packages:
  - apps/*
  - packages/*
  - infra

catalog:
  '@types/react': ^19.3.0
  '@types/react-dom': ^19.3.0
  react: ^19.3.0
  react-dom: ^19.3.0
  react-router: ^8.4.0
  # tsrs ports one exact TypeScript build (`tsrs --version` prints it), and
  # `typescript` is pinned to that build so the editor and every tool peering on
  # it see the compiler CI checks with. Bump the two together.
  tsrs: 0.21.0-ts7.1.0-beta
  typescript: 7.1.0-beta
  zod: ^4.6.7

overrides:
  '@types/react': "catalog:"
  '@types/react-dom': "catalog:"
  browserslist: ^4.28.7
  dompurify: ^3.4.0
  esbuild: ^0.28.1
  file-type: ^22.1.1
  # A CVE floor across a major: GHSA-3g3m-2fjr-6pw4 is fixed only in 14.0.2,
  # while react-email, @sentry/bundler-plugins and the Storybook docgen plugin
  # still ask for ^13. None of them uses what 14 removed (the `debug` option)
  # or changed (ignore patterns starting with `/`).
  glob: ^14.0.3
  # Apollo Server only supports graphql 16 (@apollo/server 5.5.1 peers on
  # ^16.11.0), so 17 waits for apollographql/apollo-server#8220. The override
  # rewrites that peer range too: pnpm reports no conflict even when it is
  # raised past what Apollo supports.
  graphql: 16.14.2
  ip-address: ^10.7.4
  lodash: ^4.17.23
  lodash-es: ^4.18.1
  # A floor, not a cap: graphql-config still needs minimatch 10, while glob 14
  # and the backend, which matches user-defined globs, take 11.
  minimatch@<10.2.6: ^10.2.6
  react: "catalog:"
  react-dom: "catalog:"
  react-router: "catalog:"
  sharp: ^0.35.5
  # A nightly falls outside every peer range, which would pull in a second
  # TypeScript for msw and tsdown.
  typescript: "catalog:"
  uuid: ^14.0.0
  undici: ^8.12.2
  ws: ^8.20.1

allowBuilds:
  "@apollo/protobufjs": true
  "@parcel/watcher": true
  "@tailwindcss/oxide": true
  esbuild: true
  # Its postinstall refetches the domain list from three remote sources and
  # rewrites domains.json, so the installed content would vary per install and
  # escape the lockfile — and the install fails outright whenever a source is
  # down. Blocked: we take the deterministic published snapshot instead, and
  # top it up in src/util/public-email-domains.ts.
  free-email-domains: false
  msw: true
  odiff-bin: true
  oxc-resolver: true
  sharp: true

minimumReleaseAgeExclude:
  - "@argos-ci/*"

# Base UI clears the shared tooltip's pending close whenever any trigger
# unmounts, leaving a tooltip open after the pointer leaves. Re-check on every
# upgrade: the Tooltip story "Closes When Another Trigger Unmounts" fails
# without the patch.
patchedDependencies:
  '@base-ui/react@1.9.0': patches/@base-ui__react@1.9.0.patch