pnpm-workspace.yaml

# TODO(deps): enable `minimumReleaseAge: 4320` here at the same time as in
# ../src/Gatherstead.Web/pnpm-workspace.yaml — see the explanation there. Blocked on the same
# nanoid@3.3.17 lockfile entry; safe from 2026-08-06.

# Native/build-script dependencies this project trusts to run install scripts (pnpm 11+).
# Mirrors the allowlist convention in ../src/Gatherstead.Web/pnpm-workspace.yaml.
allowBuilds:
  esbuild: true
  sharp: true

# Transitive advisory floors. Deliberately NOT a copy of the web project's override block:
# astro 7.1.x requires vite ^8, so web's `vite: ">=7.3.2 <8"` bound would break this build.
# Only add keys here that a resolved version in pnpm-lock.yaml actually needs.
overrides:
  # GHSA-f88m-g3jw-g9cj (high): sharp < 0.35.0 bundles a libvips with four CVEs. astro declares
  # `sharp ^0.34.0 || ^0.35.0` and resolved 0.34.5, so bumping astro alone does not fix it.
  # Bounded to the 0.35 line; requires node >=20.9, satisfied by the node 24 used in CI.
  sharp: ">=0.35.0 <0.36"
  # GHSA-2p49-hgcm-8545 (high): svgo's removeScripts plugin leaves some executable scripts intact
  # (XSS). astro still declares `svgo ^4.0.1`, so this floor is required independently of the bump.
  svgo: ">=4.0.2 <5"
  # GHSA-7p8r-x3mc-p8w7 / GHSA-v2hh-gcrm-f6hx (high): host confusion via backslash authority.
  # Reached through ajv; bounded to 3.x since 4.x is a breaking API change.
  fast-uri: ">=3.1.5 <4"
  # GHSA-r28c-9q8g-f849 (high, path traversal) + GHSA-fxqj-rqcc-2cmp (incomplete fix of
  # GHSA-6g55-p6wh-862q, patched 8.5.23). Reached via expressive-code and postcss-nested.
  postcss: ">=8.5.23 <9"
  # GHSA-8cp3-6hjf-hh8h (high): quadratic CPU consumption in !!omap. Bounded to the 4.x line;
  # 5.x is a breaking API change for every consumer in the tree.
  js-yaml: ">=4.3.1 <5"