packages:
  - apps/*
  - packages/*
allowBuilds:
  "@parcel/watcher": true
  "@prisma/client": true
  "@prisma/engines": true
  "@swc/core": true
  # Astro (apps/docs) bundles through esbuild; its postinstall only re-checks
  # the platform binary the optional dependency already installed.
  esbuild: false
  # Pulled in by @scalar/api-reference (apps/docs), whose prebuilt standalone
  # bundle is all the docs copy; vue-demi's Vue 2/3 switch never runs there.
  vue-demi: false
  # prisma-erd-generator pulls puppeteer, but the .md ERD target never launches
  # a browser, so we skip its Chromium download. @scarf/scarf is opt-in analytics.
  "@scarf/scarf": false
  # Only needed for source-map upload during build (not set up yet — see
  # docker-compose.glitchtip.yml's GlitchTip section, "not for now" call).
  "@sentry/cli": false
  # Its postinstall only copies the browser Service Worker script; the web
  # component tests use msw/node, which intercepts fetch without it.
  msw: false
  prisma: true
  puppeteer: false
  unrs-resolver: true
minimumReleaseAgeExclude:
  - "js-yaml@4.3.1"
  - "brace-expansion@1.1.18"
  - "otpauth@9.5.2"
overrides:
  cookie@<0.7.0: ^0.7.0
  mysql2@<3.22.0: ^3.22.0
  nanoid@<3.3.18: ^3.3.18
  # Share one compatible Fastify version across Nest and the API to avoid
  # incompatible FastifyInstance types in main.ts.
  fastify: ^5.12.3
  # Transitive-only vulnerable versions (fastify's ajv/fast-json-stringify,
  # unleash-client's make-fetch-happen, prisma/lhci and the docs build chains),
  # none reachable from user input — forced to the first patched release.
  fast-uri@>=3.0.0 <3.1.8: ^3.1.8
  fast-uri@>=4.0.0 <4.1.5: ^4.1.5
  brace-expansion@>=4.0.0 <5.0.12: ^5.0.12
  http-cache-semantics@<4.3.0: ^4.3.0
  source-map-js@>=1.0.0 <1.2.2: ^1.2.2
  postcss-selector-parser@<7.1.6: ^7.1.6
  "@ai-sdk/provider-utils@>=4.0.0-beta.10 <4.0.33": ^4.0.33
  deepmerge-ts@<8.0.0: ^8.0.0
  tmp@<0.2.6: ^0.2.6
  uuid@<11.1.1: ^11.1.1
  qs@<6.16.0: ^6.16.0
  basic-ftp@<=6.2.0: ^6.2.1
  happy-dom@>=17.0.0 <=21.0.3: ^21.0.4
  zod@<4.6.6: ^4.6.6
  # Reaches the API image through @sentry/bundler-plugins and cacache.
  glob@>=13.0.0 <14.0.2: ^14.0.2
# @nestjs/platform-fastify imports rxjs without declaring it, so it used
# whichever rxjs pnpm hoisted — rxjs 6 once apps/docs joined the workspace,
# which crashes the API at boot. Declared here, it gets the app's rxjs 7.
packageExtensions:
  # Vitest browser mocking still imports msw/core/http, removed in MSW 3.
  "@vitest/mocker@5.0.3":
    dependencies:
      msw: ^2.15.0
  "@nestjs/platform-fastify":
    peerDependencies:
      rxjs: ^7.1.0