packages:
  - packages/*
  - plugins/*
  - plugins/*/examples/*
  - examples/*

allowBuilds:
  # appium's postinstall only auto-installs drivers for global installs; ours
  # are regular devDependencies of packages/api-e2e, which appium picks up on
  # its own, so there is nothing for it to do
  appium: false
  # transitive deps of @wdio/utils; their postinstall downloads browser drivers
  # the desktop e2e suite never uses (it drives the app via tauri-driver)
  edgedriver: false
  esbuild: true
  geckodriver: false

overrides:
  # mocha (via @wdio/mocha-framework) pins a vulnerable range
  serialize-javascript@<7.0.5: ^7.0.5
  devalue@<5.9.1: ^5.9.1
  morgan@<1.12.0: ^1.12.0

auditConfig:
  ignoreGhsas:
    # extract-zip symlink path traversal; no patched release exists (latest is
    # still 2.0.1). Reached via @wdio/utils > @puppeteer/browsers, which only
    # unpacks the browser drivers we never download (see allowBuilds above)
    - GHSA-jmr9-qjv8-65gv
    - GHSA-7pqw-9j4j-h8q3