pnpm-workspace.yaml

packages:
  - 'frameworks/*'
  - 'packages/*'
  - 'playgrounds/*'
  - 'scripts'
  - 'website'
minimumReleaseAge: 10080  # minutes — 7 days
minimumReleaseAgeExclude:
  - valibot
  - miniflare@4.20260603.0
  - wrangler@4.98.0
allowBuilds:
  '@parcel/watcher': true
  better-sqlite3: true
  deasync: true
  esbuild: true
  lmdb: false
  msgpackr-extract: false
  sharp: true
  unrs-resolver: true
  vercel: true
  workerd: true
overrides:
  # Security: pin vulnerable deps to patched versions (CVE Lite high findings).
  # Keyed by major so only the affected major line is moved to its fixed version.
  '@babel/plugin-transform-modules-systemjs@7': '7.29.4'
  '@sveltejs/kit@2': '2.60.1'
  'defu@6': '6.1.5'
  'devalue@5': '5.8.1'
  'flatted@3': '3.4.2'
  'glob@10': '10.5.0'
  'h3@1': '1.15.9'
  'immutable@5': '5.1.5'
  'js-cookie@3': '3.0.7'
  'lodash@4': '4.18.0'
  'minimatch@3': '3.1.4'
  'minimatch@5': '5.1.8'
  'minimatch@9': '9.0.7'
  'node-forge@1': '1.4.0'
  'path-to-regexp@6': '6.3.0'
  'picomatch@2': '2.3.2'
  'picomatch@4': '4.0.4'
  'react-router@7': '7.12.0'
  'rollup@4': '4.59.0'
  '@qwik.dev/core>rollup': '4.59.0'
  'semver@7': '7.5.2'
  'serialize-javascript@6': '7.0.5'
  'seroval@1': '1.5.3'
  'shell-quote@1': '1.8.4'
  'svgo@3': '3.3.3'
  'tar@4': '7.5.19'
  'tar@6': '7.5.19'
  'tar@7': '7.5.19'
  'undici@5': '6.24.0'
  'undici@7': '7.24.0'
  'vite@6': '6.4.2'
  'vite@7': '7.3.2'
patchedDependencies:
  '@qwik.dev/router@2.0.0-beta.9': patches/@qwik.dev__router@2.0.0-beta.9.patch