pnpm-workspace.yaml
Rama main · réplica de lectura del repositorio original.
packages:
# include packages in subfolders (e.g. apps/ and packages/)
- "web"
- "worker"
- "ai-gateway"
- "packages/**"
- "ee"
# Consolidate compatible versions during writable installs; frozen installs keep the lockfile.
autoDedupe: true
# Record resolution settings so frozen installs can be reused by pnpm run.
lockfile:
includeResolutionSettings: true
# These private product packages are versioned together by release-it.
versioning:
fixed:
- [langfuse, web, worker]
# Bound competing Rust jobs across worktrees sharing pnpm's state directory.
# Keep persistent dev servers and the outer Turbo commands outside this group.
concurrencyGroups:
langfuse-rust: 1
tasks:
"rust:build":
concurrencyGroup: langfuse-rust
"rust:build:dev":
concurrencyGroup: langfuse-rust
"rust:build:debug":
concurrencyGroup: langfuse-rust
"rust:typecheck":
concurrencyGroup: langfuse-rust
"rust:lint":
concurrencyGroup: langfuse-rust
"rust:lint:fix":
concurrencyGroup: langfuse-rust
"rust:test":
concurrencyGroup: langfuse-rust
catalog:
# Keep the AG-UI protocol packages aligned across web, worker, and shared.
"@ag-ui/client": 1.0.4
"@ag-ui/core": 1.0.4
"@ag-ui/mastra": 2.0.2
"@aws-sdk/client-cloudwatch": 3.1074.0
"@aws-sdk/client-eventbridge": 3.1074.0
"@aws-sdk/client-iam": 3.1074.0
"@aws-sdk/client-lambda": 3.1074.0
"@aws-sdk/client-lambda-microvms": 3.1074.0
"@aws-sdk/client-s3": 3.1074.0
"@aws-sdk/client-sesv2": 3.1074.0
"@aws-sdk/credential-providers": 3.1074.0
"@aws-sdk/lib-storage": 3.1074.0
"@aws-sdk/s3-request-presigner": 3.1074.0
# The official TS 6 side-by-side wrapper (resolves to typescript 6.0.3):
# provides the JS compiler API for tooling that still needs it but
# ships no `tsc` bin, so package scripts fall through to the workspace-root
# ts7 alias and build/typecheck with the native TypeScript 7 compiler.
typescript: npm:@typescript/typescript6@^6.0.2
# 5 day delay for new dep upgrades to reduce supply chain attack risk
minimumReleaseAge: 7200
minimumReleaseAgeExclude:
# Security fix for CVE-2026-116592 and related redirect/cache advisories.
- undici@7.30.2
# Coordinated protocol upgrade accompanying the Mastra security fix.
- "@ag-ui/client@1.0.4"
- "@ag-ui/core@1.0.4"
- "@ag-ui/encoder@1.0.4"
- "@ag-ui/proto@1.0.4"
# Drop exceptions for versions no longer in the lockfile during writable installs.
minimumReleaseAgeExcludePrune: true
# Reject recent releases whose publishing trust is weaker than earlier versions.
# Older releases have already passed the five-day quarantine above.
trustPolicy: no-downgrade
trustPolicyIgnoreAfter: 7200
# Keep pnpm itself out of the workspace lockfile's dependency graph.
pmOnFail: ignore
packageExtensions:
# TypeScript 7 has no JavaScript compiler API yet. Keep Storybook's toolchain
# on the TypeScript 6 compatibility package while Next builds with 7.
"@storybook/nextjs-vite@10.3.6":
dependencies:
typescript: npm:@typescript/typescript6@^6.0.2
# dependency-cruiser reads the JS compiler API to follow TypeScript imports.
# Resolved against web's `typescript` (7.x) it finds no API, silently stops
# parsing .ts/.tsx, and reports an empty import graph instead of an error.
"dependency-cruiser@18.1.0":
dependencies:
typescript: npm:@typescript/typescript6@^6.0.2
"eslint-plugin-storybook@10.3.6":
dependencies:
typescript: npm:@typescript/typescript6@^6.0.2
"vite-tsconfig-paths@6.1.1":
dependencies:
typescript: npm:@typescript/typescript6@^6.0.2
allowBuilds:
"@prisma/client": true
"@prisma/engines": true
"@sentry/cli": true
esbuild: true
sharp: true
unrs-resolver: true
"@datadog/native-appsec": false
"@datadog/native-iast-taint-tracking": false
"@datadog/native-metrics": false
core-js: false
dd-trace: false
msgpackr-extract: false
msw: false
prisma: false
protobufjs: false
"@datadog/pprof": false
"@scarf/scarf": false
cpu-features: true
ssh2: true
vue-demi: true
overrides:
# Storybook's compatible Vite adapter pins an older Next.js env prerelease.
# Keep its env loader aligned with the app until the adapter updates its pin.
"vite-plugin-storybook-nextjs@3.3.2>@next/env": 16.4.5
# React Email requires html-to-text ^9, which pulls in vulnerable deepmerge
# (CVE-2026-93753). Version 10.0.1 replaces it with patched deepmerge-ts.
"@react-email/render>html-to-text": 10.0.1
# The root Mastra adapter does not load CopilotKit. Only its unused
# `@ag-ui/mastra/copilotkit` subpath requires this peer.
"@ag-ui/mastra@2.0.2>@copilotkit/runtime": "-"
# The adapter only drives local agents and never requires the remote-agent
# client at runtime (its types import MastraClient). Auto-installing this peer
# added @mastra/client-js, which pins a second, older @mastra/core (~60MB).
"@ag-ui/mastra@2.0.2>@mastra/client-js": "-"
# The generated client loads its query engine from .prisma/client and never
# requires the CLI. Resolving this optional peer made `pnpm deploy --prod`
# ship the Prisma CLI and its engines in the worker image.
"@prisma/client>prisma": "-"
browserslist: 4.28.7
postcss: 8.5.25
esbuild: "0.28.1"
# Keep both installed majors on their security-patched releases.
"undici@6": 6.29.1
"undici@7": 7.30.2
zod: 4.6.6
nanoid: 3.3.18
tar-fs: ^2.1.2
rollup@^4.0.0: ^4.22.4
"@types/node-fetch": ^2.6.13
"@types/react-dom": 19.2.3
fast-xml-builder: 1.1.7
# CVE-2026-118773: an aborted glob walk keeps reading directories. The
# advisory's patched range is >=14.0.2, and 13.x has no release in it.
# @sentry/nextjs 11.11 declares glob ^14.0.3. Storybook's docgen plugin
# still declares ^13; 0.9.x drops glob but rejects TypeScript 7.0, which
# this repo uses. Its only call is globSync with absolute/cwd/ignore/nodir.
"@joshwooding/vite-plugin-react-docgen-typescript>glob": 14.0.3
qs: 6.17.0
path-to-regexp@0.1.12: 0.1.13
# ReDoS only affects the 8.x line (CVE-2026-4926/-4923, >=8.0.0 <8.4.0).
path-to-regexp@8.3.0: 8.4.0
# SSRF + throttling fixes land in 4.0.29/4.0.33. @mastra/core pins its
# provider-utils-v6 alias to exactly 4.0.27, which the range key can't
# catch — aliased deps need alias-name overrides (same reason -v5 exists).
"@ai-sdk/provider-utils@<=4.0.32": 4.0.33
"@ai-sdk/provider-utils-v5": "npm:@ai-sdk/provider-utils@4.0.33"
"@ai-sdk/provider-utils-v6": "npm:@ai-sdk/provider-utils@4.0.33"
# Scalar's agent package pins an SSRF-vulnerable AI SDK through two paths.
"@scalar/agent-chat@0.12.28>ai": 6.0.230
"@ai-sdk/vue@3.0.33>ai": 6.0.230
# CVE-2026-45820: fflate infinite loop DoS in unzipSync (GHSA-px8p-9vwx-vf98)
fflate@0.8.1: 0.8.3
# CVE-2026-104844: quadratic flat-selector parsing, fixed in 6.1.5.
# @tailwindcss/typography pins exactly 6.0.10, including at its latest release.
"@tailwindcss/typography>postcss-selector-parser": 6.1.5
# Hono's dependents allow these security fixes: XSS in 4.13.7 and
# double decoding in 4.13.11 (GHSA-5r4p-p66f-jhc7).
hono: 4.13.11
# A batch of SSRF, prototype-pollution, ReDoS and proxy-confusion fixes
# (CVE-2026-101898 through -101909) all land in 1.20.0. @slack/web-api and
# @vueuse/integrations declare ^1 ranges the vulnerable 1.18.0 already
# satisfies, so only an override moves it.
axios: 1.20.0
# CVE-2026-101916 (certificate validation) and CVE-2026-101915 (sensitive
# data in server errors), fixed in 1.14.5. The OpenTelemetry gRPC exporters,
# @a2a-js/sdk and dockerode all declare ^1 ranges the vulnerable 1.14.4
# already satisfies, so only an override moves it.
"@grpc/grpc-js": 1.14.5
# CVE-2026-106444/-106445/-106446: code injection and script-tag escaping
# fixes land in 4.7.10. eslint-plugin-boundaries and @boundaries/elements
# both pin handlebars to exactly 4.7.9, including at their latest releases,
# so only an override moves it to the patched version.
handlebars: 4.7.10
# CVE-2026-118764 (glob-part amplification) is fixed only in minimatch 11.
# eslint, @eslint/config-array, and @typescript-eslint/typescript-estree
# still declare ^10 at their latest releases, which resolves to 10.2.6.
# Those packages only call Minimatch#match / minimatch(). 3.x and 9.x stay
# put: glob 10 and eslint-plugin-react depend on the older APIs.
"minimatch@10": 11.0.1
# next-auth 4.24.x caps its optional nodemailer peer at ^7 but contains no
# nodemailer imports (we pass a custom sendVerificationRequest); without this
# pnpm auto-installs a second, unused nodemailer@7 instance for web.
# Remove once next-auth allows nodemailer ^10.
"next-auth>nodemailer": "^10.1.7"
patchedDependencies:
# focusFirst crashes on null item refs (items unmounting while entry focus
# runs), e.g. opening a row-actions dropdown while a table re-renders.
# Still unfixed upstream as of 1.1.19; remove once Radix guards focusFirst.
"@radix-ui/react-roving-focus@1.1.11": patches/@radix-ui__react-roving-focus@1.1.11.patch
# Select typeahead schedules nextItem.ref.current.focus() in a setTimeout.
# If the item unmounts before the timeout (dynamic option lists, closing the
# menu, a sibling field remounting items), the ref is null and throws.
# Fixed upstream in 2.3.7; remove this patch when we bump.
"@radix-ui/react-select@2.2.6": patches/@radix-ui__react-select@2.2.6.patch
next-auth@4.24.15: patches/next-auth@4.24.15.patch
# The document-level drag handlers crash when a panel group unmounts
# mid-drag: setPointerCapture on the detached separator throws
# InvalidStateError on every pointermove, and the pointerup teardown throws
# "Could not find data for Group with id ...". Guard both (skip detached
# elements / unmounted groups). Still unfixed upstream as of 4.12.2.
react-resizable-panels@4.8.0: patches/react-resizable-panels@4.8.0.patch
publicHoistPattern:
- "*prisma*"
- "@aws-sdk/client-s3"