mirror of
https://github.com/vercel/next.js.git
synced 2026-09-20 02:25:18 +08:00
Benjamin Woodruff
5abeaea316
Depends on pnpm 10.x: https://github.com/vercel/next.js/pull/92283 Enables https://pnpm.io/settings#minimumreleaseage to protect against supply-chain attacks. The `minimumReleaseAgeExclude` list is copied from https://github.com/vercel/front/blob/1c3a9458d970265e1fb5ec14ddfed9a0eab2abef/pnpm-workspace.yaml#L13, with `react` and `react-dom` added.
22 lines
398 B
YAML
22 lines
398 B
YAML
packages:
|
|
- 'actions/*'
|
|
injectWorkspacePackages: true
|
|
blockExoticSubdeps: true
|
|
minimumReleaseAge: 2880 # 48 hrs
|
|
minimumReleaseAgeExclude:
|
|
- '@next/*'
|
|
- '@turbo/*'
|
|
- '@vercel/*'
|
|
- '@workflow/*'
|
|
- babel-plugin-react-compiler
|
|
- next
|
|
- react
|
|
- react-dom
|
|
- react-dom-*
|
|
- react-experimental-builtin
|
|
- react-is
|
|
- react-is-builtin
|
|
- react-server-dom-*
|
|
- scheduler-*
|
|
- turbo
|