95 lines
3.5 KiB
YAML
95 lines
3.5 KiB
YAML
packages:
|
|
- "."
|
|
- "apps/*"
|
|
- "packages/*"
|
|
- "runtime/*"
|
|
|
|
# pnpm 11 delays brand-new releases by default. DOMPurify 3.4.12 is an
|
|
# intentionally reviewed security override, so exempt only that exact release.
|
|
minimumReleaseAge: 1440
|
|
minimumReleaseAgeExclude:
|
|
- "dompurify@3.4.12"
|
|
|
|
# GHSA-qwww-vcr4-c8h2 affects only React Router's unstable RSC APIs. HiveGrid
|
|
# uses the classic framework runtime and does not enable or ship the RSC
|
|
# plugin/runtime. Keep the exception advisory-specific until the planned v8
|
|
# platform upgrade can adopt the patched major without bypassing peer guards.
|
|
auditConfig:
|
|
ignoreGhsas:
|
|
- "GHSA-qwww-vcr4-c8h2"
|
|
|
|
# pnpm 11 fails closed on unreviewed dependency build scripts. Keep approvals
|
|
# version-specific so an upgraded package must be reviewed again before install.
|
|
allowBuilds:
|
|
"@prisma/client@7.8.0": true
|
|
"@prisma/engines@7.8.0": true
|
|
"@sentry/cli@2.58.5": false
|
|
"@swc/core@1.15.33": false
|
|
"argon2@0.44.0": true
|
|
"better-sqlite3@12.9.0": true
|
|
"core-js": false
|
|
"cpu-features@0.0.10": false
|
|
"cypress": false
|
|
"esbuild@0.28.1": true
|
|
"lefthook@1.13.6": false
|
|
"msgpackr-extract@3.0.3": false
|
|
"prisma@7.8.0": true
|
|
"protobufjs@7.6.5": false
|
|
"sharp@0.35.2": true
|
|
"ssh2@1.17.0": false
|
|
|
|
overrides:
|
|
"@babel/core": "7.29.6"
|
|
"@grpc/grpc-js": "1.14.4"
|
|
"@hono/node-server": "2.0.11"
|
|
"@opentelemetry/core": "2.9.0"
|
|
# The archived Remix config adapter is covered by the React Router 7 route
|
|
# manifest tests, but its published peer range still names an old nightly.
|
|
"@react-router/remix-config-routes-adapter@0.0.0-nightly-bf7ecb711-20240911>@react-router/dev": "7.18.1"
|
|
"minimatch@3.1.5>brace-expansion": "1.1.16"
|
|
"minimatch@5.1.9>brace-expansion": "2.1.2"
|
|
"minimatch@9.0.9>brace-expansion": "2.1.2"
|
|
"minimatch@10.2.5>brace-expansion": "5.0.8"
|
|
# GHSA-mh99-v99m-4gvg has no 1.x/2.x backports. Keep ExcelJS on its proven
|
|
# Archiver stream contract while replacing only the legacy glob tree.
|
|
"exceljs@4.4.0>archiver": "5.3.2"
|
|
"archiver@5.3.2>readdir-glob": "3.0.0"
|
|
"archiver-utils@2.1.0>glob": "13.0.6"
|
|
"archiver-utils@3.0.4>glob": "13.0.6"
|
|
"body-parser": "2.3.0"
|
|
"classnames": "2.5.1"
|
|
"crypto-js": "4.2.0"
|
|
"dompurify": "3.4.12"
|
|
"esbuild": "0.28.1"
|
|
# ExcelJS accepts the same unzipper API. The maintained release removes the
|
|
# legacy binary/fstream/buffers chain and its undeclared license.
|
|
"exceljs@4.4.0>unzipper": "0.12.5"
|
|
# GHSA-4c8g-83qw-93j6 (high): fast-uri < 3.1.3 mis-canonicalises failed IDN
|
|
# hosts, so a URI can be read as pointing at a different host. It reaches us
|
|
# only transitively (ajv, and Prisma's own ajv copy). Staying on 3.x keeps
|
|
# ajv's expected API; 4.x is a separate upgrade.
|
|
"fast-uri": "3.1.4"
|
|
"js-yaml": "4.3.0"
|
|
# BullMQ pins an older ioredis release. Keep every runtime on the reviewed
|
|
# WHATWG URL parser fix instead of shipping a second deprecated copy.
|
|
"ioredis": "5.11.1"
|
|
"linkify-it": "5.0.2"
|
|
"markdown-it": "14.3.0"
|
|
"morgan": "1.11.0"
|
|
# GHSA-r28c-9q8g-f849: prevent previous-source-map path traversal in every
|
|
# direct and transitive PostCSS consumer.
|
|
"postcss": "8.5.22"
|
|
"protobufjs": "7.6.5"
|
|
"qs": "6.15.3"
|
|
"tmp": "0.2.7"
|
|
"uuid": "11.1.1"
|
|
# GHSA-5qjj-4xww-7phc: inherited Object-property names can crash
|
|
# Valibot's flattened validation-error path. Prisma and React Router both
|
|
# accept the patched 1.x API, so keep every transitive copy on the fix.
|
|
"valibot": "1.4.2"
|
|
"vitest": "3.2.7"
|
|
"ws": "8.21.0"
|
|
|
|
patchedDependencies:
|
|
"@react-router/dev@7.18.1": "patches/@react-router__dev@7.18.1.patch"
|