Files
zitadel/pnpm-workspace.yaml
T
Max PeintnerandLivio Spring bc9333aef9 chore: update npm dependencies (#12375)
# Which Problems Are Solved

- npm dependencies across the monorepo are behind current patch/minor
releases.
- Transitive dependencies are pinned to older versions by parent
packages (karma, nx, @changesets/cli, etc.).
- Console build fails after the Angular toolchain update because
`angular.json` references assets outside the workspace root.

# How the Problems Are Solved

- Bumps `@angular/*` to `^21.2.17` in console.
- Bumps `js-yaml` to `^4.2.0` in docs.
- Bumps `concurrently` to `^10.0.3` in login.
- Adds pnpm overrides for transitive deps that cannot be bumped directly
(ws, undici, minimatch, esbuild, dompurify, qs, and others).

# Additional Changes

- Removes 10 overrides that are no longer needed after parent packages
resolve to newer versions.
- Updates 4 existing overrides (`tar`, `js-yaml`, `dompurify`,
`brace-expansion`) to match current upstream ranges.
- 2 low-severity findings remain via the abandoned `raw-loader` package
in docs (peer dep resolution; no upstream fix without replacing
`raw-loader`).
- Fixes console build: replaced the `angular.json` asset glob
`../apps/docs/public/img/tech` with a `prebuild` script that copies tech
images into `src/assets/docs/img/tech`. **Verify at runtime that tech
images on project grant / integration pages still load.**

# Additional Context

- Overrides remain where parent packages still pin older transitive
versions.
- The `angular.json` asset path issue predates this PR (not introduced
by the Angular bump).

---------

Co-authored-by: Livio Spring <9405495+livio-a@users.noreply.github.com>
2026-07-06 14:18:51 +00:00

42 lines
1.2 KiB
YAML

packages:
- console
- tests/*
- packages/*
- apps/*
- deploy/compose
exclude:
- benchmark # because of the node 18 or 20 dependency
overrides:
"tar@<7.5.16": "^7.5.16 <8.0.0"
"flatted@<3.4.2": "^3.4.2"
"rollup@>=4.0.0 <4.59.0": "^4.59.0"
"socket.io-parser@>=4.0.0 <4.2.6": "^4.2.6"
"picomatch@>=4.0.0 <4.0.4": "^4.0.4"
"lodash@>=4.0.0 <4.18.0": "^4.18.0"
"js-yaml@<3.15.0": "^3.15.0"
"qs@>=6.11.1 <=6.15.1": "^6.15.2"
"ajv@<6.14.0": "^6.14.0"
"minimatch@<3.1.4": "^3.1.4"
"dompurify@>=3.1.3 <3.4.11": "^3.4.11"
"unhead@<2.1.11": "^2.1.11"
"brace-expansion@<1.1.13": "^1.1.13"
"brace-expansion@>=5.0.0 <5.0.6": "^5.0.6"
"yaml@>=2.0.0 <2.8.3": "^2.8.3"
"follow-redirects@<1.16.0": "^1.16.0"
"axios@<1.17.0": "^1.17.0"
"systeminformation@<5.31.6": "^5.31.6"
"tmp@<0.2.6": "^0.2.6"
"fast-uri@<3.1.2": "^3.1.2"
"ws@>=8.0.0 <8.21.0": "^8.21.0"
"undici@<6.27.0": "^6.27.0"
"webpack@>=5.0.0 <5.104.1": "^5.104.1"
"minimatch@>=9.0.0 <9.0.7": "^9.0.7"
"esbuild@>=0.27.3 <0.28.1": "^0.28.1"
"postcss@<8.5.10": "^8.5.10"
"ip-address@<=10.1.0": "^10.1.1"
"uuid@<11.1.1": "^11.1.1"
"@babel/core@<=7.29.0": "^7.29.6"
"@opentelemetry/core@<2.8.0": "^2.8.0"