pnpm-workspace.yaml

# pnpm v11 reads settings from this file rather than package.json's "pnpm"
# section. We don't actually use pnpm workspaces — this file exists so
# pnpm picks up project-wide settings (overrides, allowBuilds).

# Allow @parcel/watcher's install script to run; it downloads a prebuilt
# native binary used by sass/vitest for file watching. Without this entry,
# pnpm fails the install on fresh machines (strictDepBuilds default).
allowBuilds:
  '@parcel/watcher': true

# Pin transitive dependency versions across the entire dep tree. These
# eliminate older / vulnerable copies that ship as transitive deps of
# webpack, eslint, etc.
overrides:
  ajv: 8.20.0
  minimatch: 10.2.5
  serialize-javascript: 7.0.6
  lodash: 4.18.1
  follow-redirects: 1.16.0
  flatted: 3.4.2
  brace-expansion: 5.0.6
  path-to-regexp: 0.1.13
  yaml: 2.9.0
  uuid: 14.0.0
  picomatch@<4: 2.3.2
  picomatch@>=4: 4.0.4
  fork-ts-checker-webpack-plugin>schema-utils: 4.3.3
  # GHSA-q8mj-m7cp-5q26
  qs@<6.15.2: 6.15.2
  # GHSA-58qx-3vcg-4xpx
  ws@>=8.0.0 <8.20.1: 8.21.0
  # GHSA-w7jw-789q-3m8p (shell-quote newline escaping, via launch-editor)
  shell-quote@<1.8.4: 1.8.4
  # GHSA-v6wh-96g9-6wx3 (launch-editor NTLMv2 hash disclosure, via webpack-dev-server)
  launch-editor@<2.14.1: 2.14.1
  # GHSA-fx2h-pf6j-xcff (vite server.fs.deny bypass, via vitest)
  vite@>=8.0.0 <8.0.16: 8.0.16
  # GHSA-ph9p-34f9-6g65 (tmp path traversal, via patch-package)
  tmp@<0.2.6: 0.2.7
  # GHSA-h67p-54hq-rp68 (js-yaml quadratic-complexity DoS, via cosmiconfig)
  js-yaml@>=4.0.0 <4.2.0: 4.2.0
  # GHSA-vmh5-mc38-953g / GHSA-hm92-r4w5-c3mj (+4) (undici Set-Cookie / cache / SOCKS5 issues, via jsdom)
  undici@<7.28.0: 7.28.0
  # GHSA-64mm-vxmg-q3vj (http-proxy-middleware host+path routing bypass, via webpack-dev-server)
  http-proxy-middleware@<3.0.6: 3.0.6