diff --git a/package.json b/package.json index 8a538e1be..22e40bb10 100755 --- a/package.json +++ b/package.json @@ -46,7 +46,6 @@ "overrides": { "micromatch": "^4.0.8", "css-select>nth-check": "^2.0.1", - "node-gyp": "^10.0.0", "ansi-html": "^0.0.9", "fireworm>async": "^2.6.4", "ember-cli-babel>@babel/runtime": "7.27.6", @@ -54,7 +53,7 @@ "ember-loading>ember-concurrency": "^4.0.0", "tmp": "^0.2.5", "tar": "^7.5.10", - "underscore": "^1.13.8" + "nomnom>underscore": "^1.13.8" }, "ignoredBuiltDependencies": [ "@parcel/watcher", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b04c4f404..02135c1b7 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -7,7 +7,6 @@ settings: overrides: micromatch: ^4.0.8 css-select>nth-check: ^2.0.1 - node-gyp: ^10.0.0 ansi-html: ^0.0.9 fireworm>async: ^2.6.4 ember-cli-babel>@babel/runtime: 7.27.6 @@ -15,7 +14,7 @@ overrides: ember-loading>ember-concurrency: ^4.0.0 tmp: ^0.2.5 tar: ^7.5.10 - underscore: ^1.13.8 + nomnom>underscore: ^1.13.8 patchedDependencies: ember-loading: @@ -4213,7 +4212,7 @@ packages: toffee: ^0.3.6 twig: ^1.15.2 twing: ^5.0.2 - underscore: ^1.13.8 + underscore: ^1.11.0 vash: ^0.13.0 velocityjs: ^2.0.1 walrus: ^0.10.1 diff --git a/pnpm-overrides.md b/pnpm-overrides.md new file mode 100644 index 000000000..fb0bc2f90 --- /dev/null +++ b/pnpm-overrides.md @@ -0,0 +1,17 @@ +# package.json Overrides + +This file documents the rationale for each dependency override defined in `package.json` under `pnpm.overrides`. +These overrides force specific versions of transitive dependencies, primarily for security and compatibility reasons. + +| Package | Version | Pulled in by | What to check before removing | +|---------|---------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `micromatch` | `^4.0.8` | `anymatch` (`^3.1.4`), `common-tags` (`3.1.10`), `sane` (`^3.1.4`), `find-yarn-workspace-root` / `findup-sync` (`^4.0.2`), `ember-template-lint` / `stylelint` (`^4.0.5`) all declare ranges that would resolve below `4.0.8`. | Once all dependents declare a range of `^4.0.8` or higher, the override can be removed. | +| `css-select>nth-check` | `^2.0.1` | `css-select` pins an older `nth-check`. | Check whether a newer `css-select` release drops the pinned `nth-check` `<2.0.0` requirement. Used by `ember-inline-svg`. | +| `ansi-html` | `^0.0.9` | Both `broccoli-middleware` and `broccoli` pin `"ansi-html": "^0.0.7"`. | Check whether newer `broccoli` / `ember-cli` releases update these to drop the sub-`0.0.9` pin. | +| `fireworm>async` | `^2.6.4` | `fireworm` pins an older `async`. | Check whether `fireworm` has been updated or replaced; if `testem` updates `fireworm`, this override can be removed. | +| `ember-cli-babel>@babel/runtime` | `7.27.6` | `ember-cli-babel` restricts the version it resolves. | Review when upgrading `ember-cli-babel`; once its `@babel/runtime` range is broad enough, remove and verify the build. | +| `ember-try-config>package-json` | `^10.0.1` | `ember-try-config` pins an older `package-json`. | Check whether a newer `ember-try-config` release widens its `package-json` range to include v10+. | +| `ember-loading>ember-concurrency` | `^4.0.0` | `ember-loading` declares `"ember-concurrency": "^2.0.3"`. | The override and the patch (`patches/ember-loading.patch`) are a pair — the override forces v4 to be installed, the patch updates the source to use v4. Both must be removed together if `ember-loading` ever ships a version that natively supports v4. | +| `tmp` | `^0.2.5` | 10+ packages pin old versions of `tmp` (`broccoli`, `can-symlink`, `ember-cli-typescript`, `external-editor`, `fixturify-project`, `sane`, `testem`, and others) | Check whether the main Ember toolchain packages (`broccoli`, `ember-cli`, `testem`) have been updated to allow `tmp ^0.2.x`. | +| `tar` | `^7.5.10` | Both `cacache` (`^6.1.11`) and `@electron/rebuild` (`^6.0.5`) pin old ranges. | Check whether a newer `ember-electron` brings in versions of `@electron/rebuild` and `cacache` that allow `tar ^7.x`. | +| `nomnom>underscore` | `^1.13.8` | `nomnom` pins `"underscore": "~1.6.0"`. All other consumers already declare ranges that include 1.13.8. | `nomnom@1.8.1` is the last published version and the package is abandoned. `jsonlint` is the actual consumer, currently pinned to `^1.6.3` which still depends on `nomnom`. | diff --git a/ui/desktop/electron-app/pnpm-overrides.md b/ui/desktop/electron-app/pnpm-overrides.md new file mode 100644 index 000000000..679f01cf3 --- /dev/null +++ b/ui/desktop/electron-app/pnpm-overrides.md @@ -0,0 +1,9 @@ +# package.json Overrides + +This file documents the rationale for each dependency override defined in `package.json` under `pnpm.overrides` for the `electron-app` sub-package. +These overrides force specific versions of transitive dependencies, primarily for security and compatibility reasons. + +| Package | Version | Pulled in by | What to check before removing | +|---------|---------|--------------|-------------------------------| +| `tar` | `^7.5.10` | Both `cacache` (`^6.1.11`) and `@electron/rebuild` (`^6.0.5`) pin old ranges. | Check whether newer releases of `@electron/rebuild` and `cacache` (brought in via `@electron-forge` and `electron`) allow `tar ^7.x`. | +