pnpm-workspace.yaml

# Edit this file by hand. Using `pnpm config` reformats the file and removes all comments.

packages:
  - "components/**"
  - "packages/*"
  - "proprietary/*"

# Configure pnpm so peer dependencies must be explicitly added instead of being automatically installed.
autoInstallPeers: false

# Configure pnpm so that it will not install any package that claims to not be compatible with the current Node.js
# version.
engineStrict: true

# Configure pnpm so it only installs package versions that have been published on the npm registry for at least 24 hours
# (1440 minutes). This helps mitigate the risk of supply chain attacks by avoiding newly published, potentially
# malicious versions. Keep this in sync with npm-check-updates's `cooldown` configuration.
minimumReleaseAge: 1440

# Make an exception for trusted packages, notably our own
minimumReleaseAgeExclude:
  - "@amsterdam/*"
  - "@gemeente-denhaag/*"
  - "@gemeente-rotterdam/*"
  - "@nl-design-system/*"
  - "@nl-design-system-candidate/*"
  - "@nl-design-system-community/*"
  - "@nl-design-system-unstable/*"
  - "@nl-rvo/*"
  - "@rijkshuisstijl-community/*"
  - "@utrecht/*"

overrides:
  form-data@>=4.0.0 <4.0.4: ">=4.0.4"

# Configure pnpm to save exact version numbers (not including ^ or ~) in package.json. Lock dependencies to specific
# versions to ensure reproducible installs and prevent automatic upgrades to newer minor or patch releases.
saveExact: true
savePrefix: ""

# Configure pnpm to not fail when there are missing or invalid peer dependencies in the tree.
strictPeerDependencies: false