onlyBuiltDependencies location: package.json vs pnpm-workspace.yaml

[hyperknot]

In my repos, this onlyBuiltDependencies is getting inserted randomly between package.json and pnpm-workspace.yaml.

Is there any way to control this? What does it depend on?

Also, do you have workaround for enabling some packages globally? For example, every single time I use vite, I have to enable esbuild. I'd love to select esbuild once and then never be asked about if I want to trust it or not.