chore: move pnpm settings and enable minimumReleaseAge 3 days (#1226)

* chore: move pnpm settings to workspace.yml and enable minimumReleaseAge 3 days in pnpm and renovate

* fix: allow immediate update of rolldown-vite related deps

* fix: allow all of oxc-project because of rolldown

* one more

Author: dominikg

.github/renovate.json5

@@ -13,6 +13,9 @@
 		{
 			"matchDepTypes": ["peerDependencies","engines"],
 			"enabled": false
+		}, {
+			"matchDatasources": ["npm"],
+			"minimumReleaseAge": "3 days"
 		}
 	]
 }

package.json

@@ -64,43 +64,9 @@
     "*": "prettier --cache --ignore-path .gitignore --ignore-unknown --write",
     "packages/*/src/**/*": "pnpm generate:types-staged"
   },
-  "packageManager": "pnpm@10.16.1",
+  "packageManager": "pnpm@10.17.1",
   "engines": {
     "pnpm": "^10.2.0",
     "node": "^20.19 || ^22.12 || >=24"
-  },
-  "pnpm": {
-    "overrides": {
-      "@sveltejs/kit": "$@sveltejs/kit",
-      "@sveltejs/kit>@sveltejs/vite-plugin-svelte": "workspace:^",
-      "@sveltejs/vite-plugin-svelte": "workspace:^",
-      "@sveltejs/vite-plugin-svelte-inspector": "workspace:^",
-      "svelte": "$svelte",
-      "vite": "$vite",
-      "@types/node@<=20.12.0": "20.19.14",
-      "send@<0.19.0": "^0.19.1",
-      "@sveltejs/kit>cookie@<0.7.0": "^0.7.2",
-      "vite-plugin-inspect": "/home/dominikg/develop/vite-plugin-inspect"
-    },
-    "onlyBuiltDependencies": [
-      "esbuild"
-    ],
-    "ignoredBuiltDependencies": [
-      "@parcel/watcher",
-      "carbon-components-svelte",
-      "es5-ext",
-      "svelte-preprocess"
-    ],
-    "auditConfig": {
-      "ignoreGhsas": [
-        "GHSA-67mh-4wv8-2f99",
-        "GHSA-v6h2-p8h4-qcjw"
-      ]
-    },
-    "updateConfig": {
-      "ignoreDependencies": [
-        "execa"
-      ]
-    }
   }
 }

pnpm-lock.yaml

@@ -3,7 +3,48 @@ packages:
   - 'packages/e2e-tests/*'
   - 'packages/e2e-tests/_test_dependencies/*'
 
-# settings
+# package resolution settings
+minimumReleaseAge: 4320 #3 days
+
+minimumReleaseAgeExclude:
+  - 'vite'
+  - 'create-vite'
+  - '@vitejs/*'
+  - 'svelte'
+  - '@sveltejs/*'
+  - 'rolldown-vite'
+  - 'rolldown'
+  - '@rolldown/*'
+  - '@oxc-project/*'
+
+onlyBuiltDependencies:
+  - esbuild
+ignoredBuiltDependencies:
+  - '@parcel/watcher'
+  - 'carbon-components-svelte'
+  - 'es5-ext'
+  - 'svelte-preprocess'
+
+auditConfig:
+  ignoreGhsas:
+    - 'GHSA-67mh-4wv8-2f99'
+    - 'GHSA-v6h2-p8h4-qcjw'
+
+updateConfig:
+  ignoreDependencies:
+    - 'execa' # v9 is larger than v8 and doesn't work the same, we only use it in testing
+
+overrides:
+  # $ prefixed package names take their version from root package.json - this is like catalogs but without them
+  '@sveltejs/kit': '$@sveltejs/kit'
+  '@sveltejs/kit>@sveltejs/vite-plugin-svelte': 'workspace:^'
+  '@sveltejs/vite-plugin-svelte': 'workspace:^'
+  '@sveltejs/vite-plugin-svelte-inspector': 'workspace:^'
+  'svelte': '$svelte'
+  'vite': '$vite'
+  '@types/node@<=20.12.0': '20.19.14'
+  'send@<0.19.0': '^0.19.1'
+  '@sveltejs/kit>cookie@<0.7.0': '^0.7.2'
 
 #cli output
 aggregateOutput: true