agents/pnpm-workspace.yaml at main · NextGenAILLC/agents · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
packages:
  - agents-api
  - agents-manage-ui
  - agents-cli
  - agents-ui-demo
  - agents-docs
  - agents-cookbook
  - test-agents
  - "packages/*"

catalog:
  better-auth: 1.5.5
  "@better-auth/sso": 1.5.5
  "@better-auth/infra": 0.1.11
  "@opentelemetry/api": ^1.9.0
  "@opentelemetry/auto-instrumentations-node": ^0.70.0
  "@opentelemetry/baggage-span-processor": ^0.5.0
  "@opentelemetry/context-async-hooks": ^2.5.1
  "@opentelemetry/core": ^2.5.1
  "@opentelemetry/exporter-trace-otlp-http": ^0.212.0
  "@opentelemetry/resources": ^2.5.1
  "@opentelemetry/sdk-node": ^0.212.0
  "@opentelemetry/sdk-trace-base": ^2.5.1
  "@opentelemetry/semantic-conventions": ^1.39.0

publicHoistPattern:
  - "@types/react"
  - "@types/react-dom"

ignorePatchFailures: false

patchedDependencies:
  "@changesets/assemble-release-plan@6.0.9": patches/@changesets__assemble-release-plan.patch
  fumadocs-core: patches/fumadocs-core.patch

overrides:
  next: ^16.1.6 # https://github.com/advisories/GHSA-5f7q-jpqc-wp7h
  esbuild: 0.25.9 # we pin it for Cypress
  "@modelcontextprotocol/sdk>zod": ^3.25.7
  "@anthropic-ai/mcpb>zod": ^3.25.7
  preact: "-" # we don't use preact, this removes pnpm audit warnings from posthog-js>preact
  # Security overrides — upstream packages haven't released fixes
  devalue: ">=5.6.3" # @workflow/core pins 5.6.0; DoS + prototype pollution
  rollup: ">=4.59.0" # vite lockfile pins 4.54.0; arbitrary file write
  undici: ">=6.23.0" # @workflow/web pins 6.22.0; unbounded decompression DoS
  fast-xml-parser: ">=5.3.6" # @aws-sdk/xml-builder@3.969.0 pins 5.2.5; entity injection + DoS
  qs: ">=6.14.2" # body-parser/cypress resolve stale versions; arrayLimit bypass DoS
  axios: ">=1.13.5" # @nangohq/types pins 1.12.0; DoS via __proto__ in mergeConfig
  "ajv@>=6 <6.14.0": ">=6.14.0 <7" # eslint resolves 6.12.6; ReDoS with $data option
  "ajv@>=8 <8.18.0": ">=8.18.0" # direct dep resolves 8.17.1; ReDoS with $data option
  "minimatch@<3.1.3": ">=3.1.3" # @eslint/config-array resolves 3.1.2; ReDoS via wildcards
  "minimatch@>=9 <9.0.6": ">=9.0.6" # @hono/vite-dev-server resolves 9.0.5; ReDoS via wildcards
  "minimatch@>=10 <10.2.1": ">=10.2.1" # glob@13 lockfile pins 10.1.1; ReDoS via wildcards