packages:

include packages in subfolders (e.g. apps/ and packages/)

• "web"
• "worker"
• "packages/**"
• "ee"

5 day delay for new dep upgrades to reduce supply chain attack risk

minimumReleaseAge: 7200

the exclusions are temporary so that we can set the 5 day limit without downgrading packages.

this list is version-specific

minimumReleaseAgeExclude:

• [email protected]
• "[email protected]||4.0.6"
• [email protected]
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]"
• "@esbuild/[email protected]" allowBuilds: "@prisma/client": true "@prisma/engines": true "@sentry/cli": true esbuild: true sharp: true unrs-resolver: true "@datadog/native-appsec": false "@datadog/native-iast-taint-tracking": false "@datadog/native-metrics": false core-js: false dd-trace: false msgpackr-extract: false msw: false prisma: false protobufjs: false "@datadog/pprof": false "@scarf/scarf": false overrides: esbuild: "0.28.1" zod: 4.3.6 nanoid: ^3.3.8 katex: ^0.16.21 tar-fs: ^2.1.2 rollup@^4.0.0: ^4.22.4 "@types/node-fetch": ^2.6.13 "@types/react-dom": 19.2.3 fast-xml-builder: 1.1.7 glob: ^10.5.0 qs: 6.15.2 [email protected]: 0.1.13 [email protected]: 10.2.0 "@ai-sdk/provider-utils@<=4.0.26": 4.0.27 "@ai-sdk/provider-utils-v5": "npm:@ai-sdk/[email protected]" "@copilotkit/[email protected]>@ag-ui/langgraph": 0.0.29

Keep Anthropic's Vertex client on an SDK version that emits Vertex rawPredict URLs.

Remove once @langchain/anthropic allows the same SDK range.

Check: https://www.npmjs.com/package/@langchain/anthropic?activeTab=dependencies

"@anthropic-ai/vertex-sdk>@anthropic-ai/sdk": 0.104.1 patchedDependencies: [email protected]: patches/next-[email protected] publicHoistPattern:

• "prisma"
• "@aws-sdk/client-s3"