packages:
  - "apps/*"
  - "packages/*"
  - "tools/www-assets"

catalog:
  "@types/node": ^26.6.6

autoInstallPeers: false
minimumReleaseAge: 1440
minimumReleaseAgeStrict: true
minimumReleaseAgeExclude:
  # Released security fix for GHSA-ch52-4w7c-c8xp.
  - "http-cache-semantics@4.3.0"
  - "@techsquidtv/canvas-timeline@0.7.0"
  - "@techsquidtv/canvas-timeline-core@0.7.0"
  - "@techsquidtv/canvas-timeline-html-media-adapter@0.7.0"
  - "@techsquidtv/canvas-timeline-mediabunny-adapter@0.7.0"
  - "@techsquidtv/canvas-timeline-react@0.7.0"
  - "@techsquidtv/canvas-timeline-renderer@0.7.0"
  - "@techsquidtv/canvas-timeline-utils@0.7.0"
  - "@techsquidtv/gifenc@2.0.0"

allowBuilds:
  "@sentry/cli": true
  esbuild: true
  sharp: true
  workerd: true

overrides:
  # Astro augments HAST types; converters must share that same type instance.
  "@types/hast": 3.0.5
  # The OpenAPI parser pins vulnerable js-yaml; remove when it requires >=4.3.2.
  "@hey-api/json-schema-ref-parser>js-yaml": 4.3.2
  # ESLint and typescript-eslint still require vulnerable minimatch 10.
  # Remove when their released dependency ranges accept minimatch >=11.0.1.
  "minimatch@>=7.0.0 <11.0.1": 11.0.5
  enhanced-resolve: 5.26.1
  es-object-atoms: 1.1.2

peerDependencyRules:
  ignoreMissing:
    - mssql
    - "@types/mssql"