chore: consume published inventories, and stop exempting graphql

[pyramation]

Switches this workspace to the two published inventories and closes an exemption that reached further than intended.

The problem

To exempt the graphile v5 stack from the release-age wait, this repo listed an upstream npm account under maintainers. That account also co-maintains graphql — the reference implementation — so pnpm-workspace.yaml on main carries:

minimumReleaseAgeExclude:
  - graphql

along with graphiql, monaco-graphql, graphql-language-service and the four @graphiql/* packages.

graphql has six maintainers. A compromise of any one of those accounts published a release this workspace installed immediately, with no wait — which is the exact scenario minimumReleaseAge exists to prevent, on one of the most depended-upon packages in the ecosystem.

maintainers is a delegation as wide as everything an account will ever publish. Fine for accounts we control; wrong for anyone who also maintains popular upstream software.

The change

inventory:
  - "@constructive-io/pnpm-policy/inventory.json"
  - "@constructive-io/pnpm-policy-graphile/inventory.json"

pnpm-policy merges them (constructive-io/dev-utils#116). The graphile one (constructive-io/dev-utils#117) enumerates 16 package names, derived from what the lockfiles actually resolve and filtered to packages published from Graphile-owned repositories — not from an account.

No npm account is named anywhere in this repo now.

What actually changed in the generated file

-# Exempt from the wait: 6 scope glob(s), 49 first-party package(s), 9 exception(s).
-# First-party membership comes from what <account>, <account> publish on npm...
+# Exempt from the wait: 6 scope glob(s), 41 first-party package(s), 9 exception(s).
+# First-party membership comes from the inventory.

-  - "@graphiql/plugin-doc-explorer"
-  - "@graphiql/plugin-history"
-  - "@graphiql/react"
-  - "@graphiql/toolkit"
-  - graphiql
-  - graphql
-  - graphql-language-service
-  - monaco-graphql

All 16 graphile packages remain exempt — grafast, grafserv, postgraphile, graphile-build, graphile-build-pg, graphile-config, graphile-utils, pg-sql2, pg-introspection, tamedevil, ruru, ruru-types, @dataplan/json, @dataplan/pg, @graphile/lru, @graphile-contrib/pg-many-to-many. Nothing about upgrading Graphile gets slower.

The eight above now wait two days like any other third-party dependency. We upgrade graphql rarely, so that costs nothing.

Deletes the local inventory

pnpm-policy.inventory.json (1041 lines) is gone. The list lived in two places, went stale independently of the published one, and had to be reviewed by hand. Both sources are pinned packages now, so a change to what skips the wait arrives as a version bump you can review rather than an edit to a thousand-line file in this repo.

policy:refresh goes with it — refreshing happens where the inventories are published.

Verification

pnpm-policy check      ✓ pnpm-workspace.yaml matches the policy
pnpm-policy generate   ✓ deterministic — second run byte-identical
exemption list         49 first-party names -> 41
graphile allowlist     16/16 present
forbidden names        none

Note on the lockfile

The 32-line lockfile diff is hand-spliced: the two new packages plus the pnpm-policy bump, with pnpm's own integrity hashes. Regenerating rewrote 10,283 lines and changed 59 resolutions — the committed lockfile was written by a different pnpm major, so any write re-resolves peer permutations. That churn does not belong in a policy PR. CI runs plain pnpm install, which will reconcile anything it needs to.

Pinned: @constructive-io/pnpm-policy@0.3.1, @constructive-io/pnpm-policy-graphile@0.2.0, pnpm-policy@^0.4.0.

Refs constructive-io/constructive-planning#1464

🤖 Generated with Claude Code

https://claude.ai/code/session_01CEswUi4ANuB58rva48aHge

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​constructive-io/​pnpm-policy-graphile@​0.2.0
	@​constructive-io/​pnpm-policy@​0.3.1
	pnpm-policy@​0.4.0

View full report