packages:
  - "packages/*"
  - "apps/*"
  - "tooling/*"
  - "tools/*"
  - "docs"

nodeLinker: hoisted

# Refuse to install a version whose publish trust (trusted publisher or
# provenance) is weaker than an earlier version of the same package, which is
# what a takeover with a stolen publish token looks like.
trustPolicy: no-downgrade
# Exact versions only, so later releases of these packages are still checked.
# Each was hand-published by the package's long-time maintainer (without CI
# provenance) after other releases had started shipping with it. Review the
# publisher and release history on npm before adding an entry here.
trustPolicyExclude:
  # paulmillr, after 3.6.0 shipped with provenance.
  - chokidar@4.0.3
  # lukastaegert, a 2.x backport after 4.x moved to trusted publishing.
  - rollup@2.80.0
  # lukekarrys (npm team), a 6.x backport after 7.5.1 shipped with provenance.
  - semver@6.3.1
  # faisalman (the author), 1.x maintenance after 2.0 prereleases had provenance.
  - ua-parser-js@1.0.41
# Only direct dependencies may come from git repos or tarball URLs. This is
# already pnpm 11's default; it's set explicitly so a future default change
# can't silently turn it off.
blockExoticSubdeps: true

allowBuilds:
  "@sentry/cli": true
  "@swc/core": true
  better-sqlite3: true
  esbuild: true
  re2: true
  sharp: true
  tesseract.js: true
  # These install scripts are informational or unnecessary for our installs.
  "@parcel/watcher": false
  core-js: false
  core-js-pure: false
  postman-code-generators: false
  protobufjs: false

patchedDependencies:
  react-tweet@3.2.2: "patches/react-tweet@3.2.2.patch"
  xcode@3.0.1: "patches/xcode@3.0.1.patch"
  # Swift 6.2 / Xcode 26 rejects `weak let`; rewrite to `nonisolated(unsafe) weak var`.
  expo-modules-jsi@57.1.1: patches/expo-modules-jsi@57.1.1.patch
  # Disables React 19.2's dev "component performance track" prop serialization,
  # which crashes when a changed prop is a tRPC proxy (RN 0.86 + new arch).
  react-native@0.86.3: patches/react-native@0.86.3.patch
  # Android: don't drop shares that arrive while the app is being recreated after
  # process death, and don't replay the task's launch share on reopen (#513).
  expo-share-intent@8.0.1: patches/expo-share-intent@8.0.1.patch
  # Detach service worker targets that Chrome reports without a browserContextId
  # instead of failing an assertion that crashes connectOverCDP().
  patchright-core@1.59.4: patches/patchright-core@1.59.4.patch

# Docker builds can prune packages that use one of the root patches.
allowUnusedPatches: true

minimumReleaseAgeExclude: [
    "@next/bundle-analyzer@16.4.1",
    "@next/env@16.4.1",
    "@next/swc-darwin-arm64@16.4.1",
    "@next/swc-darwin-x64@16.4.1",
    "@next/swc-linux-arm64-gnu@16.4.1",
    "@next/swc-linux-arm64-musl@16.4.1",
    "@next/swc-linux-x64-gnu@16.4.1",
    "@next/swc-linux-x64-musl@16.4.1",
    "@next/swc-win32-arm64-msvc@16.4.1",
    "@next/swc-win32-x64-msvc@16.4.1",
    next@16.4.1,
    liteque@0.10.0,
    "@astrojs/react@6.0.6",
    # Better Auth's Nov 3, 2026 security release.
    "@better-auth/core@1.7.16",
    "@better-auth/drizzle-adapter@1.7.16",
    "@better-auth/kysely-adapter@1.7.16",
    "@better-auth/memory-adapter@1.7.16",
    "@better-auth/mongo-adapter@1.7.16",
    "@better-auth/prisma-adapter@1.7.16",
    "@better-auth/telemetry@1.7.16",
    better-auth@1.7.16,
    better-call@1.4.5,
  ]

overrides:
  # 6.1.3's CVE fix breaks Tailwind 3's `:merge(.group)` variant transform.
  "tailwindcss@3.4.1>postcss-selector-parser": 6.1.4
  # OpenAPI's Postman converter pins both YAML parsers to vulnerable releases.
  "openapi-to-postmanv2@6>js-yaml": 4.3.2
  "openapi-to-postmanv2@6>yaml": 1.10.3
  # The current OpenTelemetry exporters pin older 2.x core versions exactly.
  "@opentelemetry/core@>=2.0.0 <2.8.0": 2.8.0
  # refractor 3 restricts prismjs to ~1.27.0.
  "refractor@3>prismjs": 1.30.0
  # Docusaurus's webpack plugins require v6. v7 keeps the API and needs Node 20+.
  "serialize-javascript@>=6.0.0 <7.0.5": 7.0.5
  i18next-fs-backend: 2.6.6
  shell-quote: 1.11.0
  # React Native vendors a renderer built against one exact React version and
  # asserts on it at runtime, so the whole workspace has to agree. React's
  # experimental types also contain unique symbols, so separate @types/react
  # versions are not structurally compatible. Keep these in sync with the
  # versions used by the apps when bumping Expo or React.
  react: 19.2.3
  react-dom: 19.2.3
  "@types/react": 19.2.15
  "@types/react-dom": 19.2.3