pnpm-workspace.yaml

packages:
  - apps/*
  - packages/*

# Dependency build scripts are off unless listed. Both of these ship prebuilt
# native binaries through optional dependencies, so their scripts have nothing
# to do here: nx's only refreshes an Nx Cloud client this repository does not
# use, and @parcel/watcher's compiles from source only when no prebuilt binary
# matches the platform.
allowBuilds:
  "@parcel/watcher": false
  nx: false

# gesturx and reactjrx share prose-reader's maintainer, so their releases are
# installed as soon as they are out.
minimumReleaseAgeExclude:
  - gesturx
  - reactjrx

# lerna and nx pin their dependencies to exact versions, so an in-range update
# cannot move a pin that falls behind. Each override lifts one, stays inside
# the major its consumers ask for, and goes once lerna or nx pins a version at
# or past its floor:
#
# - conventional-commits-parser: lerna pins 7.1.2, and the
#   @conventional-changelog/git-client it installs asks for ^7.1.3.
# - undici: nx pins 7.29.0, below the release that fixes the advisories
#   against it. The override is keyed on that pin, since undici 8 is in the
#   tree too, for consumers that ask for that major.
#
# Each floor is the first release that does what its override is for, not the
# newest release. pnpm refuses versions published less than a day ago
# (minimumReleaseAge), so an override that only a brand-new version satisfies
# fails every install until that version ages; a floor lets pnpm take the
# newest version old enough.
overrides:
  conventional-commits-parser: ^7.1.3
  undici@7.29.0: ^7.29.1