pnpmlisted

# pnpm Configuration `pnpm-workspace.yaml` at the repo root is where pnpm's behavior is configured — **for any repo, single-package or monorepo.** The supply-chain, build-allowlist, override, and peer-dependency sections below apply everywhere; a single-package repo keeps this file for exactly those settings and simply omits the workspace-layout section (`packages`, linking, catalogs, `requiredScripts`), which only a monorepo needs. Group settings by intent and keep a short comment (often a `https://pnpm.io/settings#...` link) above any non-obvious key. ## Monorepo: workspace layout & linking > Workspace-only — omit in a single-package repo. ```yaml packages: - projects/* - packages/* # Use the workspace protocol for local packages linkWorkspacePackages: deep # Copy (not symlink) workspace deps so builds match what ships injectWorkspacePackages: true # Install the package manager version pinned in package.json managePackageManagerVersions: true ``` ## Monorepo: catalogs > Workspace-only — a single-package repo has nothing to share, so skip this. When several workspace packages share a dependency, pin its version **once** in a catalog so they can never drift apart. Define a default catalog (and optional named catalogs for staged migrations); packages then reference `catalog:` instead of a literal range. ```yaml # pnpm-workspace.yaml catalog: react: ^18.2.0 react-dom: ^18.2.0 catalogs: # referenced as "catalog:react17" react17: react: ^17.0.2 react