{"path":"pnpm-workspace.yaml","size":6779,"locked":false,"binary":false,"truncated":false,"content":"# ============================================================================\n# SECURITY: Minimum release age for npm packages (supply-chain attack defense)\n# ============================================================================\n#\n# This setting requires that any npm package version must have been published\n# for at least 1 day (1440 minutes) before pnpm will allow installing it.\n# This is a critical defense against supply-chain attacks. In most cases,\n# malicious npm releases are discovered and pulled within hours, so a 1-day\n# delay provides a strong safety buffer.\n#\n# DO NOT DISABLE THIS SETTING. Removing or setting it to 0 is considered\n# extremely dangerous and leaves the entire workspace vulnerable to supply-\n# chain attacks, which have been the #1 vector for npm ecosystem compromises.\n#\n# If you absolutely need to install a package before the 1-day window has\n# passed (e.g. an urgent security bugfix), you can add it to the\n# `minimumReleaseAgeExclude` allowlist below. Only consider doing this for\n# packages released by trusted organizations with an impeccable security\n# posture (e.g. Replit packsges, react from Meta, typescript from Microsoft). Even then,\n# remove the exclusion once the 1-day window has passed.\n#\n# Example:\n#   minimumReleaseAgeExclude:\n#     - react\n#     - typescript\n#\n# ============================================================================\nminimumReleaseAge: 1440\n\nminimumReleaseAgeExclude:\n  - \"@replit/*\"\n  - elliptic@6.6.2\n  - serialize-javascript@7.0.3 || 7.0.5\n  - uuid@11.1.1\n  - qs@6.15.2\n  - esbuild@0.28.1\n  - vite@7.3.5\n  - markdown-it@14.1.2\n  - linkify-it@5.0.1 || 5.0.2\n  - js-yaml@4.1.2 || 4.3.0 || 4.3.1\n  - \"@babel/core@7.29.1\"\n  - brace-expansion@2.1.2 || 2.1.3 || 2.1.4 || 5.0.7 || 5.0.8 || 5.0.9\n  - body-parser@2.3.0\n  - fast-uri@3.1.3 || 3.1.4 || 3.1.5\n  - postcss@8.5.18 || 8.5.23\n  - ip-address@10.2.1 || 10.2.2 || 10.3.1\n  - nanoid@3.3.16 || 3.3.18\n\npackages:\n  - oracle\n  - apps/*\n  - lib/*\n  - lib/integrations/*\n  - scripts\n\ncatalog:\n  \"@tailwindcss/vite\": ^4.3.3\n  \"@tanstack/react-query\": ^5.101.4\n  \"@types/node\": ^26.2.0\n  \"@types/react\": ^19.2.18\n  \"@types/react-dom\": ^19.2.4\n  \"@vitejs/plugin-react\": ^6.0.5\n  class-variance-authority: ^0.7.1\n  clsx: ^2.1.1\n  drizzle-orm: ^0.45.2\n  framer-motion: ^13.1.0\n  lucide-react: ^1.31.0\n  # Must be this exact version because expo requires it\n  react: 19.2.8\n  # Must be this exact version because expo requires it\n  react-dom: 19.2.8\n  tailwind-merge: ^3.6.0\n  tailwindcss: ^4.3.3\n  tsx: ^4.23.12\n  vite: ^8.2.1\n  wouter: ^3.3.5\n  zod: ^4.4.3\n\nautoInstallPeers: false\n\noverrides:\n  # replit uses linux-x64 only, we can exclude all other platforms\n  \"esbuild>@esbuild/darwin-arm64\": \"-\"\n  \"esbuild>@esbuild/darwin-x64\": \"-\"\n  \"esbuild>@esbuild/freebsd-arm64\": \"-\"\n  \"esbuild>@esbuild/freebsd-x64\": \"-\"\n  \"esbuild>@esbuild/linux-arm\": \"-\"\n  \"esbuild>@esbuild/linux-arm64\": \"-\"\n  \"esbuild>@esbuild/linux-ia32\": \"-\"\n  \"esbuild>@esbuild/linux-loong64\": \"-\"\n  \"esbuild>@esbuild/linux-mips64el\": \"-\"\n  \"esbuild>@esbuild/linux-ppc64\": \"-\"\n  \"esbuild>@esbuild/linux-riscv64\": \"-\"\n  \"esbuild>@esbuild/linux-s390x\": \"-\"\n  \"esbuild>@esbuild/netbsd-arm64\": \"-\"\n  \"esbuild>@esbuild/netbsd-x64\": \"-\"\n  \"esbuild>@esbuild/openbsd-arm64\": \"-\"\n  \"esbuild>@esbuild/openbsd-x64\": \"-\"\n  \"esbuild>@esbuild/sunos-x64\": \"-\"\n  \"esbuild>@esbuild/win32-arm64\": \"-\"\n  \"esbuild>@esbuild/win32-ia32\": \"-\"\n  \"esbuild>@esbuild/win32-x64\": \"-\"\n  \"esbuild>@esbuild/aix-ppc64\": \"-\"\n  \"esbuild>@esbuild/android-arm\": \"-\"\n  \"esbuild>@esbuild/android-arm64\": \"-\"\n  \"esbuild>@esbuild/android-x64\": \"-\"\n  \"esbuild>@esbuild/openharmony-arm64\": \"-\"\n  \"lightningcss>lightningcss-android-arm64\": \"-\"\n  \"lightningcss>lightningcss-darwin-arm64\": \"-\"\n  \"lightningcss>lightningcss-darwin-x64\": \"-\"\n  \"lightningcss>lightningcss-freebsd-x64\": \"-\"\n  \"lightningcss>lightningcss-linux-arm-gnueabihf\": \"-\"\n  \"lightningcss>lightningcss-linux-arm64-gnu\": \"-\"\n  \"lightningcss>lightningcss-linux-arm64-musl\": \"-\"\n  \"lightningcss>lightningcss-linux-x64-musl\": \"-\"\n  \"lightningcss>lightningcss-win32-arm64-msvc\": \"-\"\n  \"lightningcss>lightningcss-win32-x64-msvc\": \"-\"\n  \"@tailwindcss/oxide>@tailwindcss/oxide-android-arm64\": \"-\"\n  \"@tailwindcss/oxide>@tailwindcss/oxide-darwin-arm64\": \"-\"\n  \"@tailwindcss/oxide>@tailwindcss/oxide-darwin-x64\": \"-\"\n  \"@tailwindcss/oxide>@tailwindcss/oxide-freebsd-x64\": \"-\"\n  \"@tailwindcss/oxide>@tailwindcss/oxide-linux-arm-gnueabihf\": \"-\"\n  \"@tailwindcss/oxide>@tailwindcss/oxide-linux-arm64-gnu\": \"-\"\n  \"@tailwindcss/oxide>@tailwindcss/oxide-linux-arm64-musl\": \"-\"\n  \"@tailwindcss/oxide>@tailwindcss/oxide-win32-arm64-msvc\": \"-\"\n  \"@tailwindcss/oxide>@tailwindcss/oxide-win32-x64-msvc\": \"-\"\n  \"@tailwindcss/oxide>@tailwindcss/oxide-linux-x64-musl\": \"-\"\n  \"rollup>@rollup/rollup-android-arm-eabi\": \"-\"\n  \"rollup>@rollup/rollup-android-arm64\": \"-\"\n  \"rollup>@rollup/rollup-darwin-arm64\": \"-\"\n  \"rollup>@rollup/rollup-darwin-x64\": \"-\"\n  \"rollup>@rollup/rollup-freebsd-arm64\": \"-\"\n  \"rollup>@rollup/rollup-freebsd-x64\": \"-\"\n  \"rollup>@rollup/rollup-linux-arm-gnueabihf\": \"-\"\n  \"rollup>@rollup/rollup-linux-arm-musleabihf\": \"-\"\n  \"rollup>@rollup/rollup-linux-arm64-gnu\": \"-\"\n  \"rollup>@rollup/rollup-linux-arm64-musl\": \"-\"\n  \"rollup>@rollup/rollup-linux-loong64-gnu\": \"-\"\n  \"rollup>@rollup/rollup-linux-loong64-musl\": \"-\"\n  \"rollup>@rollup/rollup-linux-ppc64-gnu\": \"-\"\n  \"rollup>@rollup/rollup-linux-ppc64-musl\": \"-\"\n  \"rollup>@rollup/rollup-linux-riscv64-gnu\": \"-\"\n  \"rollup>@rollup/rollup-linux-riscv64-musl\": \"-\"\n  \"rollup>@rollup/rollup-linux-s390x-gnu\": \"-\"\n  \"rollup>@rollup/rollup-linux-x64-musl\": \"-\"\n  \"rollup>@rollup/rollup-openbsd-x64\": \"-\"\n  \"rollup>@rollup/rollup-openharmony-arm64\": \"-\"\n  \"rollup>@rollup/rollup-win32-arm64-msvc\": \"-\"\n  \"rollup>@rollup/rollup-win32-ia32-msvc\": \"-\"\n  \"rollup>@rollup/rollup-win32-x64-gnu\": \"-\"\n  \"rollup>@rollup/rollup-win32-x64-msvc\": \"-\"\n  \"@expo/ngrok-bin>@expo/ngrok-bin-darwin-arm64\": \"-\"\n  \"@expo/ngrok-bin>@expo/ngrok-bin-darwin-x64\": \"-\"\n  \"@expo/ngrok-bin>@expo/ngrok-bin-freebsd-ia32\": \"-\"\n  \"@expo/ngrok-bin>@expo/ngrok-bin-freebsd-x64\": \"-\"\n  \"@expo/ngrok-bin>@expo/ngrok-bin-linux-arm64\": \"-\"\n  \"@expo/ngrok-bin>@expo/ngrok-bin-linux-arm\": \"-\"\n  \"@expo/ngrok-bin>@expo/ngrok-bin-linux-ia32\": \"-\"\n  \"@expo/ngrok-bin>@expo/ngrok-bin-sunos-x64\": \"-\"\n  \"@expo/ngrok-bin>@expo/ngrok-bin-win32-ia32\": \"-\"\n  \"@expo/ngrok-bin>@expo/ngrok-bin-win32-x64\": \"-\"\n  # drizzle-kit uses esbuild internally on an older version that's vulnerable, this overrides it\n  \"@esbuild-kit/esm-loader\": \"npm:tsx@^4.21.0\"\n  esbuild: \"0.27.3\"\n  serialize-javascript: \"7.0.3\"\n  js-yaml: \"4.3.1\"\n\nallowBuilds:\n  \"@swc/core\": true\n  esbuild: true\n  msw: true\n  unrs-resolver: true\n  bufferutil: true\n  protobufjs: true\n  utf-8-validate: true\n"}