packages:
  - "apps/*"
  - "builders/*"
  - "core"
  - "modules/*"
  - "packages/*"
  - "surfaces/*"
  - "templates/*"

allowBuilds:
  esbuild: true

minimumReleaseAgeExclude:
  - postcss@8.5.24

# Narrowly scoped advisory remediation. Each entry raises exactly the one edge that resolves a
# vulnerable version, never the whole graph, and pins an exact release rather than a range.
overrides:
  # GHSA-r28c-9q8g-f849 (high). PostCSS is reached only through Vite, which better-auth pulls in
  # via Vitest. Vite 8.1.4's own dependency range still resolves the vulnerable 8.5.17.
  vite>postcss: "8.5.24"
  # GHSA-67mh-4wv8-2f99 (moderate). The vulnerable esbuild 0.18.20 is reached only through the
  # deprecated @esbuild-kit/core-utils (drizzle-kit -> @esbuild-kit/esm-loader), whose pinned range
  # predates the fix. Scoped to that one edge deliberately: drizzle-kit already resolves esbuild
  # 0.25.12 directly and tsx/vite resolve 0.28.1, so a global override would drag those newer,
  # unaffected versions backwards.
  "@esbuild-kit/core-utils>esbuild": "0.25.12"
  # GHSA-r5fr-rjxr-66jc (high), GHSA-f23m-r3pf-42rh and GHSA-xxjr-mmjv-4gpg (moderate). Lodash is
  # reached only through the development-time Better Auth `auth` CLI's Prisma parser
  # (@mrleebo/prisma-ast -> chevrotain). All three chevrotain packages pin lodash to exactly
  # 4.17.21, so no in-range release is patched; the advisories require >= 4.17.24, which the 4.17.x
  # line never published, making 4.18.1 the lowest fixed release. Verified compatible: it keeps the
  # per-method CommonJS subpath files (`lodash/assign`, `lodash/isRegExp`, ...) chevrotain requires,
  # with the same `main` and no restrictive `exports` field.
  chevrotain>lodash: "4.18.1"
  "@chevrotain/gast>lodash": "4.18.1"
  "@chevrotain/cst-dts-gen>lodash": "4.18.1"