mirror of
https://github.com/vercel/workflow.git
synced 2026-09-14 19:59:43 +08:00
Simon H
37ed0493e1
Instead of accessing private files from SvelteKit, we use @sveltejs/load-config to load the Svelte config (that package also knows about checking Vite config). The deadlock is avoided by having a module-level Set to see if we're currently recursing or not. This is necessary for SvelteKit 3 since there the config lives exclusively in the vite config, and the previous logic did not handle that. This also uncovered that we're needlessly rebuilding the generated files in sub builds/workers (SvelteKit, at least below 3, starts off secondary builds; and some things are done in workers), which a new file cache now checks. Picked from stable branch PR #3474 Signed-off-by: Simon Holthausen <simon.holthausen@vercel.com> Co-authored-by: Peter Wielander <mittgfu@gmail.com>
73 lines
2.2 KiB
YAML
73 lines
2.2 KiB
YAML
packages:
|
|
- workbench/*
|
|
- "!workbench/nitro"
|
|
- packages/*
|
|
- docs
|
|
- tarballs
|
|
|
|
catalog:
|
|
"@biomejs/biome": ^2.4.4
|
|
"@swc/core": 1.15.3
|
|
"@types/json-schema": ^7.0.15
|
|
"@types/node": 22.19.0
|
|
"@vercel/functions": ^3.8.0
|
|
"@vercel/oidc": 3.2.0
|
|
"@vercel/queue": 0.5.0
|
|
"@vitest/coverage-v8": ^4.1.10
|
|
"@vitest/runner": ^4.1.10
|
|
ai: 6.0.116
|
|
enhanced-resolve: 5.19.0
|
|
esbuild: ^0.28.1
|
|
nitro: ^3.0.260610-beta
|
|
semver: 7.7.4
|
|
typescript: ^6.0.3
|
|
ulid: ~3.0.1
|
|
undici: 7.29.0
|
|
vitest: ^4.1.10
|
|
zod: ~4.3.6
|
|
|
|
onlyBuiltDependencies:
|
|
- esbuild
|
|
|
|
overrides:
|
|
# `@vercel/queue` accepts any `@vercel/oidc` in the 3.x line, and 3.3+ pulls in
|
|
# `@vercel/cli-config`, whose `xdg-app-paths` dependency instantiates itself at
|
|
# module scope and throws `The "path" argument must be of type string` once a
|
|
# bundler inlines it. Pin the queue client's copy to the last dependency-free
|
|
# release so a bundled queue client keeps working.
|
|
'@vercel/queue>@vercel/oidc': 3.2.0
|
|
# Single @opentelemetry/api instance workspace-wide: with two resolved
|
|
# copies (1.9.0 + 1.9.1), the copy that registers the tracer provider and
|
|
# the copy a package imports can differ, and the API's global-registration
|
|
# version check then hands the importer a noop tracer — world-vercel's
|
|
# spans were silently dropped this way while core's flowed (#2900).
|
|
'@opentelemetry/api': 1.9.1
|
|
rfc6902: 5.1.2
|
|
devalue: 5.9.0
|
|
'@sveltejs/acorn-typescript': 1.0.10
|
|
# postcss < 8.5.18 is vulnerable to CVE-2026-45623 and GHSA-r28c-9q8g-f849
|
|
# (arbitrary file read / .map disclosure via attacker-controlled
|
|
# sourceMappingURL). Forces transitive pins (e.g. next.js's postcss@8.4.31)
|
|
# onto a patched version.
|
|
'postcss@<8.5.18': 8.5.22
|
|
|
|
savePrefix: ""
|
|
|
|
minimumReleaseAge: 2880
|
|
|
|
minimumReleaseAgeExclude:
|
|
- '@turbo/*'
|
|
- 'turbo'
|
|
- '@vercel/*'
|
|
- '@workflow/*'
|
|
- 'esbuild'
|
|
- '@esbuild/*'
|
|
- '@sveltejs/load-config'
|
|
- 'quickjs-wasi'
|
|
# The CI canary lanes pin `next` to a fresh canary at install time
|
|
# (see "Setup canary" in .github/workflows/tests.yml); canaries are
|
|
# usually younger than the 48h gate, and next and its @next/* companion
|
|
# packages (published in lockstep) are Vercel-published.
|
|
- 'next'
|
|
- '@next/*'
|