# pnpm 11+ moved settings out of package.json. Mirrors web/pnpm-workspace.yaml.
#
# Trust the install-time build scripts of these packages so pnpm doesn't
# refuse to run them. esbuild is pulled in transitively by vite and
# needs to compile its native binary at install time.
allowBuilds:
  esbuild: true

# Match the dashboard's overrides so transitive deps don't drift.
overrides:
  picomatch: ^4.0.4
  # Clear CVE-2026-59869 (DoS via crafted YAML) and GHSA-5p4m-2wfm-xmqj
  # (quadratic CPU use resolving !!omap) in the transitive js-yaml.
  js-yaml: ^4.3.1
  # Clear CVE-2026-67213 (DoS via infinite loop) in the transitive nanoid.
  nanoid: ^3.3.17