From bb10e78f30c5d0dae23ac89378b64d68961559ef Mon Sep 17 00:00:00 2001
From: Marcin Panek <m.panek@cksource.com>
Date: Thu, 3 Sep 2026 10:55:15 +0000
Subject: [PATCH] Apply the ratified dependency policy.

---
 .circleci/config.yml |  6 +++---
 pnpm-workspace.yaml  | 11 ++++++++++-
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 99c5368..b5e99d1 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -24,10 +24,10 @@ commands:
           command: sudo corepack disable
       - run:
           name: Install pnpm
-          command: sudo npm i -g pnpm@^11
+          command: sudo npm i -g pnpm@11.14.0
       - run:
           name: Install dependencies
-          command: pnpm install
+          command: pnpm install --frozen-lockfile
 
   install_ssh_keys_command:
     description: "Install SSH keys"
@@ -46,7 +46,7 @@ commands:
     steps:
       - run:
           name: Install npm with CircleCI OIDC support
-          command: sudo npm i -g npm@^11.11.0
+          command: sudo npm i -g npm@11.19.1
       - run:
           name: Get npm OIDC token
           command: |
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index f621073..da9bc80 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -12,11 +12,20 @@ overrides:
 
 minimumReleaseAge: 4320 # 3 days
 minimumReleaseAgeExclude:
+  # Company-owned scopes - every release comes from our own pipelines.
   - '@ckeditor/*'
   - '@cksource/*'
-  - '*ckeditor5*'
+  # Company-owned unscoped names, listed one by one. The `*ckeditor5*` glob used here before
+  # also matched foreign packages with `ckeditor5` in the name - see ckeditor5-internal#4665.
+  - 'ckeditor5' # Owned by the `ckeditor` npm account.
+  - 'ckeditor5-premium-features' # Owned by the `ckeditor` npm account.
+  - 'eslint-config-ckeditor5' # Published from `ckeditor/ckeditor5-linters-config`.
+  - 'eslint-plugin-ckeditor5-rules' # Published from `ckeditor/ckeditor5-linters-config`.
 
 shellEmulator: true
 shamefullyHoist: true
 preferFrozenLockfile: true
 verifyDepsBeforeRun: false
+# Only registry tarballs may enter the tree as subdependencies. Direct git/tarball
+# dependencies stay allowed - see ckeditor/ckeditor5#20216.
+blockExoticSubdeps: true