design-system/*"
  - "@nl-design-system-candidate/*"
  - "@nl-design-system-community/*"
  - "@nl-design-system-unstable/*"
  - "@nl-rvo/*"
  - "@rijkshuisstijl-community/*"
  - "@utrecht/*"
  - "@next/*"
  - "next"
  - "eslint-config-next@15.5.9"
  - "react@19.2.3"
  - "react-dom@19.2.3"
  - "@isaacs/brace-expansion"

# Configure pnpm to save exact version numbers (not including ^ or ~) in package.json. Lock dependencies to specific
# versions to ensure reproducible installs and prevent automatic upgrades to newer minor or patch releases.
saveExact: true
savePrefix: ""

auditConfig:
  ignoreGhsas:
    - GHSA-vh9h-29pq-r5m8

overrides:
  axios@<1.15.0: ">=1.15.0"
  handlebars@>=4.0.0 <4.7.9: ">=4.7.9"
  locutus@>=2.0.12 <2.0.39: ">=2.0.39"
  "@isaacs/brace-expansion@<=5.0.0": ">=5.0.1"

# Configure pnpm to not fail when there are missing or invalid peer dependencies in the tree.
strictPeerDependencies: false