packages:
  - .
  - ui
  - packages/*
  - extensions/*
  - examples/*

minimumReleaseAge: 10080
minimumReleaseAgeStrict: true

# Trusted Codex runtimes are outside the dependency cooldown.
minimumReleaseAgeExclude:
  # GHSA-vp8m-p9jh-q5pm / GHSA-w293-vg96-wgc3 security fixes; remove after 2026-09-12.
  - "undici@8.10.2"
  - "undici@7.29.1"
  # GHSA-58mr-gqgx-xq4g / GHSA-qw65-cvwx-89v3 security fix; remove after 2026-09-09.
  - "fast-uri@4.1.4"
  # GHSA-2x7j-588g-ccc2 security fix; remove after 2026-09-08.
  - "nodemailer@9.1.1"
  # Reviewed Crabline bundle fix and its required Zod version; remove after 2026-09-10.
  - "@openclaw/crabline@0.1.20"
  - "zod@4.5.2"
  - "@openai/codex"
  - "@openai/codex-*"
  # fs-safe 0.8.1 adds retainOnExit for fail-closed build locks; remove after 2026-09-11.
  - "@openclaw/fs-safe@0.8.1"
  - "@openclaw/fs-safe-darwin-arm64@0.8.1"
  - "@openclaw/fs-safe-darwin-x64@0.8.1"
  - "@openclaw/fs-safe-linux-arm64-gnu@0.8.1"
  - "@openclaw/fs-safe-linux-arm64-musl@0.8.1"
  - "@openclaw/fs-safe-linux-x64-gnu@0.8.1"
  - "@openclaw/fs-safe-linux-x64-musl@0.8.1"
  - "@openclaw/fs-safe-win32-x64-msvc@0.8.1"
  # Bot API 10.3 types replace OpenClaw's temporary rich-message bridge.
  - "@grammyjs/types@5.0.0"
  - "grammy@1.46.0"

# Isolated installs let pnpm reuse whole-package APFS clones instead of relinking every file.
nodeLinker: isolated
# GWTs share node_modules; script commands must not reconcile that shared install.
verifyDepsBeforeRun: false
blockExoticSubdeps: true

overrides:
  # Memory LanceDB supplies vectors; WhatsApp prepares thumbnails with Rastermill.
  "@lancedb/lancedb>@huggingface/transformers": "-"
  "baileys>sharp": "-"
  "@agentclientprotocol/codex-acp@1.6.2>@openai/codex": 0.153.4
  "@codemirror/commands@6.11.0>@codemirror/view": 6.43.9
  "@anthropic-ai/sdk": 0.120.0
  "@opentelemetry/core": 2.10.0
  "@opentelemetry/propagator-jaeger": 2.10.0
  "@aws-sdk/core": 3.977.9
  "@aws-sdk/credential-provider-node": 3.972.81
  "@aws-sdk/xml-builder": 3.972.40
  "@hono/node-server": 2.1.1
  axios: 1.19.0
  fast-uri: 4.1.4
  follow-redirects: 1.16.0
  defu: 6.1.7
  fast-xml-parser: 5.11.0
  request: "npm:@cypress/request@4.0.1"
  request-promise: "npm:@cypress/request-promise@5.0.0"
  basic-ftp: 6.2.0
  brace-expansion: 5.0.9
  file-type: 22.0.2
  form-data: 4.0.6
  "werift-ice@0.2.2>ip": "npm:neoip@3.1.0"
  ip-address: 10.5.0
  # Keep the cooled HTML converter security fix while Mailparser is rolled back.
  "mailparser@3.9.15>html-to-text": 10.0.1
  "mailauth@5.0.2>nodemailer": 9.1.1
  # Mailauth pins vulnerable Undici; remove when its direct dependency is fixed.
  "mailauth@5.0.2>undici": 8.10.2
  "mailparser@3.9.15>nodemailer": 9.1.1
  minimatch: 10.2.6
  path-to-regexp: 8.4.2
  qs: 6.15.3
  node-domexception: "npm:@nolyfill/domexception@1.0.28"
  typebox: 1.3.18
  tar: 7.5.22
  tough-cookie: 6.0.2
  "tsdown>rolldown-plugin-dts": 0.28.2
  "zca-js@2.1.2>tough-cookie": 5.1.2
  yauzl: 3.4.0
  protobufjs: 8.7.2
  uuid: 14.0.2

allowBuilds:
  "@google/genai": true
  "@lydell/node-pty": true
  "@matrix-org/matrix-sdk-crypto-nodejs": true
  "@tloncorp/api": true
  "@tloncorp/tlon-skill": true
  baileys: true
  authenticate-pam: true
  "@discordjs/opus": false
  esbuild: true
  koffi: false
  protobufjs: true
  tree-sitter-bash: false
  openclaw: true
  "@openclaw/proxyline": true
  clawpdf: true
  "@openclaw/crabline": true
  rastermill: true
  node-pty: true

# The transient npm lock generator also needs the peer marked optional.
packageExtensions:
  baileys:
    peerDependenciesMeta:
      sharp:
        optional: true

patchedDependencies:
  "@awesome.me/webawesome@3.12.0": patches/@awesome.me__webawesome@3.12.0.patch
  "@vitest/runner@4.1.11": patches/@vitest__runner@4.1.11.patch
  "vitest@4.1.11": patches/vitest@4.1.11.patch
  "matrix-js-sdk@42.2.0": patches/matrix-js-sdk@42.2.0.patch
  "@novnc/novnc@1.7.0": patches/@novnc__novnc@1.7.0.patch