# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1

packages:
  - apps/*
allowBuilds:
  # The ESLint resolver ships a small native lookup helper used during linting.
  # Its package-local install script is the only dependency build approved here.
  unrs-resolver: true
overrides:
  # Development tooling resolves an exact 5.0.9 through minimatch, which has
  # published denial-of-service advisories fixed by 5.0.12. Remove this once
  # minimatch depends on a fixed release itself.
  "brace-expansion@>=5.0.0 <5.0.12": 5.0.12
  # eslint-plugin-react-hooks resolves zod 4.4.3, which can exhaust memory while
  # validating oversized constrained collections (fixed in 4.6.6). The plugin
  # accepts any zod 4; remove this once it resolves a fixed release itself.
  "zod@<4.6.6": 4.6.7
  # c8 reaches glob 13 and minimatch 10 through test-exclude 8, the latest
  # release. glob before 14.0.2 keeps walking the file system after its
  # AbortSignal fired, and minimatch before 11.0.1 can be made to expand a
  # pattern without bound. test-exclude uses only their stable glob and match
  # calls, which the fixed majors keep. Remove these once test-exclude
  # depends on fixed releases itself.
  "glob@>=9.0.0 <14.0.2": 14.0.4
  "minimatch@>=7.0.0 <11.0.1": 11.0.5
auditConfig:
  ignoreGhsas:
    # braces <= 3.0.3: stack exhaustion on deeply nested brace patterns. No
    # fixed release exists (3.0.3 is the latest). The package is reached only
    # through the lint toolchain (eslint-config-next > @next/eslint-plugin-next
    # > fast-glob > micromatch), is not part of the built or deployed
    # application, and only ever receives the glob patterns of this
    # repository. Remove this entry as soon as braces or the Next.js lint
    # plugin publishes a release without the advisory.
    - GHSA-vfj7-8cjw-p6xm