# pnpm 11 only reads overrides and build-script allow-lists from this
# file. The legacy `pnpm.overrides` and `pnpm.onlyBuiltDependencies`
# blocks in package.json are silently ignored after pnpm v11.

overrides:
  # GHSA-m5mm-p8h7-m29v (CVE-2026-115897): serialize-javascript <7.1.3
  # leaves `</script` unescaped at the end of a serialized function
  # body, an XSS wherever the output is inlined into a page; fixed in
  # 7.1.3. Supersedes the earlier >=7.0.5 floor for GHSA-76p7-773f-r4q5
  # (XSS via crafted Object.prototype payloads). Pulled transitively
  # through the Docusaurus webpack plugins; not a direct dep.
  serialize-javascript: ">=7.1.3"
  # CVE-2026-69153 (GHSA-fxqj-rqcc-2cmp): postcss <8.5.23 still reads
  # arbitrary `.map` files from an attacker-controlled
  # sourceMappingURL when `from` is unset, an incomplete fix of
  # GHSA-6g55-p6wh-862q. Supersedes the earlier >=8.5.18 floor for
  # GHSA-r28c-9q8g-f849 (same auto-loader, path traversal) and the
  # >=8.5.10 floor for CVE-2026-41305 (GHSA-qx2v-qp2m-jg93, XSS via
  # unescaped </style> in stringify output). Transitive via
  # @docusaurus/core.
  postcss: ">=8.5.23"
  # uuid <14.0.0 floor for a single resolved major across the tree;
  # multiple Docusaurus transitives still pin older 9.x/10.x lines.
  uuid: ">=14.0.0"
  # GHSA-rwhq-pwvg-2vrg: @babel/plugin-transform-modules-systemjs
  # 7.12.0..=7.29.3 can generate arbitrary code when compiling
  # malicious input. Transitive via @docusaurus/core > @babel.
  "@babel/plugin-transform-modules-systemjs": ">=7.29.4"
  # fast-uri <3.1.9 carries five advisories: GHSA-hrr3-gc8f-f4qj
  # (CVE-2026-86472, inconsistent host case normalisation via
  # percent-encoded octets, fixed in 3.1.8) and four fixed in 3.1.9,
  # GHSA-w74x-v6f9-j3xg (CVE-2026-110306, scheme spoofing via
  # percent-encoded scheme decoding), GHSA-wjr9-j795-jxcr
  # (CVE-2026-110180, host confusion via unchecked WHATWG host
  # canonicalisation), GHSA-xhq7-xmqj-769h (CVE-2026-110095, path
  # equivalence in relative reference normalisation), and
  # GHSA-333x-w4r6-6crp (CVE-2026-110725, scheme injection via an
  # unescaped first-segment colon). Supersedes the earlier >=3.1.6
  # floor for CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, and
  # CVE-2026-76172, the >=3.1.5 floor for CVE-2026-18446
  # (GHSA-7p8r-x3mc-p8w7), and the >=3.1.4 floor before it that cleared
  # GHSA-86c8-pmm6-93fp, CVE-2026-13676, and CVE-2026-16221.
  # Transitive via @docusaurus/core > webpack > schema-utils > ajv.
  # Held to the 3.x line expected by ajv.
  fast-uri: ">=3.1.9 <4"
  # image-size <=2.0.2 carries two infinite-loop DoS advisories, both
  # fixed in 2.0.3: GHSA-w3rx-r6r6-pgpr (ICNS parser) and
  # GHSA-5p2g-fcmc-qvqq (JXL and HEIF parsers). Transitive via
  # @docusaurus/core > @docusaurus/mdx-loader; runs only while the
  # docs site builds.
  image-size: ">=2.0.3"
  # mermaid <11.16.1 carries five advisories, all fixed in 11.16.1:
  # GHSA-3rrr-jr9j-h3q3 (prototype pollution through Architecture
  # diagrams), GHSA-rhh3-jpg6-66xh (DoS via radar diagrams),
  # GHSA-6x64-9x62-f2gx (CSS injection reaching siblings of the
  # diagram), GHSA-2v8p-3f2j-5mp7 (infinite-loop DoS in XY charts),
  # and GHSA-c4c3-pg64-4m4v (prototype pollution via the configuration
  # APIs). Supersedes the earlier >=11.15.0 floor that cleared the
  # classDef, classDefs, configuration, and Gantt sanitisation alerts.
  # Transitive via @docusaurus/theme-mermaid.
  mermaid: ">=11.16.1"
  # webpack-dev-server <=5.2.5 carries GHSA-m28w-2pqf-7qgj (DoS via a
  # malformed Host or Origin header) and GHSA-f5vj-f2hx-8m93 (CSRF
  # through internal developer endpoints), both fixed in 5.2.6;
  # supersedes the earlier GHSA-mx8g-39q3-5c79 <5.2.5 floor.
  # Transitive via @docusaurus/core; only active during `pnpm start`.
  webpack-dev-server: ">=5.2.6 <6"
  # CVE-2026-48779 (GHSA-96hv-2xvq-fx4p): ws >=8.0.0 <8.21.0 allows a
  # memory-exhaustion DoS from a flood of tiny WebSocket fragments;
  # supersedes the earlier CVE-2026-45736 <8.20.1 floor. Transitive
  # via @docusaurus/core > webpack-dev-server and
  # webpack-bundle-analyzer.
  ws: ">=8.21.0"
  # GHSA-pqg4-j6r4-53mv (CVE-2026-102422): shell-quote <1.11.0 lets a
  # line terminator inside a token through quote(), enabling command
  # injection when the output is handed to a shell; fixed in 1.11.0.
  # Supersedes the earlier >=1.8.4 floor for CVE-2026-9277
  # (GHSA-w7jw-789q-3m8p, newlines left unescaped by quote()).
  # Transitive via @docusaurus/core > webpack-dev-server >
  # launch-editor. Held to the 1.x line launch-editor declares.
  shell-quote: ">=1.11.0 <2"
  # undici <7.30.1 carries the advisories fixed across 7.29.1 and
  # 7.30.1, among them two TLS certificate-validation bypasses
  # (GHSA-2m5v-pch6-74hx, CVE-2026-109383; GHSA-w293-vg96-wgc3,
  # CVE-2026-84961), cache poisoning across origins on redirects
  # (GHSA-4w7w-5xrc-9h26, CVE-2026-109829), DoS via TLS 1.2
  # renegotiation (GHSA-qrxm-fqhp-jwvm) and via excessive
  # content-encodings (GHSA-xjj6-f33q-929c), and a WebSocket
  # subprotocol DoS (GHSA-rfgv-xxqx-mfg5), plus medium and low issues
  # fixed in the same releases. Supersedes the earlier >=7.29.0 floor
  # for CVE-2026-13697, CVE-2026-14643, CVE-2026-15157, CVE-2026-16728,
  # and CVE-2026-16729, and the >=7.28.0 floor before it that cleared
  # GHSA-vmh5-mc38-953g, GHSA-vxpw-j846-p89q, and GHSA-hm92-r4w5-c3mj.
  # Transitive via @easyops-cn/docusaurus-search-local > cheerio. Held
  # to the 7.x line since nothing in the tree needs undici 8.
  undici: ">=7.30.1 <8"
  # dompurify <3.4.17 carries GHSA-cg2g-xh64-v4q7 (critical: split
  # template expressions survive SAFE_FOR_TEMPLATES in an attached
  # shadow root) and GHSA-mrv2-3pqr-j5jr (an IN_PLACE hook that removes
  # a parent or sibling leaves the detached subtree's event handlers),
  # plus the low-severity GHSA-c6gr-qvv4-5v3f, GHSA-6688-9rhm-gjv2, and
  # GHSA-p98j-92pf-mc4p, all fixed by 3.4.17. Supersedes the earlier
  # >=3.4.13 floor for GHSA-55q2-fjhq-7xh7, the >=3.4.12 floor for
  # GHSA-c2j3-45gr-mqc4, and the >=3.4.11 floor before them that
  # cleared the eight-advisory sanitizer-bypass cluster
  # (GHSA-x4vx-rjvf-j5p4, GHSA-vxr8-fq34-vvx9, GHSA-gvmj-g25r-r7wr,
  # GHSA-rp9w-3fw7-7cwq, GHSA-hpcv-96wg-7vj8, GHSA-r47g-fvhr-h676,
  # GHSA-76mc-f452-cxcm, GHSA-cmwh-pvxp-8882).
  # Transitive via @docusaurus/theme-mermaid > mermaid.
  dompurify: ">=3.4.17 <4"
  # GHSA-4x5r-pxfx-6jf8: @babel/core <7.29.1 can read arbitrary files
  # through a crafted sourceMappingURL comment during compilation.
  # Transitive via @docusaurus/core > @docusaurus/babel.
  "@babel/core": ">=7.29.1 <8"
  # GHSA-64mm-vxmg-q3vj: http-proxy-middleware <2.0.10 matches its
  # router by host+path substring, letting a crafted Host header reach
  # an unintended backend. Transitive via @docusaurus/core >
  # webpack-dev-server; only active during `pnpm start`.
  http-proxy-middleware: ">=2.0.10 <3"
  # GHSA-4528-x5fx-h6hg (CVE-2026-118772): joi <17.13.9 splits
  # string().email({ multiple: true }) input in quadratic time, a DoS,
  # fixed in 17.13.9. Supersedes the earlier >=17.13.6 floor for the
  # prototype-pollution pair GHSA-gg4h-3hg2-grpc (CVE-2026-84367) and
  # GHSA-6w3j-5fw6-r9vr (CVE-2026-84368), and the >=17.13.4 floor
  # before it for GHSA-q7cg-457f-vx79 (uncaught RangeError on deeply
  # nested input through recursive link() schemas). Transitive via
  # @docusaurus/core > @docusaurus/utils > @docusaurus/types.
  joi: ">=17.13.9 <18"
  # CVE-2026-84375: js-yaml denial of service in YAML parsing, fixed in
  # 3.15.2 and 4.3.2; supersedes the earlier >=3.15.1 and >=4.3.1
  # floors for CVE-2026-59870 (GHSA-5p4m-2wfm-xmqj, quadratic CPU
  # consumption resolving !!omap) and the >=3.15.0 and >=4.1.2 floors
  # before them that cleared GHSA-h67p-54hq-rp68 (quadratic-complexity
  # DoS in merge-key handling via repeated aliases). Two lines resolve
  # in the tree: gray-matter pins js-yaml 3 (kept on the 3.x fix so its
  # safeLoad API survives) and Docusaurus build tooling pulls js-yaml 4.
  "js-yaml@3": ">=3.15.2 <4"
  "js-yaml@4": ">=4.3.2 <5"
  # launch-editor <2.14.2 carries three advisories, all fixed in
  # 2.14.2: GHSA-587h-7wmj-h5pm (CVE-2026-112942, existence check
  # bypassable on Windows), GHSA-r825-w8mm-5pxw (CVE-2026-112944, an
  # editor CLI flag misread as an argument, allowing command
  # execution), and GHSA-698v-4r3x-3vcv (CVE-2026-112943,
  # escapeCmdArgs() leaves `%` unescaped on Windows). Supersedes the
  # earlier >=2.14.1 floor for GHSA-v6wh-96g9-6wx3 (NTLMv2 hash leak
  # through UNC paths). Transitive via @docusaurus/core >
  # webpack-dev-server; only active during `pnpm start`.
  launch-editor: ">=2.14.2 <3"
  # CVE-2026-67213: nanoid <3.3.17 spins in an infinite loop generating
  # random IDs, a DoS reachable from whatever feeds it a size. Held to
  # the 3.x line that postcss 8 declares; the other fix, 5.1.6, is
  # ESM-only. Transitive via @docusaurus/core > postcss.
  nanoid: ">=3.3.17 <4"
  # GHSA-6pq8-jhm2-2vcw (CVE-2026-110816): qs <=6.16.0 throws an
  # uncaught TypeError from stringify with arrayFormat 'comma' when an
  # array element carries a non-callable own toString, a DoS; fixed in
  # 6.16.1. Supersedes the earlier >=6.16.0 floor for
  # GHSA-4mjr-xmp4-gh2g (CVE-2026-82417, DoS through an
  # attacker-controlled isBuffer reached from stringify) and
  # GHSA-x5fp-wj9c-mxmx (CVE-2026-82562, the array limit bypassed by
  # comma parsing of bracket keys), and the >=6.15.2 floor before it
  # for GHSA-q8mj-m7cp-5q26 (TypeError DoS on null/undefined entries in
  # comma-format arrays when encodeValuesOnly is set). Transitive via
  # @docusaurus/core > webpack-dev-server > express > body-parser;
  # only active during `pnpm start`.
  qs: ">=6.16.1 <7"
  # GHSA-27r3-jxmh-p828 (CVE-2026-111181): body-parser <1.20.9 can be
  # driven into a DoS by trailing bytes after a compressed request
  # body, fixed in 1.20.9. Supersedes the earlier >=1.20.6 floor for
  # GHSA-v422-hmwv-36x6 (size enforcement silently disabled by an
  # invalid `limit`). Transitive via @docusaurus/core >
  # webpack-dev-server > express; only active during `pnpm start`.
  # Held to the 1.x line that express 4 declares.
  body-parser: ">=1.20.9 <2"
  # websocket-driver <0.7.5 carries two advisories, both fixed in
  # 0.7.5: GHSA-xv26-6w52-cph6 (CVE-2026-54466, message corruption by
  # abusing protocol length headers) and GHSA-mp7j-qc5w-4988
  # (CVE-2026-54490, resource-limit bypass via message compression).
  # Transitive via @docusaurus/core > webpack-dev-server > sockjs >
  # faye-websocket; only active during `pnpm start`. Held to the 0.7
  # line because sockjs 0.3.24 declares ^0.7.4.
  websocket-driver: ">=0.7.5 <0.8"
  # brace-expansion 1.x carries three DoS advisories, all fixed on the
  # v1 maintenance line by 1.1.21: GHSA-6j4f-fj2g-mc7p
  # (CVE-2026-102276, uncontrolled recursion in parseCommaParts,
  # <1.1.19), GHSA-qhr7-859c-m2p7 (CVE-2026-102278, uncontrolled
  # recursion on nested brace groups, <1.1.20), and GHSA-q2hr-2g5m-vwhr
  # (CVE-2026-102277, quadratic-time `{a},b}` rewrite, <1.1.21).
  # Supersedes the earlier >=1.1.18 floor for CVE-2026-13149,
  # CVE-2026-14257, and CVE-2026-69152. Transitive via the many
  # minimatch 3.x consumers in the webpack toolchain. Held to the 1.x
  # line because minimatch 3 declares ^1.1.7 and 5.x replaced the
  # CommonJS default export with a named one.
  "brace-expansion@1": ">=1.1.21 <2"
  # GHSA-wq5f-xc86-pv6w: sharp <0.35.5 bundles a librsvg build subject
  # to CVE-2026-96889, fixed in 0.35.5. Supersedes the earlier >=0.35.4
  # floor for GHSA-rgj7-g3m4-5g8c (libheif builds subject to
  # GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545) and the >=0.35.0 floor
  # before it for GHSA-f88m-g3jw-g9cj (libvips builds subject to
  # CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, and
  # CVE-2026-35591). Transitive via @docusaurus/plugin-ideal-image >
  # responsive-loader; only used at build time to resize doc images.
  sharp: ">=0.35.5 <0.36"
  # CVE-2026-84370: svgo <3.3.5 lets executable links through
  # removeScripts via namespace and control-character bypasses, fixed
  # in 3.3.5; supersedes the earlier >=3.3.4 floor for
  # GHSA-2p49-hgcm-8545 (executable scripts left intact despite the
  # removeScripts plugin). Transitive via @docusaurus/core >
  # @svgr/webpack and cssnano > postcss-svgo. Held to the 3.x line
  # declared by both consumers.
  svgo: ">=3.3.5 <4"
  # GHSA-2wm5-q62r-hmrv (CVE-2026-85062): colord <2.9.4 rejects
  # oversized malformed colour strings slowly enough to be a DoS.
  # Transitive via @docusaurus/core > cssnano > postcss-colormin and
  # postcss-minify-gradients; only used at build time to minify CSS.
  colord: ">=2.9.4"
  # GHSA-vc2v-76pw-4v95 (CVE-2026-87776): compression <1.8.2 leaks
  # memory when a response closes early, a DoS, fixed in 1.8.2.
  # Transitive via @docusaurus/core > webpack-dev-server; only active
  # during `pnpm start`.
  compression: ">=1.8.2 <2"
  # follow-redirects <1.16.2 can carry credential headers across
  # redirects: GHSA-8r9p-f939-6h3c (CVE-2026-111755, sensitiveHeaders
  # regex escaping) and GHSA-q3jh-wrc6-jgq8 (CVE-2026-111756,
  # array-form headers bypassing cross-origin stripping), fixed in
  # 1.16.1, and GHSA-mrwp-f3q8-3g9p (CVE-2026-116689, cross-realm
  # sensitiveHeaders arrays discarded), fixed in 1.16.2. Transitive via
  # webpack-dev-server > http-proxy-middleware > http-proxy; only
  # active during `pnpm start`.
  follow-redirects: ">=1.16.2 <2"
  # GHSA-jqcg-44mw-7w3h (CVE-2026-90711): proxy-addr <2.0.8 can be
  # spoofed through an IPv4-mapped IPv6 trust subnet, fixed in 2.0.8.
  # Transitive via @docusaurus/core > webpack-dev-server > express;
  # only active during `pnpm start`.
  proxy-addr: ">=2.0.8 <3"
  # GHSA-68fv-2mgg-jv7q (CVE-2026-93749): source-map-js <1.2.2 can
  # stall the event loop through indexed source-map section offsets,
  # fixed in 1.2.2. Transitive via postcss, and via svgo > csso and
  # css-tree.
  source-map-js: ">=1.2.2 <2"
  # GHSA-g84c-rxfj-3j2c (CVE-2026-76844): webpack-dev-middleware path
  # traversal through a public path without a trailing slash, fixed in
  # 7.4.6 on the 7.x line. Transitive via @docusaurus/core >
  # webpack-dev-server; only active during `pnpm start`.
  webpack-dev-middleware: ">=7.4.6 <8"
  # GHSA-rj75-hqrm-r3gf (CVE-2026-104844): postcss-selector-parser
  # parses flat selectors in quadratic time, a CPU-exhaustion DoS,
  # fixed in 6.1.5 and 7.1.6. Both lines resolve in the tree: the
  # cssnano 6 plugins declare ^6.0.x and the newer postcss plugins
  # declare ^7.0.0.
  "postcss-selector-parser@6": ">=6.1.5 <7"
  "postcss-selector-parser@7": ">=7.1.6 <8"
  # tinypool <2.1.2 lets prototype pollution in worker or run() options
  # reach code execution: GHSA-5gmw-xhrv-c9v3 (CVE-2026-104848, fixed
  # in 2.1.1) and GHSA-85c8-ppgw-ccpr (CVE-2026-104849, fixed in
  # 2.1.2). No 1.x release carries the fix, so this lifts
  # @docusaurus/core past its ^1.0.2 range; 2.0 only dropped Node 18,
  # and Docusaurus loads it through import() for its SSG worker pool.
  tinypool: ">=2.1.2 <3"

# pnpm 11 replaces `onlyBuiltDependencies` with an explicit allow-map.
# Each entry permits the named package's install scripts to run;
# everything else is blocked by default.
allowBuilds:
  "@swc/core": true
  core-js: true
  sharp: true