@savvy-web/pnpm-plugin-silk

Warning

Development of this package has been moved to the savvy-web/systems monorepo. Source code live in the packages/pnpm-plugin-silk folder. No further code updates will be published here.

Centralized dependency version management for the Silk ecosystem via pnpm config dependencies. Share curated dependency catalogs, security overrides and build configurations across multiple repositories from a single source of truth.

Features

• Dual catalog strategy — Current versions for direct dependencies (catalog:silk), permissive ranges for peer dependencies (catalog:silkPeers)
• Security overrides — Centralized CVE fixes via overrides that propagate to all consuming repositories
• Build allowlist — allowBuilds map (pnpm 11) controls which packages may run install scripts; local repos can extend it per-key
• Security defaults — strictDepBuilds, blockExoticSubdeps and minimumReleaseAge are enforced by default; weakening them triggers a prominent warning
• Workspace settings inheritance — publicHoistPattern, packageExtensions, allowedDeprecatedVersions, supportedArchitectures and auditConfig all merge into child workspaces
• Peer dependency rules — Syncs peerDependencyRules (allowedVersions, ignoreMissing, allowAny) to suppress common peer warnings
• Effect ecosystem management — 26 coordinated @effect/* packages across eight functional groups with compatible version resolution
• Non-destructive merging — Local definitions always take precedence, with clear warnings for divergences

Install

Add as a config dependency using pnpm:

pnpm add --config @savvy-web/pnpm-plugin-silk

This adds the package to your pnpm-workspace.yaml with the required integrity hash (pnpm fills in the version and hash automatically):

configDependencies:
  "@savvy-web/pnpm-plugin-silk": "npm:@savvy-web/pnpm-plugin-silk@<version>+sha512-..."

Quick start

Reference Silk catalogs in your package.json:

{
  "devDependencies": {
    "typescript": "catalog:silk",
    "vitest": "catalog:silk"
  },
  "peerDependencies": {
    "typescript": "catalog:silkPeers"
  }
}

The silk catalog provides current/latest versions for direct dependencies, while silkPeers provides permissive ranges for peer dependencies. Security overrides, build script allowlists and hoist patterns are automatically merged during pnpm install.

Documentation

• Configuration — Catalogs, overrides, Effect ecosystem packages, allowBuilds, security settings and workspace configuration
• How it works — Architecture overview, merge strategy and bundle details
• Troubleshooting — Common issues and solutions

More information

• Changelog — Release history
• Contributing — Development setup and guidelines
• Security Policy — Vulnerability reporting
• Code of Conduct — Community guidelines

License

MIT