pnpm-workspace.yaml

packages:
  - apps/docs
  - apps-sfdx

engineStrict: true

# Allow installing root-level dependencies
ignoreWorkspaceRootCheck: true

# Wait 3 days before upgrading packages
minimumReleaseAge: 4320
minimumReleaseAgeExclude:
  - "@jetstreamapp/*"

# Allow scripts from these specific libraries
allowBuilds:
  "@parcel/watcher": true
  "@prisma/engines": true
  "@sentry/cli": false
  "@swc/core": true
  core-js: false
  electron: true
  electron-winstaller: true
  esbuild: true
  less: false
  node: false
  nx: true
  prisma: true
  sharp: true
  spawn-sync: false
  unrs-resolver: true

overrides:
  "@babel/traverse": ">=7.23.2 <8.0.0"
  # Force a patched @xmldom/xmldom on the unauthenticated SAML response-validation path
  # (@node-saml/node-saml -> xml-crypto/xml-encryption). 0.8.11 is below the 0.8.12 (injection)
  # and 0.8.13 (recursion DoS, GHSA-2v35-w6hq-6mfw) patches.
  "@xmldom/xmldom": "^0.8.13"
  # Force a patched @xhmikosr/decompress on the dev-only @swc/cli binary-download path
  # (@swc/cli -> @xhmikosr/bin-wrapper -> downloader -> decompress). <10.2.1 allows archive
  # extraction to write files/links outside the target dir (GHSA-mp2f-45pm-3cg9). 10.2.1 stays
  # within downloader's declared ^10.0.1 range.
  "@xhmikosr/decompress": "^10.2.1"
  axios: "^1.16.1"
  "connect-pg-simple>@types/express-session": "^1.18.2"
  dompurify: "^3.3.2"
  handlebars: "4.7.9"
  shell-quote: "1.8.4"
  # Force a patched tar on the electron-builder/node-gyp build-tool chain (app-builder-lib and
  # node-gyp resolve tar 7.5.16). <=7.5.18 allows a decompression/parse DoS via unlimited input
  # (GHSA-23hp-3jrh-7fpw). 7.5.20 matches our direct dependency and stays within both consumers'
  # ^7.x ranges, deduping the tree to a single tar version.
  tar: "^7.5.20"
  "next-images>loader-utils": "2.0.4"