packages:
  - "apps/web"
  - "apps/tracker"
  - "apps/marketing"
  - "packages/*"
# Force patched versions of transitive dependencies flagged by high-severity
# advisories (DoS via quadratic/exponential parsing). All are same-major pins,
# so no API change: brace-expansion 1.1.20 (GHSA-3jxr-9vmj-r5cp,
# GHSA-rgw5-rvv9-x895, GHSA-qhr7-859c-m2p7 and GHSA-6j4f-fj2g-mc7p), js-yaml 3.15.2 for gray-matter and js-yaml 4.3.2 for
# eslint tooling (GHSA-52cp-r559-cp3m, then GHSA-2883-xcg3-v3hh).
overrides:
  # 1.1.18, not 1.1.16. GHSA-rgw5-rvv9-x895 (published after this block was
  # first written) is vulnerable below 1.1.18 and, unlike the advisory noted
  # under brace-expansion@5 below, it DOES have a 1.x backport. Staying on
  # 1.1.16 reddens the audit on every branch with no code change, which is how
  # this bump was found.
  brace-expansion@1: 1.1.20
  # brace-expansion 5.x <=5.0.7 is a DoS via unbounded expansion length
  # (GHSA-mh99-v99m-4gvg), patched in 5.0.8, and GHSA-qhr7-859c-m2p7 and GHSA-6j4f-fj2g-mc7p, patched in 5.0.11 and 5.0.10, so the pin is 5.0.11. The advisory collapses every major
  # into one range, so 1.1.16 is nominally flagged too, but there is no 1.x
  # backport and forcing 5.x onto the 1.x consumers breaks eslint at runtime
  # (@eslint/config-array pathMatches). The 1.x chain is eslint only, which never
  # ships in any deployed artifact, so it is pinned to the newest 1.x instead.
  brace-expansion@5: 5.0.11
  # Raised 3.15.1 -> 3.15.2 and 4.3.1 -> 4.3.2 for GHSA-2883-xcg3-v3hh, a CPU
  # exhaustion where `maxTotalMergeKeys` does not bound the work done for empty
  # merge sources. The 3.x chain is gray-matter, which parses the frontmatter of
  # every committed .mdx file at build time; the 4.x chain is eslint tooling.
  # Both are patch releases on their own major, so no API change.
  js-yaml@3: 3.15.2
  js-yaml@4: 4.3.2
  # sharp <0.35.0 bundles a vulnerable libvips (GHSA-f88m-g3jw-g9cj). Patched in
  # 0.35.0+; Next pulls it as an optional dep for image optimization and its
  # transform API is unchanged across this bump. Verified the marketing build.
  #
  # Raised 0.35.3 -> 0.35.4 for GHSA-rgj7-g3m4-5g8c, which covers two libheif
  # vulnerabilities bundled below 0.35.4 (GHSA-g89c-p67h-r497 and
  # GHSA-2jg2-4ch7-h545). Patch release on the same minor, so no API change.
  #
  # Raised 0.35.4 -> 0.35.5 for GHSA-wq5f-xc86-pv6w, a vulnerability in the
  # librsvg that sharp bundles below 0.35.5. Patch release on the same minor.
  sharp: 0.35.5
  # postcss path/source-map advisories (GHSA-6g55-p6wh-862q file read, then
  # GHSA-r28c-9q8g-f849 path traversal in a previous source map, fixed in
  # 8.5.18). Next pulls postcss transitively; these are same-major bug fixes, so
  # no API change. Verified the marketing build.
  #
  # Raised 8.5.18 -> 8.5.26 because THIS PIN was what held nanoid back. postcss
  # 8.5.18 depends on an older nanoid range that resolves to 3.3.12, which two
  # high-severity advisories cover (GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8);
  # 8.5.26 declares nanoid ^3.3.17 and so pulls a patched one on its own. Fixing
  # the pin that caused it beats adding a second override to paper over it, and
  # it is why no `nanoid:` entry appears in this file. Both advisories published
  # after the pin was written, so this reddened main with no code change at all.
  postcss: 8.5.26
  # source-map-js from 1.0.0 up to 1.2.1 is an event-loop denial of service
  # through indexed source-map section offsets (GHSA-68fv-2mgg-jv7q), patched in
  # 1.2.2. postcss declares ^1.2.1, so the pin stays inside its range; the other
  # consumers are build tooling. Patch release on the same minor.
  source-map-js: 1.2.2
  # seroval from 0.12.0 up to 1.6.0 is critical (GHSA-p6vx-979v-rg4c, promise
  # handling in fromJSON) and up to 1.6.2 is high (GHSA-jp82-f5mq-hwhp, an
  # unchecked TypedArray length); both are fixed from 1.6.3. TanStack Router's
  # router-core declares ^1.5.4 for seroval and for seroval-plugins, so 1.6.8 is
  # inside its range, and its newest release already requires ^1.6.7.
  # seroval-plugins takes seroval as a peer and the two are published together,
  # so they move together.
  seroval: 1.6.8
  seroval-plugins: 1.6.8
  # DOMPurify up to 3.4.16: a SAFE_FOR_TEMPLATES bypass in shadow-root content
  # (GHSA-cg2g-xh64-v4q7, critical) and IN_PLACE hooks leaving detached
  # handlers armed (GHSA-mrv2-3pqr-j5jr, high), both fixed in 3.4.17. The web app
  # declares ^3.4.17 itself; this pin carries posthog-js's copy (it declares
  # ^3.4.12, so 3.4.17 is inside its range).
  dompurify: 3.4.17
  # One copy of each Radix overlay internal (dismissable layer, focus scope,
  # focus guards, portal). Each copy keeps its own record of the page's pointer
  # events and focus traps, so a dialog opened from a menu built on another copy
  # leaves the page unresponsive after it closes. The command palette's cmdk
  # declares @radix-ui/react-dialog ^1.1.6; this keeps it on the dialog the
  # dashboard itself uses.
  cmdk>@radix-ui/react-dialog: ^1.3.1
# Documented audit exceptions. Every entry must state WHY the advisory cannot be
# fixed by pinning and WHAT would let us drop the exception, so this list stays
# short and reviewable rather than becoming a place to silence real findings.
auditConfig:
  ignoreGhsas:
    # brace-expansion DoS via unbounded expansion length. Reached ONLY through
    # eslint (eslint > minimatch@3 > brace-expansion@1), which is developer and
    # CI tooling: it is absent from the Go binary, the built web bundle, and the
    # marketing standalone output, so it is not a production attack surface.
    # The advisory collapses every major into a single "<=5.0.7" range whose only
    # patched release is 5.0.8, and there is no 1.x backport to pin to. Forcing
    # 5.0.8 onto the 1.x consumers was tested and breaks eslint at runtime
    # (@eslint/config-array pathMatches). The 5.x line IS pinned to 5.0.11 above.
    # DROP THIS when the monorepo moves to eslint 10, which no longer pulls the
    # minimatch@3 chain.
    - GHSA-mh99-v99m-4gvg
allowBuilds:
  # Pulled in by posthog-js (marketing analytics). Its postinstall script only
  # prints a funding message; core-js needs no build step to work as a runtime
  # dependency. pnpm 11 writes a "set this to true or false" placeholder here on
  # first install, which is not a valid value and fails every subsequent
  # `pnpm install`, so this must be answered rather than left.
  core-js: false
  esbuild: true
  # Puppeteer's postinstall downloads ~100 MB of Chromium. Disabled because
  # nothing in our pipeline launches a headless browser; impeccable's critique
  # uses static analysis, not screenshots. Flip to `true` if a future phase
  # needs a real browser (live preview iteration, visual diffs, etc.).
  puppeteer: false
  sharp: true
  vue-demi: false