From 1e8e004361c6ebf7b9ae86ee77d8dfa0457b723c Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Wed, 13 May 2026 10:58:48 +0100
Subject: [PATCH] build(pnpm): restore exotic subdependency blocking

---
 pnpm-workspace.yaml                 | 1 +
 test/package-manager-config.test.ts | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index e04545b8ae8..3a50f9ce38a 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -36,6 +36,7 @@ minimumReleaseAgeExclude:
   - "sqlite-vec-*"
 
 nodeLinker: hoisted
+blockExoticSubdeps: true
 
 overrides:
   "@anthropic-ai/sdk": 0.95.1
diff --git a/test/package-manager-config.test.ts b/test/package-manager-config.test.ts
index 6de97c23b99..a7d70cf837a 100644
--- a/test/package-manager-config.test.ts
+++ b/test/package-manager-config.test.ts
@@ -4,6 +4,7 @@ import { parse } from "yaml";
 
 type PnpmBuildConfig = {
   allowBuilds?: Record<string, boolean>;
+  blockExoticSubdeps?: boolean;
   ignoredBuiltDependencies?: string[];
   onlyBuiltDependencies?: string[];
 };
@@ -25,6 +26,7 @@ describe("package manager build policy", () => {
 
     expect(packageJson.pnpm).toBeUndefined();
     expect(workspace.allowBuilds?.["@discordjs/opus"]).toBe(false);
+    expect(workspace.blockExoticSubdeps).toBe(true);
     expect(workspace.onlyBuiltDependencies).toBeUndefined();
   });
 });