openclaw/pnpm-workspace.yaml

Multi-channel AI gateway with extensible messaging integrations

packages:
  - .
  - ui
  - packages/*
  - extensions/*
  - examples/*

minimumReleaseAge: 10080
minimumReleaseAgeStrict: true

# Trusted Codex runtimes are outside the dependency cooldown.
minimumReleaseAgeExclude:
  # Security fix for GHSA-68fv-2mgg-jv7q (released 2026-09-30); remove after 2026-10-07T14:08:09.382Z.
  - "source-map-js@1.2.2"
  # Maintainer-approved for Bun-only npm plugin installs; remove after 2026-09-29T21:29:31.258Z.
  - npm@11.20.0
  # Reviewed ACPX release; remove after 2026-09-29T10:05:37.124Z.
  - acpx@0.19.1
  - "@openai/codex"
  - "@openai/codex-*"
  # Reviewed fs-safe 0.21.1 release and native helpers; remove after 2026-10-04T19:13:10.081Z.
  - "@openclaw/fs-safe@0.21.1"
  - "@openclaw/fs-safe-darwin-arm64@0.21.1"
  - "@openclaw/fs-safe-darwin-x64@0.21.1"
  - "@openclaw/fs-safe-linux-arm64-gnu@0.21.1"
  - "@openclaw/fs-safe-linux-arm64-musl@0.21.1"
  - "@openclaw/fs-safe-linux-x64-gnu@0.21.1"
  - "@openclaw/fs-safe-linux-x64-musl@0.21.1"
  - "@openclaw/fs-safe-win32-x64-msvc@0.21.1"

# Isolated installs let pnpm reuse whole-package APFS clones instead of relinking every file.
nodeLinker: isolated
# Private inodes keep sibling installs from changing compiler input ctimes.
packageImportMethod: clone-or-copy
# GWTs share node_modules; script commands must not reconcile that shared install.
verifyDepsBeforeRun: false
blockExoticSubdeps: true

overrides:
  # Memory LanceDB supplies vectors; WhatsApp prepares thumbnails with Rastermill.
  "@lancedb/lancedb>@huggingface/transformers": "-"
  "baileys>sharp": "-"
  "baileys>audio-decode": 3.12.0
  "chevrotain>lodash-es": 4.18.1
  "@chevrotain/cst-dts-gen>lodash-es": 4.18.1
  "@chevrotain/gast>lodash-es": 4.18.1
  "@agentclientprotocol/codex-acp@1.12.0>@openai/codex": 0.160.0
  "@codemirror/commands@6.11.1>@codemirror/view": 6.43.12
  "@anthropic-ai/sdk": 0.127.0
  "@anthropic-ai/vertex-sdk@0.19.10>google-auth-library": 11.1.0
  "@opentelemetry/core": 2.11.0
  "@opentelemetry/propagator-jaeger": 2.11.0
  "@aws-sdk/core": 3.978.0
  "@aws-sdk/credential-provider-node": 3.972.83
  "@aws-sdk/xml-builder": 3.972.40
  "@hono/node-server": 2.1.1
  axios: 1.20.0
  fast-uri: 4.2.1
  follow-redirects: 1.16.0
  defu: 6.1.7
  fast-xml-parser: 5.11.1
  request: "npm:@cypress/request@4.0.1"
  request-promise: "npm:@cypress/request-promise@5.0.0"
  basic-ftp: 6.2.1
  brace-expansion: 5.0.12
  # GHSA-68fv-2mgg-jv7q: source-map-js <1.2.2 event-loop DoS (via css-tree).
  source-map-js: 1.2.2
  file-type: 22.1.1
  form-data: 4.0.6
  "werift-ice@0.2.2>ip": "npm:neoip@3.1.0"
  ip-address: 10.7.2
  "mailauth@5.0.3>nodemailer": 10.0.10
  "mailauth@5.0.3>joi": 18.2.9
  # Mailauth pins vulnerable Undici; remove when its direct dependency is fixed.
  "mailauth@5.0.3>undici": 8.10.2
  minimatch: 10.2.6
  path-to-regexp: 8.4.2
  proxy-addr: 2.0.8
  qs: 6.16.0
  node-domexception: "npm:@nolyfill/domexception@1.0.28"
  typebox: 1.3.34
  tar: 7.5.22
  tough-cookie: 6.0.2
  "tsdown>rolldown-plugin-dts": 0.28.6
  # Keep both Lit analyzers on the same classic compiler until they support native TS7.
  "web-component-analyzer@2.0.0>typescript": 5.9.3
  "zca-js@2.2.0>tough-cookie": 6.0.2
  yauzl: 3.4.0
  protobufjs: 8.8.0
  uuid: 14.0.2

allowBuilds:
  onnxruntime-node: false
  "@google/genai": true
  "@lydell/node-pty": true
  "@matrix-org/matrix-sdk-crypto-nodejs": true
  "@tloncorp/api": true
  "@tloncorp/tlon-skill": true
  baileys: true
  authenticate-pam: true
  "@discordjs/opus": false
  esbuild: true
  koffi: false
  protobufjs: true
  tree-sitter-bash: false
  openclaw: true
  "@openclaw/proxyline": true
  clawpdf: true
  "@openclaw/crabline": true
  rastermill: true
  node-pty: true

packageExtensions:
  # The transient npm lock generator also needs the peer marked optional.
  baileys:
    peerDependenciesMeta:
      sharp:
        optional: true
  # lit-analyzer imports the classic compiler without declaring it; match its analyzer dependency.
  "lit-analyzer@2.0.3":
    dependencies:
      typescript: 5.9.3

patchedDependencies:
  "baileys@7.0.0-rc14": patches/baileys@7.0.0-rc14.patch
  "chrome-devtools-mcp@1.9.0": patches/chrome-devtools-mcp@1.9.0.patch
  "matrix-js-sdk@42.4.0": patches/matrix-js-sdk@42.4.0.patch
  "@novnc/novnc@1.7.0": patches/@novnc__novnc@1.7.0.patch
  vitest@5.0.1: patches/vitest@5.0.1.patch
  "@awesome.me/webawesome@3.13.0": patches/@awesome.me__webawesome@3.13.0.patch
  "@openclaw/proxyline@0.3.12": patches/@openclaw__proxyline@0.3.12.patch
  ghostty-web@0.4.0: patches/ghostty-web@0.4.0.patch