pnpm-workspace.yaml

overrides:
  # Transitive dependencies of wallet-connector SDKs (trezor/near/walletconnect
  # via @creit.tech/stellar-wallets-kit) pinned to patched versions so
  # `pnpm audit` isn't permanently red on issues we don't directly control.
  # Caret-pinned (same major as what was already resolved) deliberately, not
  # `>=`: an open range let pnpm jump protobufjs to 8.x and uuid to 14.x,
  # crossing major versions these SDKs were never tested against — a
  # regression risk with no way to exercise real Trezor/Solana wallet flows
  # here to catch it. Same-major patch/minor bumps only.
  #
  # NOT overridden: `elliptic` (GHSA-848j-6mx2-7j84, low severity, via
  # secp256k1 -> @near-js/crypto) has no patched release yet as of this
  # writing (npm's latest is still 6.6.1, the vulnerable version) — nothing
  # to pin to. Re-check periodically; `pnpm audit --prod` will surface it
  # again once a fix ships.
  protobufjs: "^7.6.5"
  postcss: "^8.5.18"
  uuid: "^11.1.1"
  ws: "^8.21.0"
  axios: "^1.18.1"
  next: "^16.2.11"
  # next@16.2.9 declares its own sharp dependency as `^0.34.5`, which under
  # strict semver caret rules for 0.x versions excludes 0.35.x — so pnpm
  # resolves the vulnerable 0.34.5 by default. Forced past next's declared
  # range to the patched line; Next only exercises a small resize/format
  # subset of sharp's API for image optimization, low regression surface.
  sharp: "^0.35.3"
  acorn: "8.17.0"
  minimatch: "10.0.1"
  electron-to-chromium: "1.5.396"

allowBuilds:
  '@reown/appkit': true
  '@stellar/stellar-sdk': true
  blake-hash: true
  bufferutil: true
  msgpackr-extract: true
  protobufjs: true
  secp256k1: true
  sharp: true
  tiny-secp256k1: true
  unrs-resolver: true
  usb: true
  utf-8-validate: true

ignoredBuiltDependencies:
  - sharp
  - unrs-resolver