allowBuilds:
  esbuild: true
  unrs-resolver: true
minimumReleaseAge: 10080
# pnpm 12 auto-adds new direct dependencies to minimumReleaseAgeExclude instead
# of blocking them; strict keeps the pnpm 11 behavior (fail on immature versions)
minimumReleaseAgeStrict: true
minimumReleaseAgeExclude:
  - '@verdaccio/*'
  - '@verdaccio-scope/*'
  - 'verdaccio-*'
  # security update: body-parser@2.4.0 (GHSA-27r3-jxmh-p828)
  - body-parser@2.4.0
  # security update: fast-uri@3.1.9 (GHSA-w74x-v6f9-j3xg)
  - fast-uri@3.1.9
ignoreScripts: true
saveExact: true
preferFrozenLockfile: true

auditConfig:
  ignoreGhsas:
    # braces: no patched release yet; only reached through globby with fixed '*' patterns
    - GHSA-vfj7-8cjw-p6xm
    # http-cache-semantics: no patched release yet; got only uses it with the `cache` option, which is never set
    - GHSA-ch52-4w7c-c8xp
    # Express.js unreleased
    - GHSA-j3q9-mxjg-w52f
    # Express.js unreleased
    - GHSA-w7fw-mjwx-w883
    # fast-uri (via Ajv)
    - GHSA-qw65-cvwx-89v3
    - GHSA-58mr-gqgx-xq4g