One catalog.
A connected workspace.

Start with a default catalog

Define your ranges in pnpm-workspace.yaml, then reference them with catalog:in each package.json. Dep Beacon analyzes the resolved range, not the catalog reference itself.

catalog:
  react: ^19.0.0
  react-dom: ^19.0.0

{
  "dependencies": {
    "react": "catalog:",
    "react-dom": "catalog:"
  }
}

Name a shared set of versions

Named catalogs let packages choose a specific version policy. Here, catalog:react19resolves the matching entry under catalogs.react19.

catalogs:
  react19:
    react: ^19.0.0
    react-dom: ^19.0.0

{
  "dependencies": {
    "react": "catalog:react19",
    "react-dom": "catalog:react19"
  }
}

Bring the rest of your policy along

overrides

Central dependency overrides receive the same version and security signals as package manifests.

packageExtensions

Additional dependency mappings participate in workspace analysis too.

.yaml or .yml

Both supported workspace filenames work in VS Code and Zed.