Files
o11y/frontend/pnpm-workspace.yaml
zooqueenandHanzo Dev ddbd95b816 The console mounts the gui config its components read
The console renders @hanzo/ui's Button, Badge and Toaster, which are @hanzo/gui
components, and gui reads its config from module state createGui fills. Nothing
here created one, so the first of them to render threw Err0 and the console
fell to "Something went wrong". providers/Gui mounts GuiProvider with the
fleet's config, @hanzo/ui/gui-config (the table console and hanzo.ai mount),
themed by this app's own dark/light switch.

The lockfile is regenerated so it installs at all. The catalog commit moved
every version into pnpm-workspace.yaml at the newest release (react-router 5 to
7, antd 5 to 6, redux 4 to 5, i18next 21 to 26, fifty-three majors) without
regenerating the lockfile, so `pnpm install --frozen-lockfile` has refused
since, and neither Dockerfile.site nor a site build could run. The code is
written against the versions the lockfile holds, so the catalog now states
those, and the design system stays at the catalog's line: @hanzo/ui 8.27.0,
@hanzo/gui 8.3.1. One copy of each installs, with every @hanzogui package at
8.3.1, where the old lockfile split them across 8.0.0 and 8.0.1.

chokidar 4.0.3, which the old lockfile already installed under sass, is excluded
from the trust policy by exact version: it is the last 4.x and went out without
the provenance 4.0.1 carried.

Co-authored-by: Hanzo Dev <[email protected]>
2026-09-24 05:58:59 -07:00

201 lines
6.2 KiB
YAML

packages: []
trustPolicy: no-downgrade
minimumReleaseAge: 2880 # 2d
minimumReleaseAgeStrict: true
minimumReleaseAgeExclude:
# The cooling-off period guards against a third party's registry account being
# compromised. It does not apply to the packages this org publishes itself, and
# holding them back for two days would pin every app to a stale design system.
- '@hanzo/*'
- '@hanzogui/*'
blockExoticSubdeps: true
trustPolicyExclude:
# Same reasoning as the exclude above. 8.x of the design system is published by
# hand rather than by CI, so it carries no provenance attestation where 5.x did,
# and no-downgrade reads that as a takeover. The real fix belongs upstream —
# publish @hanzo/ui and @hanzo/gui from CI with provenance — after which these
# two entries should come back out.
- '@hanzo/*'
- '@hanzogui/*'
# The last 4.x of chokidar (sass 1.97 asks for ^4) went out without the
# provenance 4.0.1 carried. This exact version is the one the lockfile has
# always installed; the exclusion names it alone so any other chokidar is
# still checked.
- '[email protected]'
overrides:
'zod': '^4.5.2'
catalog:
'@ant-design/colors': '6.0.0'
'@ant-design/v5-patch-for-react-19': '1.0.3'
'@babel/core': '^7.22.11'
'@babel/plugin-proposal-class-properties': '^7.18.6'
'@babel/preset-env': '^7.22.14'
'@babel/preset-react': '^7.12.13'
'@babel/preset-typescript': '^7.21.4'
'@codemirror/autocomplete': '6.18.6'
'@codemirror/lang-javascript': '6.2.3'
'@codemirror/state': '6.5.2'
'@codemirror/view': '6.36.6'
'@commitlint/cli': '20.4.4'
'@commitlint/config-conventional': '20.4.4'
'@dnd-kit/core': '6.1.0'
'@dnd-kit/modifiers': '7.0.0'
'@dnd-kit/sortable': '8.0.0'
'@dnd-kit/utilities': '3.2.2'
'@grafana/data': '^11.6.14'
'@hanzo/font': '1.9.2'
'@hanzo/gui': '8.3.1'
'@hanzo/insights': '1.358.1'
'@hanzo/ui': '8.27.0'
'@jest/globals': '30.4.1'
'@jest/types': '30.2.0'
'@monaco-editor/react': '^4.7.0'
'@radix-ui/react-dialog': '1.1.15'
'@radix-ui/react-dropdown-menu': '2.1.16'
'@radix-ui/react-popover': '1.1.15'
'@radix-ui/react-select': '2.2.6'
'@radix-ui/react-tooltip': '1.2.8'
'@sentry/react': '8.41.0'
'@sentry/vite-plugin': '2.22.6'
'@tanstack/react-table': '8.20.6'
'@tanstack/react-virtual': '3.11.2'
'@testing-library/jest-dom': '5.16.5'
'@testing-library/react': '16.3.2'
'@testing-library/user-event': '14.4.3'
'@types/color': '^3.0.3'
'@types/crypto-js': '4.2.2'
'@types/d3-hierarchy': '1.1.11'
'@types/event-source-polyfill': '^1.0.0'
'@types/history': '4.7.11'
'@types/jest': '30.0.0'
'@types/lodash-es': '^4.17.4'
'@types/node': '^16.10.3'
'@types/papaparse': '5.3.7'
'@types/react': '19.2.18'
'@types/react-addons-update': '0.14.21'
'@types/react-dom': '19.2.5'
'@types/react-grid-layout': '^1.1.2'
'@types/react-resizable': '3.0.3'
'@types/react-router-dom': '^5.1.6'
'@types/react-syntax-highlighter': '15.5.13'
'@types/redux-mock-store': '1.0.4'
'@types/styled-components': '^5.1.4'
'@types/testing-library__jest-dom': '^5.14.5'
'@types/uuid': '^8.3.1'
'@uiw/codemirror-theme-copilot': '4.23.11'
'@uiw/codemirror-theme-github': '4.24.1'
'@uiw/react-codemirror': '4.23.10'
'@visx/group': '4.0.0'
'@visx/hierarchy': '4.0.0'
'@visx/shape': '4.0.0'
'@visx/tooltip': '4.0.0'
'@visx/vendor': '4.0.0'
'@vitejs/plugin-react': '5.1.4'
'ansi-to-html': '0.7.2'
'antd': '5.29.3'
'antd-table-saveas-excel': '2.2.1'
'antlr4': '4.13.2'
'axios': '1.16.0'
'babel-jest': '^29.6.4'
'chart.js': '3.9.1'
'chartjs-adapter-date-fns': '^2.0.0'
'chartjs-plugin-annotation': '^1.4.0'
'classnames': '2.3.2'
'clsx': '2.1.1'
'cmdk': '1.1.1'
'color': '^4.2.1'
'crypto-js': '4.2.0'
'd3-hierarchy': '3.1.2'
'dayjs': '^1.10.7'
'dompurify': '3.4.0'
'eslint': '9.39.5'
'eslint-plugin-sonarjs': '4.2.0'
'event-source-polyfill': '1.0.31'
'eventemitter3': '5.0.1'
'glob': '^13.0.6'
'history': '4.10.1'
'http-proxy-middleware': '4.0.0'
'http-status-codes': '2.3.0'
'husky': '^7.0.4'
'i18next': '^21.6.12'
'i18next-browser-languagedetector': '^6.1.3'
'i18next-http-backend': '^4.0.0'
'immer': '11.1.3'
'is-ci': '^3.0.1'
'jest': '30.2.0'
'jest-environment-jsdom': '29.7.0'
'jest-styled-components': '^7.2.0'
'js-base64': '^3.7.2'
'json-schema-to-typescript': '^15.0.4'
'lint-staged': '^17.0.4'
'lodash-es': '^4.17.21'
'lucide-react': '0.498.0'
'monaco-editor': '0.55.1'
'motion': '12.4.13'
'msw': '1.3.2'
'nuqs': '2.8.8'
'orval': '8.9.1'
'overlayscrollbars': '^2.8.1'
'overlayscrollbars-react': '^0.5.6'
'oxfmt': '0.47.0'
'oxlint': '1.62.0'
'oxlint-tsgolint': '0.22.1'
'papaparse': '5.4.1'
'postcss': '8.5.14'
'postcss-scss': '4.0.9'
'prop-types': '15.8.1'
'rc-tween-one': '3.0.6'
'react': '19.2.8'
'react-addons-update': '15.6.3'
'react-day-picker': '^9.0.0'
'react-dnd': '16.0.1'
'react-dnd-html5-backend': '16.0.1'
'react-dom': '19.2.8'
'react-drag-listview': '2.0.0'
'react-force-graph-2d': '^1.29.1'
'react-full-screen': '1.1.1'
'react-grid-layout': '^1.3.4'
'react-helmet-async': '3.0.0'
'react-hook-form': '7.71.2'
'react-i18next': '^11.16.1'
'react-json-tree': '^0.20.0'
'react-markdown': '9.0.3'
'react-native-web': '0.21.2'
'react-query': '3.39.3'
'react-redux': '9.3.0'
'react-resizable': '3.0.4'
'react-resizable-panels': '^4.0.0'
'react-rnd': '^10.5.3'
'react-router-dom': '^5.2.0'
'react-router-dom-v5-compat': '6.30.3'
'react-syntax-highlighter': '15.5.0'
'react-use': '^17.3.2'
'react-virtuoso': '4.0.3'
'redux': '^4.0.5'
'redux-mock-store': '1.5.4'
'redux-thunk': '^2.3.0'
'rehype-raw': '7.0.0'
'remark-gfm': '^4.0.0'
'rollup-plugin-visualizer': '7.0.0'
'rrule': '2.8.1'
'sass': '1.97.3'
'sharp': '0.34.5'
'sonner': '2.0.7'
'styled-components': '^5.3.11'
'stylelint': '17.7.0'
'svgo': '4.0.1'
'timestamp-nano': '^1.0.0'
'typescript': '7.0.2'
'typescript-plugin-css-modules': '5.2.0'
'uplot': '1.6.31'
'use-sync-external-store': '1.6.0'
'uuid': '^8.3.2'
'vaul': '1.1.2'
'vite-plugin-checker': '0.12.0'
'vite-plugin-compression': '0.5.1'
'vite-plugin-html': '3.2.2'
'vite-plugin-image-optimizer': '2.0.3'
'vite-tsconfig-paths': '6.1.1'
'zod': '4.3.6'
'zustand': '5.0.11'