allowBuilds:
  esbuild: true

# The 24h minimumReleaseAge guard (pnpm 11's default) stays on for everything else — it is what
# catches a freshly-published compromised release before it reaches the image. jsdom is an
# explicit, owner-approved exception: it is a test-only DOM implementation for vitest, never
# installed into the runtime image (the Dockerfile ships web/dist, not node_modules), so a bad
# release could at worst break CI rather than reach a user. Remove this once jsdom 30 is not the
# newest release and the exception stops mattering.
minimumReleaseAgeExclude:
  - jsdom

overrides:
  # CVE-2026-59870 / GHSA-52cp-r559-cp3m: js-yaml burns quadratic CPU resolving `!!omap`, and the
  # earlier merge-key variant of the same bug. Reached only via openapi-typescript ->
  # @redocly/openapi-core, which pins js-yaml to an exact 4.2.0 and has no fixed release on that
  # line. Build-time only (`pnpm gen:api`), so the runtime image never ships it — the Dockerfile
  # copies web/dist, not node_modules.
  #
  # Bumped 4.3.0 -> 4.3.1 (2026-08-12): the first fix landed in 4.3.0, but the `!!omap` case was
  # NOT backported to it, so the pin that closed the original advisory was itself vulnerable. Any
  # future bound here needs the same check — "we already have an override" is not the same as "the
  # version it forces is fixed". Drop the whole block once openapi-typescript ships a
  # @redocly/openapi-core that no longer pins a vulnerable js-yaml.
  #
  # Bumped 4.3.1 -> 4.3.2 (2026-09-13): GHSA-2883-xcg3-v3hh, `maxTotalMergeKeys` does not limit CPU
  # for empty merge sources; fixed in 4.3.2 only.
  js-yaml@>=4.0.0 <4.3.2: 4.3.2
  # GHSA-mh99-v99m-4gvg and GHSA-rgw5-rvv9-x895: brace-expansion expands unbounded patterns (DoS).
  # Same build-time-only path as js-yaml above (openapi-typescript -> @redocly/openapi-core ->
  # minimatch 5, which asks for ^2.0.1). 2.1.7 is the first release fixing all
  # three advisories on this line (2.1.4 fixed only the two above); eslint's minimatch 10 already
  # brings the unaffected 5.x line, which this range leaves alone.
  brace-expansion@>=2.0.0 <2.1.7: 2.1.7
  # GHSA (source-map-js >=1.0.0 <1.2.2): event-loop DoS on a crafted source map. Reached only through
  # the PostCSS/Vite build toolchain, never the runtime image (the Dockerfile ships web/dist, not
  # node_modules). 1.2.2 is a same-major patch, so nothing that depends on it changes shape.
  source-map-js@>=1.0.0 <1.2.2: 1.2.2
  # GHSA-rj75-hqrm-r3gf: quadratic selector parsing. Reached only via tailwindcss 3 (build time).
  postcss-selector-parser@<7.1.6: 7.1.6
  # GHSA-g3hv-75wg-m249: minimatch globParts amplification (DoS) when optimizationLevel >= 2. Reached
  # only via eslint and @typescript-eslint (lint time, never the runtime image). No 10.x fix exists, so
  # this forces the 11 line: 11.0 removed makeRe/regexp/AST/matchOne/debug, none of which eslint
  # 10, @eslint/config-array or typescript-estree call (they use Minimatch, .match and .set only).
  # @redocly/openapi-core's minimatch 5 is outside the advisory range and stays as it is.
  minimatch@>=7.0.0 <11.0.1: 11.0.5