packages:
  - 'web'
  - 'web/electron'
  - '.github/ci-deps'
  - 'editors/vscode'
  - 'deploy/cloudflare'
  - 'sdks/web-extension'
  - 'examples/extensions/hello-page/web'

# 7-day dependency cooldown, mirroring the Python-side exclude-newer = "P7D" in uv.toml.
minimumReleaseAge: 10080
# electron 42 is end-of-life; 45.2.1 is the newest stable release and carries
# Chromium security fixes that 45.0.0 lacks. Drop once aged past the cooldown
# (2026-11-07).
minimumReleaseAgeExclude:
  - electron@45.2.1

settings:
  autoInstallPeers: false
  strictPeerDependencies: false

# jest-dom doesn't declare vitest as a (peer) dependency, so under pnpm's store
# layout its `declare module "vitest"` matcher-type augmentation can't resolve
# vitest and silently fails to merge — `tsc` then loses every DOM matcher
# (toBeInTheDocument, toHaveClass, …) though they work at runtime. Re-enable the
# peer so the augmentation resolves. Drop once jest-dom ships the peer upstream.
packageExtensions:
  '@testing-library/jest-dom':
    peerDependencies:
      vitest: '*'

catalog:
  react: ^18.2.0
  react-dom: ^18.2.0
  # KaTeX 0.18.11 was accidentally published with breaking changes.
  katex: 0.18.10
  # Upgrade Shiki and its Monaco adapter together with their shared packages.
  shiki: 4.5.0
  '@shikijs/monaco': 4.5.0
  '@shikijs/core': 4.5.0
  '@shikijs/primitive': 4.5.0
  '@shikijs/engine-javascript': 4.5.0
  '@shikijs/engine-oniguruma': 4.5.0
  '@shikijs/langs': 4.5.0
  '@shikijs/themes': 4.5.0
  '@shikijs/types': 4.5.0
  '@shikijs/transformers': 4.5.0
  '@shikijs/stream': 4.5.0
  vite: 8.1.6
  # Keep workspace test runners and their coverage provider on one release.
  vitest: 4.1.12
  '@vitest/coverage-v8': 4.1.12

overrides:
  # Keep build-tool upgrades explicit and validate their bundles: incompatible
  # Vite/Tailwind chunking can split Shiki incorrectly or lose the PDF worker.
  vite: "catalog:"
  tailwindcss: 4.3.1
  '@tailwindcss/vite': 4.3.1
  '@tailwindcss/node': 4.3.1
  '@tailwindcss/postcss': 4.3.1
  jiti: 2.7.0
  lightningcss: 1.32.0
  postcss: 8.5.29
  browserslist: 4.28.8
  fast-uri: 3.1.9
  '@xmldom/xmldom': 0.8.15
  qs: 6.16.1
  query-string: 9.5.0
  '@hono/node-server': 1.19.15
  hono: 4.13.13
  linkify-it: 5.0.2
  shiki: "catalog:"
  react: "catalog:"
  react-dom: "catalog:"
  dompurify: 3.4.17
  # Math renderers and their imported stylesheet must share the same classes.
  katex: "catalog:"
  mermaid: 11.16.1
  tar: 7.5.21
  'node-gyp>undici': 6.29.1
  # These parents pin a vulnerable release exactly; the patched ones are same-major drop-ins.
  'miniflare>undici': 7.30.1
  '@earendil-works/pi-coding-agent>undici': 8.12.2
  '@tailwindcss/typography>postcss-selector-parser': 6.1.5
  'brace-expansion@>=1.0.0 <2.0.0': 1.1.21
  'brace-expansion@>=2.0.0 <3.0.0': 2.1.7
  'brace-expansion@>=5.0.0 <6.0.0': 5.0.12
  'markdown-it@>=14.0.0 <15.0.0': 14.3.3
  'proxy-addr@>=2.0.0 <3.0.0': 2.0.8
  'source-map-js@>=1.0.0 <2.0.0': 1.2.2
  '@shikijs/core': "catalog:"
  '@shikijs/primitive': "catalog:"
  '@shikijs/engine-javascript': "catalog:"
  '@shikijs/engine-oniguruma': "catalog:"
  '@shikijs/langs': "catalog:"
  '@shikijs/themes': "catalog:"
  '@shikijs/types': "catalog:"
  '@shikijs/transformers': "catalog:"
  '@shikijs/stream': "catalog:"
  '@tiptap/core': 3.31.4
  '@tiptap/extension-blockquote': 3.31.4
  '@tiptap/extension-bold': 3.31.4
  '@tiptap/extension-bubble-menu': 3.31.4
  '@tiptap/extension-bullet-list': 3.31.4
  '@tiptap/extension-code': 3.31.4
  '@tiptap/extension-code-block': 3.31.4
  '@tiptap/extension-document': 3.31.4
  '@tiptap/extension-dropcursor': 3.31.4
  '@tiptap/extension-floating-menu': 3.31.4
  '@tiptap/extension-gapcursor': 3.31.4
  '@tiptap/extension-hard-break': 3.31.4
  '@tiptap/extension-heading': 3.31.4
  '@tiptap/extension-horizontal-rule': 3.31.4
  '@tiptap/extension-image': 3.31.4
  '@tiptap/extension-italic': 3.31.4
  '@tiptap/extension-link': 3.31.4
  '@tiptap/extension-list': 3.31.4
  '@tiptap/extension-list-item': 3.31.4
  '@tiptap/extension-list-keymap': 3.31.4
  '@tiptap/extension-ordered-list': 3.31.4
  '@tiptap/extension-paragraph': 3.31.4
  '@tiptap/extension-strike': 3.31.4
  '@tiptap/extension-table': 3.31.4
  '@tiptap/extension-text': 3.31.4
  '@tiptap/extension-underline': 3.31.4
  '@tiptap/extensions': 3.31.4
  '@tiptap/markdown': 3.31.4
  '@tiptap/pm': 3.31.4
  '@tiptap/react': 3.31.4
  '@tiptap/starter-kit': 3.31.4
  express-rate-limit>ip-address: 10.7.4

allowBuilds:
  '@anthropic-ai/claude-code': true
  '@google/genai': true
  '@vscode/vsce-sign': true
  canvas: true
  # electron + playwright: the desktop recording lane (web/electron/e2e/) needs
  # their postinstall scripts to run — electron downloads its ~100MB runtime
  # binary and playwright its driver. Without these, `pnpm install` in the
  # electron package "succeeds" but leaves the binaries absent, so the lane
  # can't launch. Dev/test only (both are web/electron devDependencies; not
  # bundled into the shipped app).
  electron: true
  electron-winstaller: true
  esbuild: true
  keytar: true
  msw: true
  playwright: true
  protobufjs: true
  sharp: true
  workerd: true

patchedDependencies:
  '@tiptap/react@3.31.4': patches/@tiptap__react@3.31.4.patch