overrides:
  # CVE-2026-84375 (js-yaml < 4.3.2, HIGH), CVE-2026-84363/84364/84365 (hono
  # < 4.13.5, via @hono/node-server under the MCP SDK; GHSA-5r4p-p66f-jhc7 raised the
  # floor to 4.13.11), CVE-2026-45819
  # (baseline-browser-mapping < 2.11.0), GHSA-rgj7-g3m4-5g8c (sharp < 0.35.4,
  # pulled by next). None is a direct dependency; the bounds move the copies
  # the scanner flags and nothing else.
  "js-yaml@<4.3.2": "^4.3.2"
  "hono@<4.13.11": "^4.13.11"
  "baseline-browser-mapping@<2.11.0": "^2.11.0"
  "sharp@<0.35.4": "^0.35.4"
  # GHSA-55q2-fjhq-7xh7: a crafted document gets past the sanitiser and its
  # markup survives into the output. The copy here is jspdf's optional HTML
  # renderer, which the doctor-report PDF path reaches.
  # A later advisory against 3.4.13 to 3.4.15 raised the floor to 3.4.16, and
  # GHSA-cg2g-xh64-v4q7 (a SAFE_FOR_TEMPLATES bypass) with GHSA-mrv2-3pqr-j5jr
  # (an IN_PLACE hook that removes a parent) to 3.4.17. jspdf 4.2.1, the
  # newest release, still allows the flagged range.
  "dompurify@<3.4.17": "^3.4.17"
  # CVE-2026-69153. Next declares an exact `postcss@8.4.31`, so nothing except
  # this bound moves it. The build has run on the 8.5 line since the first
  # bump; the fix landed in 8.5.23.
  "postcss@<8.5.23": "^8.5.23"
  "nanoid@<3.3.18": "^3.3.18"
  # GHSA-frvp-7c67-39w9 raised the floor from 1.19.13 to 1.19.15. The
  # serveStatic double decode fixed in 2.1.3 has no fix on the 1.x line, so
  # the bound moves to 2.x, which the MCP SDK accepts (`^1.19.9 || ^2.0.5`).
  # The app never calls serveStatic; the copy sits on the MCP path all the
  # same. Mirrored for /opt/prisma-cli in the Dockerfile, where an older
  # @prisma/dev once pulled it in.
  "@hono/node-server@<2.1.3": "^2.1.3"
  "picomatch@<4.0.4": "^4.0.4"
  # CVE-2026-111181 (HIGH) raised the floor from 2.3.0. The copy arrives
  # under express in the MCP SDK, on a production path.
  "body-parser@<2.4.0": "^2.4.0"
  # CVE-2026-93749 (source-map-js < 1.2.2, HIGH, under postcss and the
  # Tailwind build), CVE-2026-104844 (postcss-selector-parser < 7.1.6, under
  # shadcn) and GHSA-r4xh-jqrq-34v2 (smol-toml < 1.9.0, under knip). All three
  # are quadratic-time parsers reached at build or dev time only.
  "source-map-js@<1.2.2": "^1.2.2"
  "postcss-selector-parser@<7.1.6": "^7.1.6"
  "smol-toml@<1.9.0": "^1.9.0"
  # Command injection through services() on Windows, under shadcn's CLI at
  # dev time only. 5.33.16 has the fix.
  "systeminformation@<5.33.16": "^5.33.16"
  # Array-limit bypass through bracket-key comma parsing, and a denial of
  # service through an attacker-controlled isBuffer. 6.16.0 covers both.
  "qs@<6.16.0": "^6.16.0"
  # GHSA-jqff-g426-hqxp and three siblings: host confusion and request
  # forgery through percent-encoded schemes, skipped IDN canonicalisation and
  # malformed authorities. It arrives under ajv, including the connector SDK's
  # copy, so it sits on a path this app exposes.
  # Authority injection through an unvalidated port in serialize, and a
  # follow-up fixed in 3.1.8, raised the floor from 3.1.6. CVE-2026-110180 and
  # CVE-2026-110306 raised it again to 3.1.9.
  "fast-uri@<3.1.9": "^3.1.9"
  "flatted@<3.4.2": "^3.4.2"
  # GHSA-jqcg-44mw-7w3h: IP spoofing through IPv4-mapped addresses. It
  # arrives under express in the MCP SDK; the app resolves client IPs itself,
  # but the copy sits on a production path.
  "proxy-addr@<2.0.8": "^2.0.8"
  # GHSA-3f6p-5ww8-9rcr: auth-plugin downgrade leaking plaintext credentials.
  # Reached only through prisma's MySQL driver, which this app never opens;
  # pinned so the audit reads clean, and mirrored for /opt/prisma-cli in the
  # Dockerfile.
  "mysql2@<3.22.0": "^3.22.0"
  # The scanner suggests 10.x (latest), but the ReDoS fix is backported: only
  # <3.1.4 is vulnerable, so the 3.x line stays where its consumers expect it.
  "minimatch@<3.1.4": "^3.1.4"
  # Address4 decoded leading-zero octets as decimal, so `010.0.0.1` parsed as
  # 10.0.0.1 rather than being rejected. That is the exact alt-notation class
  # `isPublicUrl` exists to catch, and this copy arrives under the MCP SDK's
  # rate limiter where nothing of ours screens it.
  # Later advisories raised the floor from 10.3.1 to 10.7.1, then to 10.7.4
  # (a ReDoS in the Address6 zone identifier, through 10.7.3).
  "ip-address@<10.7.4": "^10.7.4"
  "sharp@<0.35.0": "^0.35.3"
  # Deeply nested input drives DeepmergeTS into unbounded recursion until the
  # stack gives out. The copy here is Prisma's: `@prisma/config` still asks for
  # 7.1.5 even on the current 7.9.1, so no Prisma bump reaches it and the
  # override is the only way through. It runs on the config-loading and CLI
  # path, not under a request, but a red audit blocks the whole release train.
  "deepmerge-ts@<8.0.0": "^8.0.0"
  # CVE-2026-59952. The copy arrives through prisma's local dev server, not
  # ours to call. Mirrored for /opt/prisma-cli in the Dockerfile,
  # where the flagged 1.2.0 landed. 1.4.2 is the same major, so no consumer is
  # dragged onto a new one.
  "valibot@<1.4.2": "^1.4.2"

  # GHSA-p498-v437-472g. eslint's filesystem layer; development-only, but the
  # floor costs nothing and keeps the advisory list at zero so a real one is
  # not lost in the noise.
  "@humanfs/node@<0.16.8": "^0.16.8"

  # GHSA-g7r4-m6w7-qqqr. Reached through the test tooling, never shipped. The
  # patched line is the same minor, so nothing downstream moves.
  "esbuild@>=0.27.3 <0.28.1": "^0.28.1"

  # Development-only copies (test containers, build tooling) that the
  # dependency alerts flag: gRPC under the test containers, brace-expansion on
  # three major lines, and undici 7 next to the app's own undici 8
  # (CVE-2026-109869, CVE-2026-109841 and CVE-2026-109924 raised it to 7.30.1).
  "@grpc/grpc-js@>=1.14.0 <1.14.5": "^1.14.5"
  "brace-expansion@<1.1.21": "^1.1.21"
  "brace-expansion@>=2.0.0 <2.1.7": "^2.1.7"
  "brace-expansion@>=4.0.0 <5.0.12": "^5.0.12"
  "undici@>=7.0.0 <7.30.1": "^7.30.1"

  # GHSA-587h-7wmj-h5pm (HIGH), GHSA-rq7h-c2jc-7f22, GHSA-r825-w8mm-5pxw,
  # GHSA-698v-4r3x-3vcv and GHSA-9jrq-w75r-8gcw: dev-server file serving,
  # cross-origin middleware and the bundled launch-editor. Vite arrives only
  # under vitest, never in the image; vitest asks for ^8, so a floor on the
  # same major moves it and nothing else.
  "vite@>=8.0.0 <8.1.6": "^8.1.6"
  # GHSA-86w9-cpqp-85rv, GHSA-7wch-p9px-956x, GHSA-jc66-7q78-782g,
  # GHSA-8hrf-8g6f-7xwp, GHSA-hqq3-7jhf-c5jx, GHSA-5x38-2vff-x55p: signature,
  # certificate-chain and TLS-record flaws in node-forge <= 1.4.0. It arrives
  # only through @parse/node-apn; 1.4.2 is the release node-apn 8.1.1 pins.
  "node-forge@<1.4.2": "^1.4.2"

allowBuilds:
  "@prisma/engines": true
  prisma: true
  core-js: false
  cpu-features: false
  esbuild: false
  lefthook: false
  msw: false
  protobufjs: false
  sharp: false
  ssh2: false
  tesseract.js: false
  unrs-resolver: false

minimumReleaseAgeExclude:
  - "@next/bundle-analyzer@16.2.12"
  - lucide-react@1.27.0
  - undici@8.10.0

patchedDependencies:
  "@stryker-mutator/vitest-runner@10.0.0": patches/@stryker-mutator__vitest-runner@10.0.0.patch