pnpm-workspace.yaml

packages:
  - "packages/*"

allowBuilds:
  # bigint-buffer ships an optional native addon with a pure-JS fallback; we do
  # not need the native build, so deny it (this also stops pnpm 11 from failing
  # the install with ERR_PNPM_IGNORED_BUILDS).
  bigint-buffer: false
  bufferutil: true
  esbuild: true
  utf-8-validate: true

# Force the vulnerable transitive uuid@8 (pulled in by jayson via
# @solana/web3.js) up to the patched line — GHSA-w5hq-g745-h8pq. jayson only
# uses uuid.v4(), which is unchanged across 8→11, so this is API-safe. The
# other uuid copy (14.0.1 via rpc-websockets) is already patched.
overrides:
  uuid@8: "^11.1.1"

confirmModulesPurge: false

# Patch the transitive bigint-buffer (via @solana/spl-token →
# @solana/buffer-layout-utils) for GHSA-3gc7-fjrx-p6mg / CVE-2025-3194: a buffer
# overflow in its native C toBigInt/fromBigInt. There is no upstream fix — 1.1.5
# is the latest and the package is unmaintained. The patch stops the native addon
# from loading so only the safe pure-JS fallback runs, making the vulnerable path
# unreachable (allowBuilds already denies the native build; this hardens it in code).
patchedDependencies:
  bigint-buffer@1.1.5: patches/bigint-buffer@1.1.5.patch