Skip to content

security: stricter pnpm config blockExoticSubdeps & trustPolicy#220

Open
Sheraff wants to merge 1 commit into
TanStack:mainfrom
Sheraff:stricter-pnpm-deps-config
Open

security: stricter pnpm config blockExoticSubdeps & trustPolicy#220
Sheraff wants to merge 1 commit into
TanStack:mainfrom
Sheraff:stricter-pnpm-deps-config

Conversation

@Sheraff
Copy link
Copy Markdown
Contributor

@Sheraff Sheraff commented May 17, 2026 •
edited by coderabbitai Bot
Loading

Enables pnpm's no-downgrade trust policy and blocks exotic transitive dependencies via blockExoticSubdeps.

Summary by CodeRabbit

  • Chores
    • Updated workspace configuration settings for improved dependency management and security controls.

Review Change Stack

@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 17, 2026 •
edited
Loading

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: fe7ab175-dda3-457c-b158-e2483e450a72

📥 Commits

Reviewing files that changed from the base of the PR and between a894009 and 028a254.

📒 Files selected for processing (1)
  • pnpm-workspace.yaml
📝 Walkthrough

Walkthrough

The workspace configuration adds two new top-level pnpm settings to enforce stricter dependency management: blockExoticSubdeps: true prevents exotic subdependencies, and trustPolicy: 'no-downgrade' enforces trust policy constraints for all workspace packages.

Changes

Workspace Dependency Security Settings

Layer / File(s) Summary
Workspace safety settings
pnpm-workspace.yaml		 Adds blockExoticSubdeps: true to block exotic subdependencies and trustPolicy: 'no-downgrade' to enforce no-downgrade trust policy across the workspace.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

A rabbit hops through config files,
With two lines added, all smiles—
Exotic deps blocked with care,
Trust policy in the air,
Dependencies safe and bright! 🐰✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The provided description is minimal and lacks the required template structure with sections for detailed changes, checklist items, and release impact assessment. Expand the description to follow the template: add a detailed '🎯 Changes' section explaining the motivation, complete the '✅ Checklist', and specify the '🚀 Release Impact' (whether a changeset is needed).
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and specifically summarizes the main change: adding stricter pnpm configuration settings (blockExoticSubdeps and trustPolicy) for security purposes.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands and usage tips.

@nx-cloud
Copy link
Copy Markdown

nx-cloud Bot commented May 17, 2026 •
edited
Loading

View your CI Pipeline Execution ↗ for commit 028a254

Command Status Duration Result
nx run-many --targets=build --exclude=examples/** ✅ Succeeded 1s View ↗

☁️ Nx Cloud last updated this comment at 2026-05-17 13:59:47 UTC

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new Bot commented May 17, 2026

More templates

@tanstack/angular-pacer

npm i https://pkg.pr.new/@tanstack/angular-pacer@220

@tanstack/pacer

npm i https://pkg.pr.new/@tanstack/pacer@220

@tanstack/pacer-devtools

npm i https://pkg.pr.new/@tanstack/pacer-devtools@220

@tanstack/pacer-lite

npm i https://pkg.pr.new/@tanstack/pacer-lite@220

@tanstack/preact-pacer

npm i https://pkg.pr.new/@tanstack/preact-pacer@220

@tanstack/preact-pacer-devtools

npm i https://pkg.pr.new/@tanstack/preact-pacer-devtools@220

@tanstack/react-pacer

npm i https://pkg.pr.new/@tanstack/react-pacer@220

@tanstack/react-pacer-devtools

npm i https://pkg.pr.new/@tanstack/react-pacer-devtools@220

@tanstack/solid-pacer

npm i https://pkg.pr.new/@tanstack/solid-pacer@220

@tanstack/solid-pacer-devtools

npm i https://pkg.pr.new/@tanstack/solid-pacer-devtools@220

commit: 028a254

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Sheraff