overrides:
  "dompurify@<=3.4.10": "^3.4.11"
  "postcss@<8.5.10": "^8.5.10"
  "nanoid@<3.3.18": "^3.3.18"
  "@hono/node-server@<1.19.13": "^1.19.13"
  "hono@<4.12.25": "^4.12.25"
  "picomatch@<4.0.4": "^4.0.4"
  "body-parser@<2.3.0": "^2.3.0"
  "fast-uri@<3.1.5": "^3.1.5"
  "flatted@<3.4.2": "^3.4.2"
  # The advisory covers 4.x only; the bound keeps a hypothetical 3.x consumer
  # off a major it never asked for.
  "js-yaml@>=4.0.0 <4.3.1": "^4.3.1"
  # GHSA-3f6p-5ww8-9rcr: auth-plugin downgrade leaking plaintext credentials.
  # Reached only through prisma's MySQL driver, which this app never opens;
  # pinned so the audit reads clean, and mirrored for /opt/prisma-cli in the
  # Dockerfile.
  "mysql2@<3.22.0": "^3.22.0"
  # The scanner suggests 10.x (latest), but the ReDoS fix is backported: only
  # <3.1.4 is vulnerable, so the 3.x line stays where its consumers expect it.
  "minimatch@<3.1.4": "^3.1.4"
  # Address4 decoded leading-zero octets as decimal, so `010.0.0.1` parsed as
  # 10.0.0.1 rather than being rejected. That is the exact alt-notation class
  # `isPublicUrl` exists to catch, and this copy arrives under the MCP SDK's
  # rate limiter where nothing of ours screens it.
  "ip-address@<10.3.1": "^10.3.1"
  "sharp@<0.35.0": "^0.35.3"
  # A crafted PDF could run arbitrary JavaScript through the renderer. Our own
  # copy is pinned past it in `devDependencies`, but a second copy arrives
  # transitively, and `outputFileTracingIncludes` ships EVERY `pdfjs-dist@*` in
  # the store into the standalone image — so an unused transitive copy is still
  # a copy in the runtime image. The range is bounded on both ends deliberately:
  # `pdf-parse` resolves 5.4.296, which predates the flaw and drives the local
  # text-extraction path, so it must not be dragged onto a new major.
  "pdfjs-dist@>=5.6.83 <6.2.108": "6.2.108"
  # Deeply nested input drives DeepmergeTS into unbounded recursion until the
  # stack gives out. The copy here is Prisma's: `@prisma/config` still asks for
  # 7.1.5 even on the current 7.9.1, so no Prisma bump reaches it and the
  # override is the only way through. It runs on the config-loading and CLI
  # path, not under a request, but a red audit blocks the whole release train.
  "deepmerge-ts@<8.0.0": "^8.0.0"

allowBuilds:
  "@prisma/engines": true
  prisma: true
  core-js: false
  cpu-features: false
  esbuild: false
  lefthook: false
  msw: false
  protobufjs: false
  sharp: false
  ssh2: false
  tesseract.js: false
  unrs-resolver: false

minimumReleaseAgeExclude:
  - "@next/bundle-analyzer@16.2.12"
  - lucide-react@1.27.0
  - "@openai/codex-security@0.1.1"
  - undici@8.10.0