# pnpm 11+ moved settings out of package.json. This is its new home.
# Trust the install-time build scripts of these packages so pnpm doesn't
# refuse to run them. esbuild is pulled in transitively by vite/vitest
# and needs to compile its native binary at install time.
allowBuilds:
  esbuild: true

# Overrides used to live under `pnpm.overrides` in package.json but
# pnpm 11 ignores that block, which broke the web container's install
# (rolldown-vite was being requested as plain `vite@7.1.14`, which doesn't
# exist on the registry).
overrides:
  picomatch: ^4.0.4
  # Clear CVE-2026-59887 (quadratic-complexity ReDoS via `mailto:`) in the
  # transitive linkify-it.
  linkify-it: ^5.0.2
  # Clear GHSA-5p4m-2wfm-xmqj (quadratic CPU use resolving !!omap) in js-yaml.
  js-yaml: ^4.3.1
  # Clear CVE-2026-67213 (DoS via infinite loop) in the transitive nanoid.
  nanoid: ^3.3.17