pnpm-workspace.yaml

# Minimum age (in minutes) a package version must be published before pnpm will install it.
# 1440 minutes = 24 hours. Reduces risk from newly-published compromised packages.
minimumReleaseAge: 1440

# First-party packages that need freshly-published versions without a 24h wait.
minimumReleaseAgeExclude:
  - "@cloudflare/ai-search-snippet"
  - "@cloudflare/nimbus-docs"
  # First-party Cloudflare packages, published frequently. The docs site bumps
  # Wrangler often to regenerate the autogenerated command reference, so exempt
  # it (and its miniflare dependency) from the 24h wait.
  - wrangler
  - miniflare
  - workerd
  - "@cloudflare/workers-types"

overrides:
  # rolldown 1.1.x has a memory leak (rolldown/rolldown#10554) that causes
  # Workers Builds to OOM. Vite 8.2.0+ depends on rolldown ~1.2.0, but Astro
  # pins Vite ~8.1.0, so the override is needed until Astro bumps its Vite
  # range to >=8.2.0 (which resolves rolldown >=1.2.3).
  rolldown: 1.2.3

# On Astro 7 the @astrojs/mdx → @astrojs/markdown-satteri peer is satisfied
# natively (nimbus-docs pulls markdown-satteri 0.3.4, @astrojs/mdx@7 peers
# ^0.3.1), so the old allowedVersions override is obsolete and has been removed.

# Prevent transitive dependencies from using exotic sources (git repos, direct tarball URLs).
# Only direct dependencies may use exotic sources.
blockExoticSubdeps: true

# Explicit allowlist of packages permitted to run install scripts.
# These are well-known packages that require build scripts to download platform-specific binaries.
allowBuilds:
  esbuild: true
  sharp: true
  tldjs: true
  workerd: true
  # Transitive deps of @flue/runtime and agents — native binaries not needed by this repo
  "@google/genai": false
  "@mongodb-js/zstd": false
  core-js-pure: false
  node-liblzma: false
  protobufjs: false

# Always save dependencies as exact versions and to devDependencies by default.
saveExact: true
saveDev: true