pnpm-workspace.yaml

packages:
  - "packages/*"
  - "examples/*"
  - "apps/*"

onlyBuiltDependencies:
  - esbuild
  - sharp

confirmModulesPurge: false

allowBuilds:
  esbuild: true
  sharp: true

overrides:
  # Security pins for transitive deps with HIGH advisories. Each is a patch or
  # in-range minor — no major bumps here. Re-check with
  # `pnpm audit --prod --audit-level high` and RAISE these when a pin goes stale
  # (postcss 8.5.16 was itself pinned for an earlier advisory and later became
  # the vulnerable version).
  #
  # postcss <=8.5.17: path traversal via sourceMappingURL (GHSA-r28c-9q8g-f849)
  postcss: "^8.5.18"
  # fast-uri <3.1.5: host confusion via backslash authority (GHSA-7p8r-x3mc-p8w7)
  fast-uri: "^3.1.5"
  # find-my-way <9.7.0 — in fastify's own supported range
  find-my-way: "^9.7.0"
  # next <15.5.21 and its sharp dep (examples/chatbot only)
  next: "^15.5.21"
  sharp: "^0.35.0"
  # esbuild <0.28.1 dev-server arbitrary file read (GHSA-g7r4-m6w7-qqqr); only
  # tsup pulled the vulnerable 0.27.7, tsx already uses 0.28.1 — dedupe onto it.
  "tsup>esbuild": "^0.28.1"


# Advisories deliberately accepted. An entry is only acceptable when the
# vulnerable code path is PROVABLY UNREACHABLE here — never merely inconvenient
# to fix. Each one is also tabulated in SECURITY.md -> Accepted advisories.
#
# NB: the key is ignoreGhsas (ignoreCves takes CVE-* ids and silently does
# nothing for a GHSA id).
auditConfig:
  ignoreGhsas:
    # react-router RSC-mode CSRF, reached via react-router-dom in the operator
    # console. The advisory states it "only affects your application if you are
    # using the unstable RSC APIs"; the console is a static Vite SPA served by
    # nginx whose only router import is react-router-dom — no RSC, no server
    # runtime, no router actions. The fix is react-router 8.x, a major bump
    # under our react-router-dom ^7. Revisit when the console upgrades.
    - GHSA-qwww-vcr4-c8h2