composiohq__composio/pnpm-workspace.yaml

packages:
  - ts/e2e-tests/_utils
  - ts/e2e-tests/cli/*
  - ts/e2e-tests/cli/**/*
  - ts/e2e-tests/runtimes/node/*
  - ts/e2e-tests/runtimes/deno/*
  - ts/e2e-tests/runtimes/cloudflare/*
  - ts/examples/*
  - ts/packages/cli
  - ts/packages/cli-keyring
  - ts/packages/cli-local-tools
  - ts/packages/core
  - ts/packages/experimental
  - ts/packages/json-schema-to-effect-schema
  - ts/packages/json-schema-to-zod
  - ts/packages/slim
  - ts/packages/providers/*
  - ts/packages/ts-builders

allowBuilds:
  '@google/genai': false
  '@parcel/watcher': true
  esbuild: true
  msgpackr-extract: true
  protobufjs: true
  sharp: false
  tree-sitter: true
  workerd: true

catalog:
  '@ai-sdk/mcp': ^2.0.32
  '@ai-sdk/openai': ^4.0.42
  '@arethetypeswrong/cli': ^0.18.5
  '@clack/core': '^1.4.3'
  '@clack/prompts': '^1.7.0'
  '@cloudflare/vitest-pool-workers': 0.21.3
  '@cloudflare/workers-types': ^5.20260815.1
  '@composio/client': 0.1.0-alpha.76
  '@effect/cli': ^0.77.0
  '@effect/language-service': ^0.87.2
  '@effect/platform': ^0.97.1
  '@effect/platform-bun': ^0.91.2
  '@effect/platform-node': ^0.108.0
  '@effect/platform-node-shared': ^0.61.1
  '@effect/vitest': ^0.30.0
  # 1.52.1 is the latest version that keeps Node-only execa code out of
  # Workers bundles.
  '@mastra/core': 1.52.1
  '@modelcontextprotocol/sdk': ^1.30.0
  '@types/bun': ^1.3.14
  ai: ^7.0.66
  dotenv: ^17.4.2
  effect: ^3.22.1
  hono: ^4.13.2
  openai: ^7.2.0
  picocolors: ^1.1.1
  pnpm: ^11.21.0
  publint: ^0.3.23
  tsdown: ^0.22.14
  tsx: ^4.23.12
  typescript: ^7.0.2
  '@vitest/ui': ^4.1.10
  vitest: ^4.1.10
  wrangler: ^4.123.0
  zod: ^4.4.3
  zod-to-json-schema: ^3.25.2

catalogs:
  # TS7 (tsgo) ships no JS compiler API; consumers of that API pin TS6 here.
  # `typescript` rebinds the compiler-API import for @composio/cli's generate
  # pipeline and @composio/core's typedoc docgen (their typechecks still run the
  # root TS7 tsc — the alias package only ships a tsc6 bin). For core, this also
  # routes tsdown's declaration emit through TS6; the types remain equivalent,
  # but union member order and dist chunk hashes may change. `typescript6` is the
  # side-by-side alias for scripts that also need TS7 in scope
  # (ts/scripts/validate-examples.ts).
  ts6:
    typescript: npm:@typescript/typescript6@^6.0.2
    typescript6: npm:@typescript/typescript6@^6.0.2

minimumReleaseAge: 4320

minimumReleaseAgeExclude:
  - '@mastra/core'
  - '@composio/client'
  - chrome-devtools-mcp
  # temporary: hono >=4.12.34 carries the CORS ReDoS fix
  # (GHSA-hp3h-89pf-5q58 class, Access-Control-Request-Headers), but both
  # 4.12.34 and 4.13.0 were published within the 4320-minute floor, so
  # --frozen-lockfile rejects the lockfile on every branch. The last version
  # old enough to pass the gate is 4.12.33, which is the vulnerable one.
  # hono is only pulled in by ts/e2e-tests/runtimes/cloudflare/* and
  # ts/examples/cloudflare-wrangler -- it ships in no published package --
  # so taking the fix ahead of the floor is the safer trade. Drop this entry
  # once the resolved version is older than the floor (after 2026-08-06).
  - hono

peerDependencyRules:
  allowedVersions:
    typescript: '^6.0.0 || ^7.0.0'
    vitest: ^4.0.0
    zod: ^4.0.0

overrides:
  qs@<6.14.1: '>=6.14.1'
  protobufjs: 7.6.5
  # temporary: @zed-industries/claude-code-acp@0.16.2 (latest) exact-pins vulnerable 10.2.1; drop when it ships >=10.2.3
  'minimatch@>=10.0.0 <10.2.3': '>=10.2.3 <11'
  # temporary: @redocly/openapi-core@1.34.x (via openapi-typescript) exact-pins vulnerable 4.2.0; drop when it ships >=4.3.1
  'js-yaml@>=4.0.0 <4.3.1': '>=4.3.1 <5'
  # temporary: @ai-sdk/provider-utils@4 exact-pins vulnerable undici 5.x; drop when it ships >=6.28.0.
  'undici@>=5.0.0 <6.28.0': '>=6.28.0 <7'
  # temporary: gray-matter exact-pins vulnerable js-yaml 3.15.0; drop when it ships >=3.15.1.
  'js-yaml@>=3.0.0 <3.15.1': '>=3.15.1 <4'
  # temporary: @modelcontextprotocol/sdk depends on the 1.x line, which
  # GHSA-frvp-7c67-39w9 (serve-static path traversal) patches only in 2.0.5.
  # The floor also clears GHSA-9mqv-5hh9-4cgg (WebSocket handshake DoS, fixed
  # in 2.0.10); drop when the SDK depends on >=2.0.10 itself.
  '@hono/node-server@<2.0.10': '>=2.0.10 <3'
  # temporary: GHSA-7p8r-x3mc-p8w7; ajv accepts the patched 3.x line. Drop when
  # its lockfile resolution is >=3.1.5 without an override.
  'fast-uri@>=3.0.0 <3.1.5': '>=3.1.5 <4'
  # temporary: GHSA-mwp4-54f8-5fhr; express-rate-limit accepts the patched 10.x
  # line. Drop when its lockfile resolution is >=10.3.1 without an override.
  'ip-address@>=10.0.0 <=10.3.0': '>=10.3.1 <11'
  # temporary: GHSA-4cwx-7wf7-3272; @ai-sdk/provider-utils accepts the patched
  # 7.x line. Drop when its lockfile resolution is >=7.29.0 without an override.
  'undici@>=7.0.0 <7.29.0': '>=7.29.0 <8'
  # temporary: GHSA-mh99-v99m-4gvg requires the 5.x line for older majors, and
  # GHSA-rgw5-rvv9-x895 raises its patched floor to 5.0.9. This selector spans
  # majors deliberately -- narrowing it to the 5.x line would reintroduce a
  # HIGH finding on the production openapi-typescript path and fail the audit
  # gate.
  # Known trade-off: minimatch@5.1.9 (via @redocly/openapi-core) consumes
  # brace-expansion as a callable CJS export, which 5.x replaced with a named
  # `expand`, so a brace-containing pattern throws there. Not reachable today --
  # the CLI's only openapi-typescript call passes an in-memory document and no
  # redocly globs. Drop when openapi-typescript ships a @redocly/openapi-core
  # whose minimatch accepts brace-expansion 5.x.
  'brace-expansion@<=5.0.8': '>=5.0.9 <6'
  'vite@<=7.3.4': 7.3.5
  'esbuild@>=0.27.3 <0.28.1': 0.28.1