packages:
  - "packages/*"

allowBuilds:
  unrs-resolver: true

# Refuse to install a registry version published less than three days ago.
# Compromised releases — the npm token-stealing worms of 2025 — are almost
# always yanked within hours, so the wait is what keeps one out of the
# lockfile. Dependabot's `cooldown` holds its PRs for the same window, so the
# two do not fight. Raise it, never lower it, and prefer excluding a single
# package over turning it off.
minimumReleaseAge: 4320

# Floors for transitive dependencies with a published advisory, where the
# package that pulls them in has not yet moved its own range. Most arrive
# through dev tooling — eslint, eslint-config-next, shadcn; source-map-js also
# comes in under next, through postcss. Each selector names only the
# vulnerable range and stays inside its major, so an entry stops applying once
# the tree moves past it and can then be deleted.
#
# braces has an advisory with no fixed release (GHSA-vfj7-8cjw-p6xm), so there
# is nothing to floor it to. It reaches the tree only through eslint-config-next
# and shadcn, both dev-only.
overrides:
  "brace-expansion@<1.1.21": "^1.1.21"
  "brace-expansion@>=4.0.0 <5.0.12": "^5.0.12"
  "fast-uri@>=3.0.0 <3.1.8": "^3.1.8"
  "ip-address@>=10.0.0 <10.7.1": "^10.7.1"
  "proxy-addr@>=1.1.0 <2.0.8": "^2.0.8"
  "source-map-js@>=1.0.0 <1.2.2": "^1.2.2"