mirror of
https://github.com/warmbly/warmbly.git
synced 2026-09-06 00:01:24 +00:00
21 lines
931 B
YAML
21 lines
931 B
YAML
# pnpm 11+ settings live here, not in package.json.
|
|
# Allow native build scripts that ship with these packages so
|
|
# `pnpm install` and `pnpm dev` work without manual approval.
|
|
allowBuilds:
|
|
esbuild: true
|
|
sharp: true
|
|
|
|
# Clear CVE-2026-59869 (DoS via crafted YAML) and GHSA-5p4m-2wfm-xmqj
|
|
# (quadratic CPU use resolving !!omap) in the transitive js-yaml.
|
|
overrides:
|
|
js-yaml: ^4.3.1
|
|
# Clear GHSA-2p49-hgcm-8545 (SVGO removeScripts can leave some scripts) in the
|
|
# transitive svgo used for build-time SVG optimization.
|
|
svgo: ^4.0.2
|
|
# NOTE: sharp is intentionally NOT bumped here. Its 0.35 line clears the
|
|
# libvips CVEs but breaks the marketing site's Cloudflare Pages build, so site
|
|
# stays on 0.34.5 and that one HIGH is suppressed in .trivyignore (build-time
|
|
# image optimization of our own assets, no untrusted input).
|
|
# Clear CVE-2026-67213 (DoS via infinite loop) in the transitive nanoid.
|
|
nanoid: ^3.3.17
|