nocobase/pnpm-workspace.yaml

packages:
  - packages/*/*
  - ui-library
  - docs

# Commands with --dry-run must not trigger an implicit install before their
# own code can enforce read-only behavior. Dependency changes are synchronized
# explicitly with CI=true pnpm install --no-frozen-lockfile.
verifyDepsBeforeRun: false

catalog:
  '@ai-sdk/alibaba': ^2.0.60
  '@ai-sdk/anthropic': ^4.0.71
  '@ai-sdk/cohere': ^4.0.54
  '@ai-sdk/deepseek': ^3.0.58
  '@ai-sdk/google': ^4.0.87
  '@ai-sdk/moonshotai': ^3.0.62
  '@ai-sdk/openai': ^4.0.83
  '@ai-sdk/openai-compatible': ^3.0.62
  '@arethetypeswrong/cli': ^0.18.5
  '@base-ui/react': ^1.6.0
  '@better-auth/api-key': 1.7.5
  '@cacheable/memory': ^2.2.0
  '@clack/prompts': ^1.7.0
  '@dnd-kit/core': ^6.3.1
  '@dnd-kit/sortable': ^10.0.0
  '@dnd-kit/utilities': ^3.2.2
  '@eslint-react/eslint-plugin': ^5.18.6
  '@eslint/js': ^10.0.0
  '@hono/node-server': ^2.1.1
  '@oclif/core': ^4.14.0
  '@playwright/test': ^1.62.1
  '@refinedev/core': ^5.0.8
  '@sinclair/typebox': ^0.34.52
  '@tailwindcss/postcss': ^4.1.4
  '@tailwindcss/vite': ^4.1.8
  '@tanstack/react-query': ^5.81.5
  '@tanstack/react-table': ^8.2.6
  '@testing-library/jest-dom': ^7.0.0
  '@testing-library/react': ^16.3.2
  '@testing-library/user-event': ^14.6.3
  '@tiptap/core': 3.30.2
  '@tiptap/extension-link': 3.30.2
  '@tiptap/extension-file-handler': 3.30.2
  '@tiptap/extension-list': 3.30.2
  '@tiptap/extension-mention': 3.30.2
  '@tiptap/extension-placeholder': 3.30.2
  '@tiptap/extension-table': 3.30.2
  '@tiptap/extension-text-style': 3.30.2
  '@tiptap/markdown': 3.30.2
  '@tiptap/pm': 3.30.2
  '@tiptap/react': 3.30.2
  '@tiptap/starter-kit': 3.30.2
  '@tiptap/suggestion': 3.30.2
  '@types/node': ^24.0.0
  '@types/react': ^19.2.0
  '@types/react-dom': ^19.2.0
  '@types/ws': ^8.18.1
  '@typescript-eslint/eslint-plugin': ^8.67.0
  '@typescript-eslint/parser': ^8.67.0
  '@vitejs/plugin-react': ^4.4.1
  '@vitest/coverage-v8': ^4.1.10
  '@vitest/eslint-plugin': ^1.6.27
  ai: ^7.0.127
  ajv: ^8.20.0
  better-auth: 1.7.5
  better-sqlite3: ^13.0.3
  bloom-filters: ^3.0.4
  class-variance-authority: ^0.7.1
  cmdk: ^1.1.1
  cn: ^0.4.0
  cross-spawn: ^7.0.6
  date-fns: ^4.1.0
  esbuild: ^0.28.2
  eslint: ^10.0.0
  eslint-config-prettier: ^10.1.8
  eslint-plugin-react-hooks: ^7.1.1
  eslint-plugin-react-refresh: ^0.5.6
  globals: ^17.11.0
  hono: ^4.13.2
  hono-openapi: ^1.3.3
  husky: ^9.1.7
  i18next: ^26.4.0
  ignore: ^7.0.6
  ioredis: ^5.11.1
  jsdom: ^30.0.1
  just-bash: ^3.6.0
  keyv: ^5.6.0
  knex: ^3.1.0
  lint-staged: ^17.3.0
  lucide-react: ^0.487.0
  mermaid: ^12.0.0
  ollama-ai-provider-v2: ^4.0.1
  oracledb: ^6.10.0
  pino: ^10.3.1
  pino-pretty: ^13.0.0
  pino-roll: ^4.0.0
  postcss: ^8.5.3
  prettier: ^3.9.6
  publint: ^0.3.24
  react: ^19.2.8
  react-day-picker: 10.0.1
  react-dom: ^19.2.8
  react-i18next: ^17.0.12
  react-markdown: ^10.1.0
  react-router: ^7.0.2
  react-virtuoso: ^4.18.15
  remark-gfm: ^4.0.1
  shadcn: ^4.13.1
  tailwindcss: ^4.1.4
  tar: ^7.5.22
  tedious: ^20.0.0
  tsx: ^4.21.0
  tw-animate-css: ^1.2.5
  typescript: ^6.0.3
  typescript-eslint: ^8.67.0
  vite: ^6.3.5
  vitest: ^4.1.10
  ws: ^8.21.3
  yaml: ^2.9.0
  zod: ^4.6.5

# Which dependencies may run install scripts: true compiles a native addon, false skips a script
# nothing here needs. tesseract.js arrives through officeparser and its postinstall only prints a
# donation notice. A package left out entirely stops the install with ERR_PNPM_IGNORED_BUILDS.
# The AI stack (LangChain, the OpenAI, Anthropic and MCP SDKs) resolves against zod 3, as it was released and tested.
# Their zod range also admits 4, and once enough workspace packages depend on zod 4 for route validation, pnpm moves
# part of the stack onto it: the `openai` client and LangChain then load different copies, types stop agreeing, and
# LangGraph's interrupt handling changes behavior. Pinning keeps one copy throughout the stack.
overrides:
  '@anthropic-ai/sdk>zod': 3.25.76
  '@langchain/anthropic>zod': 3.25.76
  '@langchain/classic>zod': 3.25.76
  '@langchain/community>zod': 3.25.76
  '@langchain/core>zod': 3.25.76
  '@langchain/langgraph>zod': 3.25.76
  '@langchain/mcp-adapters>zod': 3.25.76
  '@langchain/openai>zod': 3.25.76
  '@modelcontextprotocol/sdk>zod': 3.25.76
  'langchain>zod': 3.25.76
  'openai>zod': 3.25.76

allowBuilds:
  # Ships prebuilt binaries for every platform NocoBase supports and loads them first. Its implicit
  # node-gyp build compiles nothing when one matches, yet still fails on a machine without make.
  better-sqlite3: false
  oracledb: true
  esbuild: true
  tesseract.js: false
  # Pulled in by @iconscout/unicons, the icon font the documentation site uses. Its build script only runs when
  # unicons regenerates its own fonts; the .woff2 files ship in the published package, so compiling the native addon
  # at install time produces nothing anything reads.
  ttf2woff2: false
  '@parcel/watcher': false
  '@biomejs/biome': true
  '@swc/core': true
  # Pulled in by dockerode (app-host-docker). ssh2 only compiles an optional native crypto binding and
  # falls back to JavaScript without it; cpu-features is that binding's optional helper; protobufjs's script only
  # prints a version notice.
  cpu-features: false
  protobufjs: false
  ssh2: false
  # Arrives through swagger-ui-dist, a development dependency of @nocobase/app-server; its install script only
  # reports download analytics.
  '@scarf/scarf': false

# Use msgpackr without its optional native accelerator or platform binary packages.
ignoredOptionalDependencies:
  - msgpackr-extract
  # The Claude Agent SDK's platform packages each carry a bundled Claude Code binary. The runner (`nocobase-runner`)
  # runs the `claude` it finds on PATH instead.
  - '@anthropic-ai/claude-agent-sdk-*'
  # Optional native decompressors of just-bash, a development dependency of the agents plugin. The bundle the plugin
  # ships leaves xz and zstd archives out, so nothing here loads them.
  - node-liblzma
  - '@mongodb-js/zstd'

# Reports a dependency whose install script was skipped as a warning instead of failing the install.
# allowBuilds decides the packages known today; this keeps a newly introduced transitive dependency
# from breaking every install until someone adds its entry.
# See https://pnpm.io/settings/build#strictdepbuilds.
strictDepBuilds: false

minimumReleaseAgeExclude:
  - mailparser@3.9.24
  - nodemailer@10.0.3
  - '@publint/pack@0.1.7'
  - publint@0.3.24
  - '@gchust/agent-annotations@0.1.9'
  - eslint-plugin-react-refresh@0.5.6