# The xlsx override below points the graph at the SheetJS CDN tarball, because
# the npm registry version is stale (0.18.5) and carries known vulnerabilities.
# Only this package depends on xlsx now, so pnpm's default protection against
# URL tarballs in subdependencies can stay enabled.

overrides:
  '@vueuse/shared': 13.9.0
  # Native-only transitives of webcrack / @huggingface/transformers.
  # The browser app aliases both to an empty module in vite.config.ts,
  # so stub them out entirely (saves ~225 MB of node_modules).
  isolated-vm: file:./stubs/empty-stub
  onnxruntime-node: file:./stubs/empty-stub
  elliptic: ^6.6.1
  # @boxyhq/saml20 pins 0.9.10 exactly, which upstream deprecated for "critical
  # issues"; 0.9.11 is the patched release of that same line.
  '@xmldom/xmldom@0.9.10': 0.9.11
  # @it-tools/bip39 pins ^0.9.0, whose Node fallback uses eval("require('crypto')")
  # and triggers rolldown EVAL build warnings; 0.11.x dropped the eval.
  js-sha256: ^0.11.1
  xlsx: https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz

patchedDependencies:
  node-forge@1.4.0: patches/node-forge@1.4.0.patch
  esm-potrace-wasm: patches/esm-potrace-wasm.patch
  run-pace: patches/run-pace.patch
  curlconverter@4.12.0: patches/curlconverter@4.12.0.patch

# pnpm 11 requires an explicit decision for every dependency build script.
# true  = script is needed (native binaries / functional postinstall)
# false = script is cosmetic (funding banners) or the build is unneeded
allowBuilds:
  '@scarf/scarf': false
  core-js: false
  es5-ext: false
  esbuild: true
  exifreader: false
  json-editor-vue: false
  msgpackr-extract: true
  protobufjs: false
  sharp: false
  tesseract.js: false
  # Native Node bindings for curlconverter's shell parser. The app only uses
  # curlconverter in the browser, where its `browser` field swaps in
  # web-tree-sitter (WASM), so the addon is never loaded. There is no
  # linux-arm64 prebuild, and compiling it fails against Node 24's C++20 headers.
  tree-sitter: false
  tree-sitter-bash: false
  vue-demi: true

minimumReleaseAgeExclude:
  - phin@3.7.1
  - elliptic@6.6.2
  - file-type@21.3.1
  - unhead@2.1.11 || 2.1.13
  - dompurify@3.3.2 || 3.3.4 || 3.4.0 || 3.4.6 || 3.4.7 || 3.4.8 || 3.4.9 || 3.4.11
  - protocol-buffers-schema@3.6.1
  - '@xmldom/xmldom@0.8.14 || 0.9.11'
  - mathjs@15.2.0
  - protobufjs@7.5.5 || 7.5.6 || 7.5.8 || 7.6.1 || 7.6.3
  - underscore@1.13.8
  - ip-address@10.1.1
  - uuid@11.1.1
  - '@iplookup/country-extra@1.0.20260711'
  - nanoid@6.0.0