Resolves the sole open Dependabot alert (GHSA-gv7w-rqvm-qjhr, high):
esbuild <0.28.1 lacks binary-integrity verification in its Deno install
path, enabling RCE via NPM_CONFIG_REGISTRY. The pnpm `overrides` entry
pinned the entire tree to esbuild 0.25.0; bump it to 0.28.1, which fixes
all transitive paths (vite, vitest, tsx, vite-node, esbuild-register).
Also bump turbo 2.9.14 -> 2.9.18 in the workspace catalog and the four
pinned production Dockerfiles (web, live, admin, space).
Verified: `pnpm audit` clean, admin react-router/vite build succeeds,
@plane/codemods vitest suite 33/33 passing.
* chore: bump turbo to 2.9.14, migrate pnpm config to workspace yaml
- Bump turbo from 2.9.4 to 2.9.14 in root package.json and the
four production Dockerfiles (web, live, admin, space).
- Move pnpm.overrides, onlyBuiltDependencies, and
ignoredBuiltDependencies from package.json into pnpm-workspace.yaml.
pnpm v10+ no longer reads the pnpm field in package.json, so the
full overrides block and most of onlyBuiltDependencies were being
silently ignored.
- Add @plane/utils as a workspace dependency to the live server.
* chore: drop unused allowBuilds block, bump lodash-es to 4.18.1
- Remove the `allowBuilds` block from pnpm-workspace.yaml. It is not
a recognized pnpm v10/v11 key and its values were inconsistent with
the actual `onlyBuiltDependencies` / `ignoredBuiltDependencies`
configuration.
- Bump `lodash-es` catalog entry from 4.18.0 to 4.18.1. With overrides
now applied workspace-wide, 4.18.0 (marked deprecated as a "bad
release") was being enforced everywhere.
* fix: use pnpm v11 allowBuilds in place of removed legacy keys
`onlyBuiltDependencies` and `ignoredBuiltDependencies` were removed
in pnpm v11. They were being silently ignored on this branch, which
caused `ERR_PNPM_IGNORED_BUILDS` to fail CI under `--frozen-lockfile`.
Replace them with the v11-native `allowBuilds:` block, mapping the
previous allowlist to `true` and the previous denylist (sharp) to
`false`. Locally verified that the build scripts for @parcel/watcher,
@swc/core, esbuild, and msgpackr-extract now run on install.
* chore: moved app & space from apps to root
* chore: modified workspace configuration
* chore: modified dockerfiles for space and web
* chore: modified icons for space
* feat: updated files for new svg icons supported by next-images
* chore: added /spaces base path for next
* chore: added compose config for space
* chore: updated husky configuration
* chore: updated workflows for new configuration
* chore: changed app name to web
* fix: resolved build errors with web
* chore: reset file tracing root for both projects
* chore: added nginx config for deploy
* fix: eslint and tsconfig settings for space app
* husky setup fixes based on new dir
* eslint fixes
* prettier formatting
---------
Co-authored-by: Henit Chobisa <chobisa.henit@gmail.com>
* chore: Added Dockerfile for Space Project
* fix: next js config to standalone mode
* fix: workedaround build error with rename 404 page
* chore: modified dockerfile with new conventions
* chore: modified dockercompose file for new plane-deploy
* fix: handled ts errors with possibly undefined states
* chore: updated main dockerfile with plane-deploy
* feat: included space project to start.sh
* chore: modified space project port while running in production
* chore: restored changes inside space project
* chore: added ngnix config for space project running :4000
* fix: Updated docker-compose files
* chore: added space url for ngnix config
* chore: Updated ngnix template
* chore: updated space url in compose hub file
* dev: updated dockerfile.space and start and replace script
* dev: equate hub and build docker files
* dev: revert workspace space page
---------
Co-authored-by: NarayanBavisetti <narayan3119@gmail.com>
