# pnpm >= 10.28 no longer reads these from the "pnpm" field in package.json and
# silently ignores them there, which left Electron's binary undownloaded in any
# freshly installed tree (see scripts/ensure-electron.mjs).
#
# There is deliberately no `packages:` key. This is a single-package repo —
# website/ is an isolated sub-project with its own lockfile and must NOT be
# pulled in as a workspace member.

onlyBuiltDependencies:
  - better-sqlite3
  - electron
  - esbuild
  - msw
  - sharp

overrides:
  tar: ^7.5.21
  # Transitive-only advisory fixes (none of these are direct dependencies; each
  # is pulled in by a devDependency's own subtree). Pinned to the lowest patched
  # version per advisory rather than "latest" to keep the bump minimal. See
  # .github/workflows/security.yml for the audit step these clear and
  # docs/specs/2026-08-05-dependency-advisory-baseline.md for the full disposition.
  brace-expansion@1: ^1.1.18
  brace-expansion@2: ^2.1.4
  brace-expansion@5: ^5.0.9
  fast-uri: ^3.1.5
  nanoid: ^3.3.18
  postcss: ^8.5.23
  ip-address: ^10.3.1
  js-yaml: ^4.3.1
  undici@6: ^6.28.0
  undici@7: ^7.29.0
  builder-util-runtime: ^9.7.0
  app-builder-lib: ^26.15.0

supportedArchitectures:
  os:
    - current
  cpu:
    - x64
    - arm64