# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1

packages:
  - apps/*
allowBuilds:
  # The ESLint resolver ships a small native lookup helper used during linting.
  # Its package-local install script is the only dependency build approved here.
  unrs-resolver: true
overrides:
  # Development tooling resolves an exact 5.0.9 through minimatch, which has
  # published denial-of-service advisories fixed by 5.0.12. Remove this once
  # minimatch depends on a fixed release itself.
  "brace-expansion@>=5.0.0 <5.0.12": 5.0.12
auditConfig:
  ignoreGhsas:
    # braces <= 3.0.3: stack exhaustion on deeply nested brace patterns. No
    # fixed release exists (3.0.3 is the latest). The package is reached only
    # through the lint toolchain (eslint-config-next > @next/eslint-plugin-next
    # > fast-glob > micromatch), is not part of the built or deployed
    # application, and only ever receives the glob patterns of this
    # repository. Remove this entry as soon as braces or the Next.js lint
    # plugin publishes a release without the advisory.
    - GHSA-vfj7-8cjw-p6xm