karakeep/pnpm-workspace.yaml at main · karakeep-app/karakeep · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
packages:
  - "packages/*"
  - "apps/*"
  - "tooling/*"
  - "tools/*"
  - "docs"

nodeLinker: hoisted

allowBuilds:
  "@sentry/cli": true
  "@swc/core": true
  better-sqlite3: true
  esbuild: true
  re2: true
  sharp: true
  tesseract.js: true
  # These install scripts are informational or unnecessary for our installs.
  "@parcel/watcher": false
  core-js: false
  core-js-pure: false
  postman-code-generators: false
  protobufjs: false

patchedDependencies:
  react-tweet@3.2.2: "patches/react-tweet@3.2.2.patch"
  xcode@3.0.1: "patches/xcode@3.0.1.patch"
  playwright-extra@4.3.6: "patches/playwright-extra@4.3.6.patch"
  # Swift 6.2 / Xcode 26 rejects `weak let`; rewrite to `nonisolated(unsafe) weak var`.
  expo-modules-jsi@56.0.12: patches/expo-modules-jsi@56.0.12.patch
  # Disables React 19.2's dev "component performance track" prop serialization,
  # which crashes when a changed prop is a tRPC proxy (RN 0.85 + new arch).
  react-native@0.85.3: patches/react-native@0.85.3.patch

# Docker builds can prune packages that use one of the root patches.
allowUnusedPatches: true

minimumReleaseAgeExclude:
  [
    "@next/bundle-analyzer@16.3.6",
    "@next/env@16.3.6",
    "@next/swc-darwin-arm64@16.3.6",
    "@next/swc-darwin-x64@16.3.6",
    "@next/swc-linux-arm64-gnu@16.3.6",
    "@next/swc-linux-arm64-musl@16.3.6",
    "@next/swc-linux-x64-gnu@16.3.6",
    "@next/swc-linux-x64-musl@16.3.6",
    "@next/swc-win32-arm64-msvc@16.3.6",
    "@next/swc-win32-x64-msvc@16.3.6",
    next@16.3.6,
    liteque@0.9.1,
    "@astrojs/react@6.0.6",
  ]

overrides:
  # 6.1.3's CVE fix breaks Tailwind 3's `:merge(.group)` variant transform.
  "tailwindcss@3.4.1>postcss-selector-parser": 6.1.4
  # OpenAPI's Postman converter pins both YAML parsers to vulnerable releases.
  "openapi-to-postmanv2@6>js-yaml": 4.3.2
  "openapi-to-postmanv2@6>yaml": 1.10.3
  # The current OpenTelemetry exporters pin older 2.x core versions exactly.
  "@opentelemetry/core@>=2.0.0 <2.8.0": 2.8.0
  # refractor 3 restricts prismjs to ~1.27.0.
  "refractor@3>prismjs": 1.30.0
  # Docusaurus's webpack plugins require v6. v7 keeps the API and needs Node 20+.
  "serialize-javascript@>=6.0.0 <7.0.5": 7.0.5
  i18next-fs-backend: 2.6.6
  shell-quote: 1.9.0
  # React Native vendors a renderer built against one exact React version and
  # asserts on it at runtime, so the whole workspace has to agree. React's
  # experimental types also contain unique symbols, so separate @types/react
  # versions are not structurally compatible. Keep these in sync with the
  # versions used by the apps when bumping Expo or React.
  react: 19.2.3
  react-dom: 19.2.3
  "@types/react": 19.2.15
  "@types/react-dom": 19.2.3