# Flat node_modules layout. The @napi-rs/cli build step fails to locate
# the cdylib artifact under pnpm's isolated layout; the hoisted linker
# mirrors npm's structure and unblocks the native build.
nodeLinker: hoisted

# Block resolution of versions less than 24h old (Shai-Hulud window).
# This is the pnpm 11 default but pinned here so it's visible to
# reviewers and survives a future pnpm major flipping the default.
minimumReleaseAge: 1440

# Fail install if a transitive dep tries to run an unapproved script.
strictDepBuilds: true

allowBuilds:
  '@biomejs/biome': true
  onnxruntime-node: true
  protobufjs: true
  sharp: true

minimumReleaseAgeExclude:
  - protobufjs@7.5.8
  - tmp@0.2.6
  - form-data@4.0.6
  - tar@7.5.16
  - markdown-it@14.1.2
  - linkify-it@5.0.1
  - js-yaml@3.15.0
  - js-yaml@4.1.2
  - protobufjs@7.6.1
  - protobufjs@7.6.3
  - '@babel/core@7.29.1'
  - axios@1.18.0
  - brace-expansion@2.1.2
  - brace-expansion@1.1.16
  - js-yaml@4.3.0
  - tar@7.5.18
  - tar@7.5.19
  - tar@7.5.17
  - protobufjs@7.6.5
  - linkify-it@5.0.2
  - sharp@0.35.0
  - brace-expansion@1.1.17
  - brace-expansion@2.1.3
  - brace-expansion@2.1.4
  - brace-expansion@1.1.18
  - js-yaml@3.15.1
  - js-yaml@4.3.1
  - tar@7.5.21
  - '@opentelemetry/core@2.8.0'

# @huggingface/transformers pins sharp ^0.33.5 and no released version has moved
# past ^0.34.5, all of which inherit the libvips CVEs in GHSA-f88m-g3jw-g9cj.
# Force the patched line. sharp is only reached by transformers' image pipeline,
# which LanceDB's text embedding function never uses.
overrides:
  sharp: ^0.35.4