pnpm-workspace.yaml

packages:
  - apps/*
  - packages/*

allowBuilds:
  '@google/genai': false
  bufferutil: false
  core-js: false
  esbuild: true
  lefthook: false
  protobufjs: false
  sharp: false
  utf-8-validate: false
  workerd: true

# These exact artifacts were already pinned and reviewed before the pnpm 11
# cutover. Every other version remains subject to pnpm 11's default 24-hour
# release-age quarantine.
minimumReleaseAgeExclude:
  - '@clerk/backend@3.11.6'
  - '@clerk/nextjs@7.5.19'
  - '@clerk/react@6.12.4'
  - '@clerk/shared@4.25.4'
  - '@clerk/ui@1.25.4'
  - '@cloudflare/workers-types@5.20260716.1'
  - '@vercel/backends@0.8.24'
  - '@vercel/build-utils@13.33.1'
  - '@vercel/cervel@0.1.32'
  - '@vercel/elysia@0.1.101'
  - '@vercel/express@0.1.115'
  - '@vercel/fastify@0.1.104'
  - '@vercel/gatsby-plugin-vercel-builder@2.2.27'
  - '@vercel/h3@0.1.110'
  - '@vercel/hono@0.2.104'
  - '@vercel/koa@0.1.84'
  - '@vercel/nestjs@0.2.105'
  - '@vercel/node@5.8.25'
  - '@vercel/static-build@2.11.7'
  - 'vercel@56.2.1'

overrides:
  # Security floors enforced by the production lockfile audit. These transitive
  # packages do not yet have upstream parents whose declared ranges include the
  # patched releases.
  '@hono/node-server@<2.0.10': 2.0.10
  '@clerk/localizations': 4.13.3
  '@clerk/shared': 4.25.4
  '@esbuild-kit/core-utils>esbuild': 0.25.12
  '@tootallnate/once@>=2.0.0 <2.0.1': 2.0.1
  '@vercel/node@5.8.25>undici': 6.27.0
  'ajv@>=8.0.0 <8.18.0': 8.20.0
  'body-parser@>=2.0.0 <2.3.0': 2.3.0
  'dompurify@<=3.4.11': 3.4.12
  'fast-uri@<3.1.4': 3.1.4
  'js-yaml@<3.15.0': 3.15.0
  'js-yaml@>=4.0.0 <4.3.0': 4.3.0
  'minimatch@>=10.0.0 <10.2.3': 10.2.5
  'path-to-regexp@>=6.0.0 <6.3.0': 6.3.0
  'path-to-regexp@>=8.0.0 <8.4.0': 8.4.2
  'postcss@<8.5.18': 8.5.18
  'sharp@<0.35.0': 0.35.0
  'smol-toml@<1.6.1': 1.6.1
  'tar@>=7.0.0 <7.5.11': 7.5.20
  'tsx@4.21.0': 4.22.4
  'undici@>=6.0.0 <6.27.0': 6.27.0
  'undici@>=7.0.0 <7.28.0': 7.28.0
  'utf-8-validate@>=5.0.2': 5.0.10
  'uuid@<11.1.1': 11.1.1
  'vercel@56.2.1>undici': 6.27.0

# Mastra 1.51 uses these AI SDK v5 packages only for its v5 message types, but
# their stale manifests still exclude Zod 4. Mastra itself supports Zod 4; keep
# this exact, removable allowance until upstream mastra-ai/mastra#16994 ships.
peerDependencyRules:
  allowedVersions:
    '@ai-sdk/provider-utils@2.2.8>zod': '^4.0.0'
    '@ai-sdk/ui-utils@1.2.11>zod': '^4.0.0'

catalog:
  '@ai-sdk/anthropic': 3.0.84
  '@ai-sdk/deepseek': 2.0.39
  '@ai-sdk/openai': 3.0.71
  '@ai-sdk/react': 3.0.207
  # 2.5.3-2.5.4 panic in the type-aware module resolver (biomejs/biome#10885).
  # Keep the last non-panicking patch until the upstream fix is released.
  '@biomejs/biome': 2.5.2
  '@clack/prompts': 1.7.0
  '@clerk/backend': 3.11.6
  '@clerk/nextjs': 7.5.19
  '@clerk/ui': 1.25.4
  '@cloudflare/workers-types': 5.20260716.1
  '@commitlint/cli': 21.2.1
  '@commitlint/config-conventional': 21.2.0
  '@hookform/resolvers': 5.4.0
  '@google/genai': 2.12.0
  '@mastra/core': 1.51.0
  '@next/env': 16.2.11
  '@openrouter/ai-sdk-provider': 2.9.1
  '@polar-sh/sdk': 0.48.1
  '@streamdown/code': 1.1.1
  '@streamdown/math': 1.0.2
  '@streamdown/mermaid': 1.0.2
  '@t3-oss/env-nextjs': 0.13.11
  '@tailwindcss/postcss': 4.3.2
  '@tanstack/react-query': 5.101.2
  '@tanstack/react-virtual': 3.14.6
  '@types/node': 22.20.1
  '@types/pg': 8.20.0
  '@types/react': 19.2.17
  '@types/react-dom': 19.2.3
  ai: 6.0.205
  arquero: 8.0.3
  cmdk: 1.1.1
  dependency-cruiser: 18.1.0
  drizzle-kit: 0.31.10
  drizzle-orm: 0.45.2
  geist: 1.7.2
  hono: 4.12.30
  katex: 0.17.0
  knip: 6.27.0
  lefthook: 2.1.10
  lucide-react: 1.24.0
  next: 16.2.11
  next-themes: 0.4.6
  nuqs: 2.9.0
  pg: 8.22.0
  qrcode.react: 4.2.0
  react: 19.2.7
  react-dom: 19.2.7
  react-hook-form: 7.81.0
  sonner: 2.0.7
  streamdown: 2.5.0
  tailwindcss: 4.3.2
  tsx: 4.23.1
  turbo: 2.10.5
  tw-animate-css: 1.4.0
  typescript: 6.0.3
  web-vitals: 5.3.0
  wrangler: 4.114.0
  zod: 4.4.3
  zustand: 5.0.14