pnpm-workspace.yaml

packages:
  - "apps/*"
  - "packages/*"
  - "e2e"

publicHoistPattern:
  - "@takumi-rs/core-*"

overrides:
  # GHSA-67mh-4wv8-2f99 (drizzle-kit's @esbuild-kit loader asks for the 0.18 line) and
  # GHSA-g7r4-m6w7-qqqr (dev-server arbitrary file read on Windows).
  esbuild: "^0.28.1"
  seroval: "^1.5.3" # GHSA-mv8w-475r-vwqw: prototype pollution while deserializing
  # samlify is on the 0.8 line, and 0.9 is a rewrite with a different parser API.
  "@xmldom/xmldom": "~0.8.15"
  uuid: "^14.0.2" # GHSA-w5hq-g745-h8pq; also anchors the direct dep in apps/web
  # The bruno CLI is the only thing pulling these in, and only for the e2e API suite.
  form-data: "^4.0.6" # GHSA-hmw2-7cc7-3qxx
  axios: "^1.18.0" # GHSA-gcfj-64vw-6mp9, GHSA-xj6q-8x83-jv6g, and seven more
  "@faker-js/faker": "^10.4.1" # GHSA-qxc2-j82w-r537
  csv-parse: "^7.0.2" # GHSA-8cw4-87c7-c6xx
  "@ai-sdk/provider-utils@^4": "^4.0.33"
  # @usebruno/cli pins these exactly; only the e2e API suite pulls them in.
  "js-yaml@^4": "^4.3.2" # GHSA-2883-xcg3-v3hh
  "yaml@^2": "^2.8.3" # GHSA-48c2-rrv3-qjmp
  # @tailwindcss/typography pins 6.0.10, and the fix only exists on the 7 line.
  postcss-selector-parser: "^7.1.6" # GHSA-rj75-hqrm-r3gf
  "@scalar/json-magic>undici": "^7.29.1" # GHSA-4cwx-7wf7-3272, GHSA-rfgv-xxqx-mfg5, and four more

allowBuilds:
  "@tailwindcss/oxide": true
  esbuild: true
  msgpackr-extract: true
  puppeteer: true
  sharp: true
  unrs-resolver: true
  "@sentry/cli": true # postinstall downloads the sentry-cli binary
  "@scarf/scarf": false
  "@tree-sitter-grammars/tree-sitter-yaml": false
  core-js: false
  core-js-pure: false
  msw: false
  protobufjs: false
  tree-sitter: false
  tree-sitter-json: false
  # Optional peers of better-auth/drizzle-orm for adapters we don't use; we
  # only ever talk to Postgres, so neither native build is needed.
  "@prisma/client": false
  better-sqlite3: false
  # Scalar's reference renderer is Vue under the hood. vue-demi's postinstall
  # only re-points its shim at the installed Vue major, and it ships built for
  # Vue 3 already, which is the only Vue in this tree.
  vue-demi: false

blockExoticSubdeps: true
minimumReleaseAge: 5760
trustPolicy: no-downgrade
trustPolicyIgnoreAfter: 129600