overrides:
  # GHSA-55q2-fjhq-7xh7 — an IN_PLACE hook removal leaves a detached subtree
  # executable (XSS). Reaches the browser through posthog-js.
  dompurify: "^3.4.17"
  # GHSA-5p4m-2wfm-xmqj — quadratic CPU on !!omap resolution. Build-time only
  # (xmlbuilder2, under the Start plugin), so this is hygiene rather than an
  # exposed surface.
  js-yaml: "^4.3.2"

allowBuilds:
  # core-js (via posthog-js) postinstall only prints a funding banner — skip it.
  core-js: false
  esbuild: true
  msw: true
  sharp: true
  workerd: true