blob: 74a255c9a6d5c13ed3d29040ec303134b0310254 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
|
# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
packages:
- apps/*
allowBuilds:
# The ESLint resolver ships a small native lookup helper used during linting.
# Its package-local install script is the only dependency build approved here.
unrs-resolver: true
overrides:
# Development tooling resolves an exact 5.0.9 through minimatch, which has
# published denial-of-service advisories fixed by 5.0.12. Remove this once
# minimatch depends on a fixed release itself.
"brace-expansion@>=5.0.0 <5.0.12": 5.0.12
# eslint-plugin-react-hooks resolves zod 4.4.3, which can exhaust memory while
# validating oversized constrained collections (fixed in 4.6.6). The plugin
# accepts any zod 4; remove this once it resolves a fixed release itself.
"zod@<4.6.6": 4.6.7
# c8 reaches glob 13 and minimatch 10 through test-exclude 8, the latest
# release. glob before 14.0.2 keeps walking the file system after its
# AbortSignal fired, and minimatch before 11.0.1 can be made to expand a
# pattern without bound. test-exclude uses only their stable glob and match
# calls, which the fixed majors keep. Remove these once test-exclude
# depends on fixed releases itself.
"glob@>=9.0.0 <14.0.2": 14.0.4
"minimatch@>=7.0.0 <11.0.1": 11.0.5
auditConfig:
ignoreGhsas:
# braces <= 3.0.3: stack exhaustion on deeply nested brace patterns. No
# fixed release exists (3.0.3 is the latest). The package is reached only
# through the lint toolchain (eslint-config-next > @next/eslint-plugin-next
# > fast-glob > micromatch), is not part of the built or deployed
# application, and only ever receives the glob patterns of this
# repository. Remove this entry as soon as braces or the Next.js lint
# plugin publishes a release without the advisory.
- GHSA-vfj7-8cjw-p6xm
|