@savvy-web/pnpm-plugin-silk

Centralized dependency version management for the Silk ecosystem via pnpm config dependencies. Share curated dependency catalogs, security overrides and build configurations across multiple repositories from a single source of truth.

Features

• Dual catalog strategy — Current versions for direct dependencies (catalog:silk), permissive ranges for peer dependencies (catalog:silkPeers)
• Security overrides — Centralized CVE fixes via overrides that propagate to all consuming repositories
• Build allowlist — allowBuilds map (pnpm 11) controls which packages may run install scripts; local repos can extend it per-key
• Security defaults — strictDepBuilds, blockExoticSubdeps and minimumReleaseAge are enforced by default; weakening them triggers a prominent warning
• Workspace settings inheritance — publicHoistPattern, packageExtensions, allowedDeprecatedVersions, supportedArchitectures and auditConfig all merge into child workspaces
• Peer dependency rules — Syncs peerDependencyRules (allowedVersions, ignoreMissing, allowAny) to suppress common peer warnings
• Effect ecosystem management — 26 coordinated @effect/* packages across eight functional groups with compatible version resolution
• Non-destructive merging — Local definitions always take precedence, with clear warnings for divergences

Install

Add as a config dependency using pnpm:

pnpm add --config @savvy-web/pnpm-plugin-silk

This adds the package to your pnpm-workspace.yaml with the required integrity hash (pnpm fills in the version and hash automatically):

configDependencies:
  "@savvy-web/pnpm-plugin-silk": "npm:@savvy-web/pnpm-plugin-silk@<version>+sha512-..."

Quick start

Reference Silk catalogs in your package.json:

{
  "devDependencies": {
    "typescript": "catalog:silk",
    "vitest": "catalog:silk"
  },
  "peerDependencies": {
    "typescript": "catalog:silkPeers"
  }
}

The silk catalog provides current/latest versions for direct dependencies, while silkPeers provides permissive ranges for peer dependencies. Security overrides, build script allowlists and hoist patterns are automatically merged during pnpm install.

Documentation

• Configuration — Catalogs, overrides, Effect ecosystem packages, allowBuilds, security settings and workspace configuration
• How it works — Architecture overview, merge strategy and bundle details
• Troubleshooting — Common issues and solutions

More information

• Changelog — Release history
• Contributing — Development setup and guidelines
• Security Policy — Vulnerability reporting
• Code of Conduct — Community guidelines

License

MIT