packages:
  - "."

# miniflare pins undici at exactly 7.28.0 and sharp at exactly 0.35.2, so no
# upstream bump clears their advisories. undici 7.30.1 is the advised patch for
# the 7.x line, and sharp 0.35.5 for the librsvg CVE. Drop these once miniflare
# ships dependencies past them.
overrides:
  undici: "7.30.1"
  sharp: "0.35.5"
  # CVE-2026-59870 (dependabot #6): quadratic CPU in !!omap; dev-only via astro.
  js-yaml: "^4.3.1"

allowBuilds:
  esbuild: true
  workerd: true

minimumReleaseAgeExclude:
  - miniflare@4.20260730.0
  - wrangler@4.116.0

onlyBuiltDependencies:
  - esbuild
  - workerd