ci: pnpm trustPolicy no-downgrade exclude chokidar@4.0.3 by Sheraff · Pull Request #7643 · TanStack/router

Sheraff · 2026-06-16T08:07:25Z

chokidar 4.0.3 (and 4.0.2) are known to be trust policy downgrades, but are safe. The maintainers do not plan on fixing this issue, to encourage the ecosystem to move to 5.0.0

However for us, it's also "the ecosystem" that is blocking us: we depend directly on 5.0.0, but transitively depend on 4.0.3 (sass, prisma, netlify, ...)

Because this problem is known, and 4.0.3 is known to be safe, and there should not be any more 4.x.x releases, we should be ok to just exclude 'chokidar@4.0.3' exactly from pnpm's trust policy rule.

Summary by CodeRabbit

Chores
- Updated workspace dependency configuration to adjust trust policy handling.

coderabbitai · 2026-06-16T08:07:47Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2d3817ac-92cf-4f9e-807b-8011b3661ebf

📥 Commits

Reviewing files that changed from the base of the PR and between a415471 and 22a7c7f.

📒 Files selected for processing (1)

pnpm-workspace.yaml

📝 Walkthrough

Walkthrough

pnpm-workspace.yaml gains a trustPolicyExclude list containing chokidar@4.0.3, exempting that specific package version from the existing trustPolicy: 'no-downgrade' workspace rule.

Changes

pnpm Trust Policy Exclusion

Layer / File(s)	Summary
Exclude chokidar@4.0.3 from no-downgrade policy `pnpm-workspace.yaml`	Adds a `trustPolicyExclude` section listing `chokidar@4.0.3` so it is not subject to the workspace-level `no-downgrade` trust policy.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

TanStack/router#7425: Also modifies pnpm-workspace.yaml to configure trustPolicy: 'no-downgrade', which is the same setting this PR extends with a trustPolicyExclude entry.

Poem

A hop through the config, a quick little skip,
Chokidar's exempted with one tiny snip.
No downgrade shall block it, the policy bends,
A rabbit adjusts where the trust policy ends.
🐇✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding a trustPolicy no-downgrade exclusion for chokidar@4.0.3 in pnpm-workspace.yaml, which directly matches the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch ci-pnpm-trust-policy-exclude-chokidar-4-0-3

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

nx-cloud · 2026-06-16T08:08:02Z

View your CI Pipeline Execution ↗ for commit 22a7c7f

Command	Status	Duration	Result
`nx run-many --target=build --exclude=examples/*...`	✅ Succeeded	2m 17s	View ↗
`nx affected --targets=test:eslint,test:unit,tes...`	✅ Succeeded	<1s	View ↗

☁️ Nx Cloud last updated this comment at 2026-06-16 08:10:42 UTC

github-actions · 2026-06-16T08:08:16Z

🚀 Changeset Version Preview

3 package(s) bumped directly, 10 bumped as dependents.

🟩 Patch bumps

Package	Version	Reason
`@tanstack/react-router`	1.170.15 → 1.170.16	Changeset
`@tanstack/solid-router`	1.170.15 → 1.170.16	Changeset
`@tanstack/start-server-core`	1.169.14 → 1.169.15	Changeset
`@tanstack/react-start`	1.168.25 → 1.168.26	Dependent
`@tanstack/react-start-client`	1.168.13 → 1.168.14	Dependent
`@tanstack/react-start-rsc`	0.1.24 → 0.1.25	Dependent
`@tanstack/react-start-server`	1.167.19 → 1.167.20	Dependent
`@tanstack/solid-start`	1.168.25 → 1.168.26	Dependent
`@tanstack/solid-start-client`	1.168.13 → 1.168.14	Dependent
`@tanstack/solid-start-server`	1.167.19 → 1.167.20	Dependent
`@tanstack/start-plugin-core`	1.171.17 → 1.171.18	Dependent
`@tanstack/vue-start`	1.168.24 → 1.168.25	Dependent
`@tanstack/vue-start-server`	1.167.19 → 1.167.20	Dependent

pkg-pr-new · 2026-06-16T08:12:05Z

More templates

@tanstack/arktype-adapter

npm i https://pkg.pr.new/@tanstack/arktype-adapter@7643

@tanstack/eslint-plugin-router

npm i https://pkg.pr.new/@tanstack/eslint-plugin-router@7643

@tanstack/eslint-plugin-start

npm i https://pkg.pr.new/@tanstack/eslint-plugin-start@7643

@tanstack/history

npm i https://pkg.pr.new/@tanstack/history@7643

@tanstack/nitro-v2-vite-plugin

npm i https://pkg.pr.new/@tanstack/nitro-v2-vite-plugin@7643

@tanstack/react-router

npm i https://pkg.pr.new/@tanstack/react-router@7643

@tanstack/react-router-devtools

npm i https://pkg.pr.new/@tanstack/react-router-devtools@7643

@tanstack/react-router-ssr-query

npm i https://pkg.pr.new/@tanstack/react-router-ssr-query@7643

@tanstack/react-start

npm i https://pkg.pr.new/@tanstack/react-start@7643

@tanstack/react-start-client

npm i https://pkg.pr.new/@tanstack/react-start-client@7643

@tanstack/react-start-rsc

npm i https://pkg.pr.new/@tanstack/react-start-rsc@7643

@tanstack/react-start-server

npm i https://pkg.pr.new/@tanstack/react-start-server@7643

@tanstack/router-cli

npm i https://pkg.pr.new/@tanstack/router-cli@7643

@tanstack/router-core

npm i https://pkg.pr.new/@tanstack/router-core@7643

@tanstack/router-devtools

npm i https://pkg.pr.new/@tanstack/router-devtools@7643

@tanstack/router-devtools-core

npm i https://pkg.pr.new/@tanstack/router-devtools-core@7643

@tanstack/router-generator

npm i https://pkg.pr.new/@tanstack/router-generator@7643

@tanstack/router-plugin

npm i https://pkg.pr.new/@tanstack/router-plugin@7643

@tanstack/router-ssr-query-core

npm i https://pkg.pr.new/@tanstack/router-ssr-query-core@7643

@tanstack/router-utils

npm i https://pkg.pr.new/@tanstack/router-utils@7643

@tanstack/router-vite-plugin

npm i https://pkg.pr.new/@tanstack/router-vite-plugin@7643

@tanstack/solid-router

npm i https://pkg.pr.new/@tanstack/solid-router@7643

@tanstack/solid-router-devtools

npm i https://pkg.pr.new/@tanstack/solid-router-devtools@7643

@tanstack/solid-router-ssr-query

npm i https://pkg.pr.new/@tanstack/solid-router-ssr-query@7643

@tanstack/solid-start

npm i https://pkg.pr.new/@tanstack/solid-start@7643

@tanstack/solid-start-client

npm i https://pkg.pr.new/@tanstack/solid-start-client@7643

@tanstack/solid-start-server

npm i https://pkg.pr.new/@tanstack/solid-start-server@7643

@tanstack/start-client-core

npm i https://pkg.pr.new/@tanstack/start-client-core@7643

@tanstack/start-fn-stubs

npm i https://pkg.pr.new/@tanstack/start-fn-stubs@7643

@tanstack/start-plugin-core

npm i https://pkg.pr.new/@tanstack/start-plugin-core@7643

@tanstack/start-server-core

npm i https://pkg.pr.new/@tanstack/start-server-core@7643

@tanstack/start-static-server-functions

npm i https://pkg.pr.new/@tanstack/start-static-server-functions@7643

@tanstack/start-storage-context

npm i https://pkg.pr.new/@tanstack/start-storage-context@7643

@tanstack/valibot-adapter

npm i https://pkg.pr.new/@tanstack/valibot-adapter@7643

@tanstack/virtual-file-routes

npm i https://pkg.pr.new/@tanstack/virtual-file-routes@7643

@tanstack/vue-router

npm i https://pkg.pr.new/@tanstack/vue-router@7643

@tanstack/vue-router-devtools

npm i https://pkg.pr.new/@tanstack/vue-router-devtools@7643

@tanstack/vue-router-ssr-query

npm i https://pkg.pr.new/@tanstack/vue-router-ssr-query@7643

@tanstack/vue-start

npm i https://pkg.pr.new/@tanstack/vue-start@7643

@tanstack/vue-start-client

npm i https://pkg.pr.new/@tanstack/vue-start-client@7643

@tanstack/vue-start-server

npm i https://pkg.pr.new/@tanstack/vue-start-server@7643

@tanstack/zod-adapter

npm i https://pkg.pr.new/@tanstack/zod-adapter@7643

commit: 22a7c7f

ci: pnpm trustPolicy no-downgrade exclude chokidar@4.0.3

22a7c7f

Sheraff merged commit 734f907 into main Jun 16, 2026
10 checks passed

Sheraff deleted the ci-pnpm-trust-policy-exclude-chokidar-4-0-3 branch June 16, 2026 08:22

coderabbitai Bot mentioned this pull request Jun 23, 2026

add undici 6 to trustPolicyExclude for vite ecosystem ci #7680

Merged

This was referenced Jul 9, 2026

feat: add Descope #7756

Open

fix deps #7810

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

ci: pnpm trustPolicy no-downgrade exclude chokidar@4.0.3#7643

ci: pnpm trustPolicy no-downgrade exclude chokidar@4.0.3#7643
Sheraff merged 1 commit into
mainfrom
ci-pnpm-trust-policy-exclude-chokidar-4-0-3

Sheraff commented Jun 16, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jun 16, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Poem

Uh oh!

nx-cloud Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

pkg-pr-new Bot commented Jun 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

Sheraff commented Jun 16, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Poem

Uh oh!

nx-cloud Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026

🚀 Changeset Version Preview

🟩 Patch bumps

Uh oh!

pkg-pr-new Bot commented Jun 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Sheraff commented Jun 16, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 16, 2026 •

edited

Loading

nx-cloud Bot commented Jun 16, 2026 •

edited

Loading