Merge pull request #4042 from element-hq/johannes/pnpm-11

Switch to pnpm 11.6.0

.oxlintrc.json

@@ -0,0 +1,125 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["jsdoc", "jsx-a11y", "react", "typescript"],
+  "jsPlugins": [
+    "eslint-plugin-matrix-org"
+    // TODO: Re-enable once oxlint supports lint rules that rely on TypeScript type-awareness.
+    // "eslint-plugin-rxjs"
+  ],
+  "categories": {
+    "correctness": "off"
+  },
+  "options": {
+    "typeAware": true
+  },
+  "env": {
+    "builtin": true
+  },
+  "rules": {
+    "jsdoc/empty-tags": "error",
+    "jsdoc/check-property-names": "error",
+    "jsdoc/require-param-description": "warn",
+    "matrix-org/require-copyright-header": [
+      "error",
+      "/*\nCopyright %%CURRENT_YEAR%% New Vector Ltd.\n\nSPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial\nPlease see LICENSE in the repository root for full details.\n*/\n\n"
+    ],
+    "react/display-name": "error",
+    // TODO: Re-enable once oxlint supports lint rules that rely on TypeScript type-awareness.
+    // "rxjs/no-exposed-subjects": "error",
+    // "rxjs/finnish": [
+    //   "error",
+    //   {
+    //     "names": {
+    //       "^this$": false
+    //     }
+    //   }
+    // ],
+    "no-restricted-imports": [
+      "error",
+      {
+        "paths": [
+          {
+            "name": "matrix-widget-api/src",
+            "message": "Please use matrix-widget-api instead"
+          },
+          {
+            "name": "matrix-widget-api/src/",
+            "message": "Please use matrix-widget-api instead"
+          },
+          {
+            "name": "matrix-widget-api/src/index",
+            "message": "Please use matrix-widget-api instead"
+          },
+          {
+            "name": "matrix-widget-api/lib",
+            "message": "Please use matrix-widget-api instead"
+          },
+          {
+            "name": "matrix-widget-api/lib/",
+            "message": "Please use matrix-widget-api instead"
+          },
+          {
+            "name": "matrix-widget-api/lib/index",
+            "message": "Please use matrix-widget-api instead"
+          },
+          {
+            "name": "matrix-js-sdk/src",
+            "message": "Please use matrix-js-sdk instead"
+          },
+          {
+            "name": "matrix-js-sdk/src/",
+            "message": "Please use matrix-js-sdk instead"
+          },
+          {
+            "name": "matrix-js-sdk/src/index",
+            "message": "Please use matrix-js-sdk instead"
+          },
+          {
+            "name": "matrix-js-sdk/lib",
+            "message": "Please use matrix-js-sdk instead"
+          },
+          {
+            "name": "matrix-js-sdk/lib/",
+            "message": "Please use matrix-js-sdk instead"
+          },
+          {
+            "name": "matrix-js-sdk/lib/index",
+            "message": "Please use matrix-js-sdk instead"
+          }
+        ],
+        "patterns": [
+          {
+            "group": [
+              "matrix-widget-api/src",
+              "matrix-widget-api/src/",
+              "matrix-widget-api/src/**",
+              "matrix-widget-api/lib",
+              "matrix-widget-api/lib/",
+              "matrix-widget-api/lib/**"
+            ],
+            "message": "Please use matrix-widget-api instead"
+          },
+          {
+            "group": [
+              "matrix-js-sdk/src",
+              "matrix-js-sdk/src/",
+              "matrix-js-sdk/src/**"
+            ],
+            "message": "Please use matrix-js-sdk instead"
+          }
+        ]
+      }
+    ],
+    "typescript/no-floating-promises": "error",
+    "typescript/no-misused-promises": "error",
+    "typescript/promise-function-async": "error",
+    "typescript/require-await": "error",
+    "typescript/await-thenable": "error",
+    "typescript/consistent-type-imports": [
+      "error",
+      {
+        "fixStyle": "inline-type-imports"
+      }
+    ]
+  }
+}

package.json

@@ -147,19 +147,5 @@
     "vitest": "^4.1.5",
     "vitest-axe": "^1.0.0-pre.3"
   },
-  "pnpm": {
+  "packageManager": "pnpm@11.6.0+sha512.9a36518224080c6fe5165afdcfe79bfa118c29be703f3f462b1e32efe1e98e47e8750b148e08286250aad4113cc7993ca413c4e2cd447752708c2ee5751bc95f"
-    "overrides": {
-      "@livekit/components-core>rxjs": "^7.8.1",
-      "@livekit/track-processors>@mediapipe/tasks-vision": "^0.10.18",
-      "minimatch": "^10.2.3",
-      "tar": "^7.5.11",
-      "glob": "^10.5.0",
-      "qs": "^6.14.1",
-      "js-yaml": "^4.1.1",
-      "esbuild": "^0.28.0",
-      "flatted": "^3.4.2",
-      "undici": "^6.24.0"
-    }
-  },
-  "packageManager": "pnpm@10.33.0"
 }

pnpm-workspace.yaml

@@ -1,3 +1,35 @@
-# dependencies where we use branches and hashes in the package.json. But that also use a pre/post install script.
+allowBuilds:
-onlyBuiltDependencies:
+  "@parcel/watcher": true
-  - "matrix-js-sdk"
+  "@sentry/cli": true
+  "@swc/core": true
+  "core-js": true
+  "esbuild": true
+  "matrix-js-sdk@https://codeload.github.com/matrix-org/matrix-js-sdk/tar.gz/8c95727b6278fe7942c20d0b9485f984dd0694b7": true
+  "protobufjs": true
+overrides:
+  # We need compatible versions of RxJS in our dependencies and LiveKit's dependencies, but
+  # LiveKit has pinned it to a very specific version which is now holding us back from updating.
+  # See livekit/components-js#1101 for a request for a proper solution.
+  "@livekit/components-core>rxjs": "^7.8.1"
+  # Dedupe Mediapipe dependencies.
+  "@livekit/track-processors>@mediapipe/tasks-vision": "^0.10.18"
+  # Security fix: https://security-tracker.debian.org/tracker/CVE-2026-31802
+  "tar": "^7.5.11"
+  # Security fixes:
+  # - https://github.com/advisories/GHSA-7r86-cg39-jmmj
+  # - https://github.com/advisories/GHSA-23c5-xmqv-rm74
+  "minimatch": "^10.2.3"
+  # Security fix: https://github.com/element-hq/element-call/security/dependabot/109
+  "glob": "^10.5.0"
+  # Security fixes:
+  # - https://github.com/element-hq/element-call/security/dependabot/110
+  # - https://github.com/element-hq/element-call/security/dependabot/122
+  "qs": "^6.14.1"
+  # Security fix: https://github.com/element-hq/element-call/security/dependabot/106
+  "js-yaml": "^4.1.1"
+  # Storybook declares support for 0.27.0 only but empirically works fine with 0.28.0.
+  "esbuild": "^0.28.0"
+  # Multiple security fixes: https://github.com/nodejs/undici/releases/tag/v6.24.0
+  "undici": "^6.24.0"
+  # Security fix: https://github.com/advisories/GHSA-rf6f-7fwh-wjgh
+  "flatted": "^3.4.2"