pnpm-workspace.yaml

packages:
  - packages/*
  - packages/actor-scraper/*

minimumReleaseAge: 1440
minimumReleaseAgeExclude:
  - "@apify/*"
  - "@crawlee/*"
  - "apify-client"
  - "apify"
  - "crawlee"
  - "got-scraping"
  # Renovate security update: turbo@2.9.14
  - turbo@2.9.14

# pnpm 11 replaced the onlyBuiltDependencies allowlist with this boolean map. Every package here
# runs install scripts; anything omitted is an ERR_PNPM_IGNORED_BUILDS failure rather than a warning.
allowBuilds:
  "@playwright/browser-chromium": true
  "@swc/core": true
  better-sqlite3: true
  camoufox-js: true
  esbuild: true
  nx: true
  playwright: true
  puppeteer: true

nodeLinker: hoisted
linkWorkspacePackages: true
preferWorkspacePackages: true

# Two groups of overrides.
#
# 1. Sitemap Extractor is the only actor on Apify/Crawlee v4 beta. Other generic actors intentionally
#    stay on Apify/Crawlee v3. apify@4 beta depends on @crawlee/* through broad beta ranges, so force
#    its internal Crawlee packages to the same beta versions used directly by the sitemap actor.
# 2. Security overrides for transitives whose owner still resolves an affected range. vite reaches us
#    through vitest and vite-tsconfig-paths; lerna pins js-yaml and tar to exact vulnerable versions
#    (lerna 10 ships patched ones, but that is a major bump of the release tooling). Drop an entry
#    once its owner has moved on.
overrides:
  "apify@4.0.0-beta.12>@crawlee/core": "4.0.0-beta.25"
  "apify@4.0.0-beta.12>@crawlee/types": "4.0.0-beta.25"
  "apify@4.0.0-beta.12>@crawlee/utils": "4.0.0-beta.25"
  vite: "^8.0.0"
  postcss: "^8.5.25"
  js-yaml: "^4.3.1"
  tar: "^7.5.22"