mirror of
https://github.com/openclaw/openclaw.git
synced 2026-10-03 09:39:25 +00:00
145 lines
5 KiB
YAML
145 lines
5 KiB
YAML
packages:
|
|
- .
|
|
- ui
|
|
- packages/*
|
|
- extensions/*
|
|
- examples/*
|
|
|
|
minimumReleaseAge: 10080
|
|
minimumReleaseAgeStrict: true
|
|
|
|
# Trusted Codex runtimes are outside the dependency cooldown.
|
|
minimumReleaseAgeExclude:
|
|
# Requested CUA update with keyboard delivery fixes; remove after 2026-09-22T22:00:08Z.
|
|
- "@trycua/cua-driver@0.28.2"
|
|
- "@trycua/cua-driver-darwin-arm64@0.28.2"
|
|
- "@trycua/cua-driver-darwin-x64@0.28.2"
|
|
- "@trycua/cua-driver-linux-arm64-gnu@0.28.2"
|
|
- "@trycua/cua-driver-linux-x64-gnu@0.28.2"
|
|
- "@trycua/cua-driver-win32-arm64-msvc@0.28.2"
|
|
- "@trycua/cua-driver-win32-x64-msvc@0.28.2"
|
|
# Reviewed ACPX release; remove after 2026-09-29T10:05:37.124Z.
|
|
- acpx@0.19.1
|
|
# Published ACPX runtime dependencies; remove after 2026-09-22T12:38:43Z.
|
|
- "@openclaw/fs-safe@0.12.0"
|
|
- "@openclaw/fs-safe-darwin-arm64@0.12.0"
|
|
- "@openclaw/fs-safe-darwin-x64@0.12.0"
|
|
- "@openclaw/fs-safe-linux-arm64-gnu@0.12.0"
|
|
- "@openclaw/fs-safe-linux-arm64-musl@0.12.0"
|
|
- "@openclaw/fs-safe-linux-x64-gnu@0.12.0"
|
|
- "@openclaw/fs-safe-linux-x64-musl@0.12.0"
|
|
- "@openclaw/fs-safe-win32-x64-msvc@0.12.0"
|
|
# Published ACPX runtime dependency; remove after 2026-09-17T21:44:31Z.
|
|
- zod@4.6.2
|
|
# GHSA-jqcg-44mw-7w3h trust-subnet fix; remove after 2026-09-22 06:13 UTC.
|
|
- "proxy-addr@2.0.8"
|
|
# Smartquotes denial-of-service fix; remove after 2026-09-18 04:04 UTC.
|
|
- "markdown-it@15.0.2"
|
|
# Reviewed running-adapter evidence contract; remove after 2026-09-23.
|
|
- "@openclaw/crabline@0.1.27"
|
|
# Reviewed Opus WASM stack repair; remove after 2026-09-21.
|
|
- "libopus-wasm@0.4.0"
|
|
# Reviewed proxy DNS/TLS controls; remove after 2026-09-15 10:08 UTC.
|
|
- "@openclaw/proxyline@0.3.12"
|
|
- "@openai/codex"
|
|
- "@openai/codex-*"
|
|
# Reviewed fs-safe 0.18.2 release and native helpers; remove after 2026-09-30T05:26:43.267Z.
|
|
- "@openclaw/fs-safe@0.18.2"
|
|
- "@openclaw/fs-safe-darwin-arm64@0.18.2"
|
|
- "@openclaw/fs-safe-darwin-x64@0.18.2"
|
|
- "@openclaw/fs-safe-linux-arm64-gnu@0.18.2"
|
|
- "@openclaw/fs-safe-linux-arm64-musl@0.18.2"
|
|
- "@openclaw/fs-safe-linux-x64-gnu@0.18.2"
|
|
- "@openclaw/fs-safe-linux-x64-musl@0.18.2"
|
|
- "@openclaw/fs-safe-win32-x64-msvc@0.18.2"
|
|
# fs-safe archive dependency; remove after 2026-09-16.
|
|
- "jszip@3.10.2"
|
|
# GHSA-prgh-xp8r-p3m5 / GHSA-v53p-9fqp-m79j security fixes; remove after 2026-09-18.
|
|
- "nodemailer@10.0.8"
|
|
|
|
# Isolated installs let pnpm reuse whole-package APFS clones instead of relinking every file.
|
|
nodeLinker: isolated
|
|
# Private inodes keep sibling installs from changing compiler input ctimes.
|
|
packageImportMethod: clone-or-copy
|
|
# GWTs share node_modules; script commands must not reconcile that shared install.
|
|
verifyDepsBeforeRun: false
|
|
blockExoticSubdeps: true
|
|
|
|
overrides:
|
|
# Memory LanceDB supplies vectors; WhatsApp prepares thumbnails with Rastermill.
|
|
"@lancedb/lancedb>@huggingface/transformers": "-"
|
|
"baileys>sharp": "-"
|
|
"@agentclientprotocol/codex-acp@1.11.0>@openai/codex": 0.155.1
|
|
"@codemirror/commands@6.11.0>@codemirror/view": 6.43.11
|
|
"@anthropic-ai/sdk": 0.125.0
|
|
"@anthropic-ai/vertex-sdk@0.19.8>google-auth-library": 11.0.2
|
|
"@opentelemetry/core": 2.11.0
|
|
"@opentelemetry/propagator-jaeger": 2.11.0
|
|
"@aws-sdk/core": 3.978.0
|
|
"@aws-sdk/credential-provider-node": 3.972.83
|
|
"@aws-sdk/xml-builder": 3.972.40
|
|
"@hono/node-server": 2.1.1
|
|
axios: 1.20.0
|
|
fast-uri: 4.1.4
|
|
follow-redirects: 1.16.0
|
|
defu: 6.1.7
|
|
fast-xml-parser: 5.11.1
|
|
request: "npm:@cypress/request@4.0.1"
|
|
request-promise: "npm:@cypress/request-promise@5.0.0"
|
|
basic-ftp: 6.2.1
|
|
brace-expansion: 5.0.9
|
|
file-type: 22.1.0
|
|
form-data: 4.0.6
|
|
"werift-ice@0.2.2>ip": "npm:neoip@3.1.0"
|
|
ip-address: 10.7.0
|
|
"mailauth@5.0.3>nodemailer": 10.0.9
|
|
# Mailauth pins vulnerable Undici; remove when its direct dependency is fixed.
|
|
"mailauth@5.0.3>undici": 8.10.2
|
|
minimatch: 10.2.6
|
|
path-to-regexp: 8.4.2
|
|
proxy-addr: 2.0.8
|
|
qs: 6.16.0
|
|
node-domexception: "npm:@nolyfill/domexception@1.0.28"
|
|
typebox: 1.3.30
|
|
tar: 7.5.22
|
|
tough-cookie: 6.0.2
|
|
"tsdown>rolldown-plugin-dts": 0.28.5
|
|
"zca-js@2.1.2>tough-cookie": 6.0.2
|
|
yauzl: 3.4.0
|
|
protobufjs: 8.8.0
|
|
uuid: 14.0.2
|
|
|
|
allowBuilds:
|
|
onnxruntime-node: false
|
|
"@google/genai": true
|
|
"@lydell/node-pty": true
|
|
"@matrix-org/matrix-sdk-crypto-nodejs": true
|
|
"@tloncorp/api": true
|
|
"@tloncorp/tlon-skill": true
|
|
baileys: true
|
|
authenticate-pam: true
|
|
"@discordjs/opus": false
|
|
esbuild: true
|
|
koffi: false
|
|
protobufjs: true
|
|
tree-sitter-bash: false
|
|
openclaw: true
|
|
"@openclaw/proxyline": true
|
|
clawpdf: true
|
|
"@openclaw/crabline": true
|
|
rastermill: true
|
|
node-pty: true
|
|
|
|
# The transient npm lock generator also needs the peer marked optional.
|
|
packageExtensions:
|
|
baileys:
|
|
peerDependenciesMeta:
|
|
sharp:
|
|
optional: true
|
|
|
|
patchedDependencies:
|
|
"chrome-devtools-mcp@1.8.0": patches/chrome-devtools-mcp@1.8.0.patch
|
|
"@awesome.me/webawesome@3.12.0": patches/@awesome.me__webawesome@3.12.0.patch
|
|
"matrix-js-sdk@42.3.0": patches/matrix-js-sdk@42.3.0.patch
|
|
"@novnc/novnc@1.7.0": patches/@novnc__novnc@1.7.0.patch
|
|
vitest@5.0.0: patches/vitest@5.0.0.patch
|