packages:
  - "apps/*"
  - "packages/*"
  # Standalone zero-dependency sub-project (Qloo hackathon entry): tracked in
  # git with its own test suite, so `pnpm -r test` runs it like any package.
  - "taste-router"
allowBuilds:
  better-sqlite3: true
  # wrangler (taste-router devDependency) needs these to install its binaries.
  esbuild: true
  workerd: true
overrides:
  # brace-expansion is pinned here because minimatch@10 resolves brace-expansion@^5 and the
  # lockfile has to stay deterministic. The pin has to MOVE when the pinned line carries a known
  # advisory: 5.0.9 is affected by GHSA-6j4f-fj2g-mc7p (stack exhaustion, fixed 5.0.10),
  # GHSA-qhr7-859c-m2p7 (nested-brace recursion, fixed 5.0.11) and GHSA-q2hr-2g5m-vwhr (quadratic
  # rewrite, fixed 5.0.12) -- all three read as BLOCKED in the dependency-security job. 5.0.12 is the
  # newest published version and clears all three. The 2.x line is bumped the same way (2.1.4 is
  # affected by the 2.x range of the first two, fixed 2.1.5/2.1.6) even though nothing currently
  # resolves to it, so a future dependent cannot land on the affected range.
  brace-expansion@2: 2.1.7
  brace-expansion@5: 5.0.12
  postcss@8: 8.5.26
  undici@7: 7.30.1
  vite@8: 8.3.3
  "@xmldom/xmldom@0.8": 0.8.15
  # hono moved 4.13.5 -> 4.13.7 when GHSA-hxh3-vqpv-xpqv (jsx renders plain strings unescaped in
  # boundary components, XSS) was published on 2026-09-30, and again 4.13.7 -> 4.13.13 on 2026-10-21
  # when GHSA-5r4p-p66f-jhc7 (serveStatic decodes the request path a second time, path traversal)
  # was published with the fix landing in 4.13.11. 4.13.13 shipped 2026-10-04, so it clears the
  # advisory while staying older than pnpm's minimum-release-age gate wants.
  hono@4: 4.13.13
  # source-map-js 1.2.1 is affected by GHSA-68fv-2mgg-jv7q (event-loop DoS via indexed section offsets); 1.2.2 is the fix.
  source-map-js@1: 1.2.2
  # sprintf-js has no fixed release for GHSA-hp3w-g68c-fv3c; it only arrives via mammoth -> argparse@1.0.10, which mammoth
  # uses solely in its CLI (lib/main.js), never from the library entry we import. argparse 2.x drops sprintf-js entirely.
  argparse@1: 2.0.1
  # @hono/node-server 1.19.10..<2.1.3 is affected by GHSA-rmxm-3fg6-px4f (serveStatic decodes the
  # request path a second time, bypassing middleware on static paths); 2.1.3 is the fix.
  # @modelcontextprotocol/node@2.1.2 declares "^1.19.9 || ^2.1.3", so 2.x is inside the declared
  # compatibility and this pin does not force a version the parent does not support.
  "@hono/node-server": 2.1.5
  # glob 13.0.6 and minimatch 10.2.6 (both resolved only via the c8 -> test-exclude coverage
  # toolchain) are affected by GHSA-3g3m-2fjr-6pw4 (an aborted async walk keeps reading the
  # filesystem after the caller was rejected; introduced 9.0.0, fixed 14.0.2, no fixed 13.x
  # release) and GHSA-g3hv-75wg-m249 (attacker-controlled pattern amplification in
  # firstPhasePreProcess followed by quadratic pairwise processing; introduced 7.0.0, fixed
  # 11.0.1, no fixed 10.x release). Both advisories were published after master's last green
  # dependency scan (2026-10-29), which turned the gate red on 2026-11-05. The fixes are major
  # jumps, but the only consumer is coverage tooling, so product runtime behavior is untouched.
  glob@13: 14.0.2
  minimatch@10: 11.0.1