pnpm-workspace.yaml

auditConfig:
  ignoreGhsas:
    - GHSA-p9ff-h696-f583
    - GHSA-v2wj-q39q-566r
    # brace-expansion DoS. Only fixed in 5.0.8, which is ESM-only and cannot be
    # required by minimatch@3.1.5 (CJS, `var expand = require('brace-expansion')`).
    # Only reaches us via dev-only deps (commitizen, nuxt docs build); not shipped.
    - GHSA-mh99-v99m-4gvg

# Require a package to be published at least 12 days (17280 minutes) before it can be installed
# minimumReleaseAge: 17280
minimumReleaseAgeExclude:
  - '@kong/*'
  - '@kong-ui/*'
  - '@kong-ui-public/*'

onlyBuiltDependencies:
  - '@evilmartians/lefthook'
  - '@parcel/watcher'
  - cypress
  - esbuild
  - vue-demi

overrides:
  '@babel/core@<=7.29.0': '>=7.29.7'
  '@nuxt/devtools@<3.3.1': '>=3.3.1'
  axios@>=1.0.0 <1.12.0: '>=1.18.1'
  brace-expansion@<1.1.18: '>=1.1.18 <2.0.0'
  brace-expansion@>=2.0.0 <2.1.4: '>=2.1.4 <3.0.0'
  brace-expansion@>=3.0.0 <5.0.9: '>=5.0.9'
  devalue@<=5.6.3: '>=5.8.2'
  esbuild: '>=0.28.1'
  fast-uri@>=3.0.0 <3.1.5: '>=3.1.5 <4.0.0'
  form-data@>=4.0.0 <4.0.6: '>=4.0.6'
  immutable@>=5.0.0-beta.1 <5.1.8: '>=5.1.8 <6.0.0'
  js-yaml@<4.3.0: '>=4.3.0 <5.0.0'
  js-yaml@>=4.0.0 <4.3.1: '>=4.3.1'
  launch-editor@<=2.14.0: '>=2.14.1'
  lodash@<=4.17.23: '>=4.18.0'
  nanoid@<3.3.18: '>=3.3.18'
  nuxt@>=4.0.0 <4.5.1: '>=4.5.1'
  postcss@<=8.5.17: '>=8.5.23'
  qs@>=6.11.1 <=6.15.1: '>=6.15.3'
  rollup: 'npm:@rollup/wasm-node'
  shell-quote@<=1.8.4: '>=1.9.0 <2.0.0'
  svgo@>=4.0.0 <4.0.2: '>=4.0.2 <5.0.0'
  systeminformation@<=5.31.6: '>=5.31.7 <6.0.0'
  tar@<=7.5.18: '>=7.5.19 <8.0.0'
  tmp: '>=0.2.7'
  undici@<6.28.0: '>=6.28.0 <7.0.0'
  undici@>=7.0.0 <7.29.0: '>=7.29.0 <8.0.0'
  vite: '>=6.4.3'
  ws@>=8.0.0 <8.21.0: '>=8.21.1'

# When set to no-downgrade, pnpm will fail if a package's trust level has decreased compared to previous releases
trustPolicy: no-downgrade

trustPolicyExclude:
  # False positive. semver@6.3.1 (2023-07-10) is the 6.x maintenance backport of the
  # ReDoS fix (CVE-2022-25883), published by the npm CLI team 3 days after 7.5.4
  # (2023-07-07). 7.5.x builds on the release branch that had provenance enabled; the
  # 6.x branch did not. Since trust checks compare by publish date and ignore semver,
  # pnpm reads the older 6.x line as a downgrade from the newer-published 7.5.x.
  # Only reaches us transitively via @babel/helper-create-class-features-plugin.
  - semver@6.3.1