mirror of
https://github.com/warmbly/warmbly.git
synced 2026-09-06 00:01:24 +00:00
22 lines
842 B
YAML
22 lines
842 B
YAML
# pnpm 11+ settings live here, not in package.json.
|
|
# Trust the install-time native build scripts so `pnpm install` + `next build`
|
|
# work without manual approval (adding this file activates pnpm's build gate).
|
|
allowBuilds:
|
|
esbuild: true
|
|
sharp: true
|
|
unrs-resolver: true
|
|
|
|
overrides:
|
|
picomatch: ^4.0.4
|
|
path-to-regexp: ^8.4.0
|
|
# Clear CVE-2026-59869 (DoS via crafted YAML) and GHSA-5p4m-2wfm-xmqj
|
|
# (quadratic CPU use resolving !!omap) in the transitive js-yaml.
|
|
js-yaml: ^4.3.1
|
|
# Clear the libvips CVEs inherited by sharp (fixed in 0.35.0).
|
|
sharp: ^0.35.0
|
|
# next pins postcss to an exact 8.4.31, which carries the sourceMappingURL
|
|
# file-read / path-traversal advisories (CVE-2026-45623, GHSA-r28c-9q8g-f849).
|
|
postcss: ^8.5.23
|
|
# Clear CVE-2026-67213 (DoS via infinite loop) in the transitive nanoid.
|
|
nanoid: ^3.3.17
|