security: stricter pnpm config blockExoticSubdeps & trustPolicy

[Sheraff]

Summary by CodeRabbit

• Chores
  • Updated workspace configuration settings to enhance dependency management security policies.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a1644851-070d-4135-b204-aa9a5d63599b

📥 Commits

Reviewing files that changed from the base of the PR and between ee8a675 and 6cbcbf8.

📒 Files selected for processing (1)

• pnpm-workspace.yaml

---

📝 Walkthrough

Walkthrough

The PR updates pnpm-workspace.yaml to add two pnpm workspace configuration settings. The blockExoticSubdeps flag is set to true to prevent installation of exotic dependencies, and trustPolicy is set to 'no-downgrade' to ensure dependency resolution does not downgrade packages during installation.

Changes

pnpm Workspace Configuration

Layer / File(s)	Summary
Workspace dependency and trust settings pnpm-workspace.yaml	Pnpm workspace configuration is updated with blockExoticSubdeps: true and trustPolicy: 'no-downgrade' to enforce dependency resolution policies.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 A bunny hops through the workspace config,
With blockExoticSubdeps, no weird deps will flock!
trustPolicy keeps versions strong and true,
Two lines of trust for the whole crew! 🌟

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding stricter pnpm security configurations (blockExoticSubdeps and trustPolicy) to the workspace config.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch stricter-pnpm-deps-config

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 6cbcbf8

Command	Status	Duration	Result
nx run-many --target=build --exclude=examples/*...	✅ Succeeded	2m 18s	View ↗
nx affected --targets=test:eslint,test:unit,tes...	✅ Succeeded	<1s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-05-17 13:21:30 UTC

[github-actions]

🚀 Changeset Version Preview

No changeset entries found. Merging this PR will not cause a version bump for any packages.

[pkg-pr-new]

More templates

• tanstack-router-react-example-authenticated-routes
• tanstack-router-react-example-authenticated-routes-firebase
• tanstack-router-react-example-basic
• tanstack-router-react-example-basic-default-search-params
• tanstack-router-react-example-basic-devtools-panel
• tanstack-router-react-example-basic-file-based
• tanstack-router-react-example-basic-non-nested-devtools
• tanstack-router-react-example-react-query
• tanstack-router-react-example-basic-react-query-file-based
• tanstack-router-react-example-basic-ssr-file-based
• tanstack-router-react-example-basic-ssr-streaming-file-based
• tanstack-router-react-example-basic-virtual-file-based
• tanstack-router-react-example-basic-virtual-inside-file-based
• tanstack-router-react-example-deferred-data
• tanstack-router-i18n-paraglide
• tanstack-router-react-example-kitchen-sink
• tanstack-router-react-example-kitchen-sink-file-based
• tanstack-router-react-example-kitchen-sink-react-query
• tanstack-router-react-example-kitchen-sink-react-query-file-based
• tanstack-router-react-example-large-file-based
• tanstack-router-react-example-location-masking
• tanstack-router-react-example-navigation-blocking
• tanstack-router-react-example-quickstart
• tanstack-router-react-example-quickstart-esbuild-file-based
• tanstack-router-react-example-quickstart-file-based
• tanstack-router-react-example-quickstart-rspack-file-based
• tanstack-router-react-example-quickstart-webpack-file-based
• router-monorepo-react-query
• router-mono-simple
• router-mono-simple-lazy
• tanstack-router-react-example-scroll-restoration
• tanstack-search-validator-adapters
• tanstack-start-example-bare
• tanstack-start-example-basic
• tanstack-start-example-basic-auth
• tanstack-router-react-example-basic-authjs
• tanstack-start-example-basic-cloudflare
• tanstack-start-example-basic-react-query
• tanstack-start-example-basic-static
• tanstack-start-bun-hosting
• tanstack-start-example-clerk-basic
• tanstack-start-example-convex-trellaux
• tanstack-start-example-counter
• tanstack-start-i18n-paraglide
• tanstack-start-example-large
• tanstack-start-example-material-ui
• tanstack-start-example-rscs
• tanstack-start-streaming-data-from-server-functions
• tanstack-start-example-supabase-basic
• tanstack-start-tailwind-v4
• tanstack-start-example-trellaux
• tanstack-start-example-workos
• tanstack-router-react-example-view-transitions
• tanstack-router-react-example-with-framer-motion
• tanstack-router-react-example-with-trpc
• tanstack-router-react-example-with-trpc-react-query
• tanstack-router-vue-example-basic-jsx
• tanstack-router-vue-example-basic-file-based-jsx
• tanstack-router-vue-example-basic-file-based-sfc
• tanstack-router-solid-example-authenticated-routes
• tanstack-router-solid-example-authenticated-routes-firebase
• tanstack-router-solid-example-basic
• tanstack-router-solid-example-basic-default-search-params
• tanstack-router-solid-example-basic-devtools-panel
• tanstack-router-solid-example-basic-file-based
• tanstack-router-solid-example-basic-non-nested-devtools
• tanstack-router-solid-example-basic-solid-query
• tanstack-router-solid-example-basic-solid-query-file-based
• tanstack-router-solid-example-basic-ssr-file-based
• tanstack-router-solid-example-basic-ssr-streaming-file-based
• tanstack-router-solid-example-basic-virtual-file-based
• tanstack-router-solid-example-basic-virtual-inside-file-based
• tanstack-router-solid-example-deferred-data
• tanstack-router-solid-i18n-paraglide
• tanstack-router-solid-example-kitchen-sink
• tanstack-router-solid-example-kitchen-sink-file-based
• tanstack-router-solid-example-kitchen-sink-solid-query
• tanstack-router-solid-example-kitchen-sink-solid-query-file-based
• tanstack-router-solid-example-large-file-based
• tanstack-router-solid-example-location-masking
• tanstack-router-solid-example-navigation-blocking
• tanstack-router-solid-example-quickstart
• tanstack-router-solid-example-quickstart-esbuild-file-based
• tanstack-router-solid-example-quickstart-file-based
• tanstack-router-solid-example-quickstart-rspack-file-based
• tanstack-router-solid-example-quickstart-webpack-file-based
• @tanstack/router-solid-mono-simple
• router-solid-mono-simple-lazy
• router-solid-monorepo-solid-query
• tanstack-router-solid-example-scroll-restoration
• tanstack-solid-router-search-validator-adapters
• tanstack-solid-start-example-basic
• tanstack-solid-start-example-basic-auth
• tanstack-solid-start-example-basic-authjs
• tanstack-solid-start-example-basic-cloudflare
• tanstack-solid-start-example-basic-netlify
• tanstack-solid-start-example-basic-nitro
• tanstack-start-example-basic-solid-query
• tanstack-solid-start-example-basic-static
• tanstack-solid-start-bun-hosting
• tanstack-solid-start-example-convex-better-auth
• tanstack-solid-start-example-counter
• tanstack-solid-start-i18n-paraglide
• tanstack-solid-start-example-large
• tanstack-solid-start-streaming-data-from-server-functions
• tanstack-solid-start-example-supabase-basic
• tanstack-solid-start-tailwind-v4
• tanstack-router-solid-example-view-transitions
• tanstack-router-solid-example-with-framer-motion
• tanstack-router-solid-example-with-trpc

@tanstack/arktype-adapter

npm i https://pkg.pr.new/@tanstack/arktype-adapter@7425

@tanstack/eslint-plugin-router

npm i https://pkg.pr.new/@tanstack/eslint-plugin-router@7425

@tanstack/eslint-plugin-start

npm i https://pkg.pr.new/@tanstack/eslint-plugin-start@7425

@tanstack/history

npm i https://pkg.pr.new/@tanstack/history@7425

@tanstack/nitro-v2-vite-plugin

npm i https://pkg.pr.new/@tanstack/nitro-v2-vite-plugin@7425

@tanstack/react-router

npm i https://pkg.pr.new/@tanstack/react-router@7425

@tanstack/react-router-devtools

npm i https://pkg.pr.new/@tanstack/react-router-devtools@7425

@tanstack/react-router-ssr-query

npm i https://pkg.pr.new/@tanstack/react-router-ssr-query@7425

@tanstack/react-start

npm i https://pkg.pr.new/@tanstack/react-start@7425

@tanstack/react-start-client

npm i https://pkg.pr.new/@tanstack/react-start-client@7425

@tanstack/react-start-rsc

npm i https://pkg.pr.new/@tanstack/react-start-rsc@7425

@tanstack/react-start-server

npm i https://pkg.pr.new/@tanstack/react-start-server@7425

@tanstack/router-cli

npm i https://pkg.pr.new/@tanstack/router-cli@7425

@tanstack/router-core

npm i https://pkg.pr.new/@tanstack/router-core@7425

@tanstack/router-devtools

npm i https://pkg.pr.new/@tanstack/router-devtools@7425

@tanstack/router-devtools-core

npm i https://pkg.pr.new/@tanstack/router-devtools-core@7425

@tanstack/router-generator

npm i https://pkg.pr.new/@tanstack/router-generator@7425

@tanstack/router-plugin

npm i https://pkg.pr.new/@tanstack/router-plugin@7425

@tanstack/router-ssr-query-core

npm i https://pkg.pr.new/@tanstack/router-ssr-query-core@7425

@tanstack/router-utils

npm i https://pkg.pr.new/@tanstack/router-utils@7425

@tanstack/router-vite-plugin

npm i https://pkg.pr.new/@tanstack/router-vite-plugin@7425

@tanstack/solid-router

npm i https://pkg.pr.new/@tanstack/solid-router@7425

@tanstack/solid-router-devtools

npm i https://pkg.pr.new/@tanstack/solid-router-devtools@7425

@tanstack/solid-router-ssr-query

npm i https://pkg.pr.new/@tanstack/solid-router-ssr-query@7425

@tanstack/solid-start

npm i https://pkg.pr.new/@tanstack/solid-start@7425

@tanstack/solid-start-client

npm i https://pkg.pr.new/@tanstack/solid-start-client@7425

@tanstack/solid-start-server

npm i https://pkg.pr.new/@tanstack/solid-start-server@7425

@tanstack/start-client-core

npm i https://pkg.pr.new/@tanstack/start-client-core@7425

@tanstack/start-fn-stubs

npm i https://pkg.pr.new/@tanstack/start-fn-stubs@7425

@tanstack/start-plugin-core

npm i https://pkg.pr.new/@tanstack/start-plugin-core@7425

@tanstack/start-server-core

npm i https://pkg.pr.new/@tanstack/start-server-core@7425

@tanstack/start-static-server-functions

npm i https://pkg.pr.new/@tanstack/start-static-server-functions@7425

@tanstack/start-storage-context

npm i https://pkg.pr.new/@tanstack/start-storage-context@7425

@tanstack/valibot-adapter

npm i https://pkg.pr.new/@tanstack/valibot-adapter@7425

@tanstack/virtual-file-routes

npm i https://pkg.pr.new/@tanstack/virtual-file-routes@7425

@tanstack/vue-router

npm i https://pkg.pr.new/@tanstack/vue-router@7425

@tanstack/vue-router-devtools

npm i https://pkg.pr.new/@tanstack/vue-router-devtools@7425

@tanstack/vue-router-ssr-query

npm i https://pkg.pr.new/@tanstack/vue-router-ssr-query@7425

@tanstack/vue-start

npm i https://pkg.pr.new/@tanstack/vue-start@7425

@tanstack/vue-start-client

npm i https://pkg.pr.new/@tanstack/vue-start-client@7425

@tanstack/vue-start-server

npm i https://pkg.pr.new/@tanstack/vue-start-server@7425

@tanstack/zod-adapter

npm i https://pkg.pr.new/@tanstack/zod-adapter@7425

commit: 6cbcbf8