pnpm-workspace.yaml

packages:
  - apps/*
  - packages/*

# Avoid implicit installs (and repeated workspace lifecycle scripts) before
# every `pnpm run` and `pnpm exec`; CI and setup invoke install explicitly.
verifyDepsBeforeRun: false

catalog:
  "@boxicons/react": ^1.0.3
  clsx: ^2.1.1
  date-fns: ^4.1.0
  lodash: ^4.17.23
  motion: ^12.23.28
  next: 15.5.21
  next-intl: 4.13.4
  react: 19.2.6
  react-dom: 19.2.6
  vitest: 4.1.8

# Class merging must follow the Tailwind generation that authored the classes.
# Shared UI packages remain on the v4 merger to preserve their existing output
# while the workspace contains both Tailwind 3 and Tailwind 4 applications.
catalogs:
  tailwind3:
    tailwind-merge: ^2.6.1
  tailwind4:
    tailwind-merge: ^3.3.1

overrides:
  # @vercel/blob permits ^3.6.1; retain the aged OIDC release until the
  # newer release clears the package-age policy.
  "@vercel/oidc": 3.6.1
  # Keep transitive build tooling on the release patched for GHSA-g7r4-m6w7-qqqr.
  "esbuild@>=0.17.0 <0.28.1": 0.28.1
  # Pin transitive releases containing the latest Immutable.js 5 security fixes.
  "immutable@>=5.0.0-beta.1 <5.1.8": 5.1.9
  # Keep transitive PostCSS consumers on a release patched for
  # GHSA-6g55-p6wh-862q and GHSA-r28c-9q8g-f849.
  "postcss@<=8.5.17": 8.5.18
  # Keep transitive nanoid consumers (postcss, @ai-sdk/provider-utils) on the
  # release patched for GHSA-2v37-7h3g-55p8.
  "nanoid@<3.3.18": 3.3.18
  # Sentry's glob 9 dependency resolves minimatch 8, whose brace-expansion 2
  # fix is still inside the package-age quarantine window. Use the compatible
  # minimatch 9 release already present in the workspace instead.
  "glob@9.3.5>minimatch": 9.0.7
  # Next.js 15 still requests Sharp 0.34, so force its optional dependency onto
  # the current patched release containing the updated libvips binaries.
  "sharp@<0.35.0": 0.35.3
  # @databricks/sql 2 requires Thrift's UUID dependency to remain CJS-compatible.
  # Package-level overrides are not inherited by pnpm consumers.
  "thrift@0.23.0>uuid": 11.1.1

auditConfig:
  ignoreGhsas:
    # image-size has not published the >=2.0.3 patched release yet. Fumadocs
    # only uses it for trusted, repository-owned assets; remove these ignores
    # as soon as the patched release is available.
    - GHSA-5p2g-fcmc-qvqq
    - GHSA-w3rx-r6r6-pgpr

allowBuilds:
  "@parcel/watcher": true
  "@sentry/cli": true
  "@swc/core": true
  bigint-buffer: true
  bufferutil: true
  core-js: false
  esbuild: true
  lz4: true
  sharp: true
  utf-8-validate: true