# pnpm 11 reads these workspace settings during the Docker css-build.
#
# trustLockfile: pnpm 11.9.0 added a supply-chain verification pass
# ("Verifying lockfile against supply-chain policies") that re-checks
# minimumReleaseAge / trustPolicy against the registry on every
# install. Under the emulated linux/arm64 image build that pass crawls
# to a near-hang and blew past the 45-minute Docker job. The committed
# lockfile is our own trusted base, so skip the re-verification here.
trustLockfile: true

# allowBuilds: this project compiles the Tailwind + daisyUI CSS bundle
# at Docker build time; @parcel/watcher runs an install-time native
# build for the optional watch path.
allowBuilds:
  "@parcel/watcher": true

overrides:
  # GHSA-68fv-2mgg-jv7q (CVE-2026-93749): source-map-js <1.2.2 can
  # stall the event loop through indexed source-map section offsets,
  # fixed in 1.2.2. Transitive via @tailwindcss/cli > @tailwindcss/node,
  # which declares ^1.2.1.
  source-map-js: ">=1.2.2 <2"