packages:
  - packages/*
  - plugins/*
  - plugins/*/examples/*
  - examples/*

allowBuilds:
  # appium's postinstall only auto-installs drivers for global installs; ours
  # are regular devDependencies of packages/api-e2e, which appium picks up on
  # its own, so there is nothing for it to do
  appium: false
  # transitive deps of @wdio/utils; their postinstall downloads browser drivers
  # the desktop e2e suite never uses (it drives the app via tauri-driver)
  edgedriver: false
  esbuild: true
  geckodriver: false

overrides:
  # mocha (via @wdio/mocha-framework) pins a vulnerable range
  serialize-javascript@<7.0.5: ^7.0.5
  morgan@<1.12.0: ^1.12.0
  # appium and its helpers pin vulnerable ranges
  axios@<1.20.0: ^1.20.0
  sharp@<0.35.5: ^0.35.5
  shell-quote@<1.11.0: ^1.11.0
  # get-uri (via @wdio/utils > @puppeteer/browsers > proxy-agent) is still on
  # basic-ftp 5; it only uses the stable Client API that 6 keeps
  basic-ftp@<6.2.1: ^6.2.1
  # vite > postcss
  source-map-js@<1.2.2: ^1.2.2

auditConfig:
  ignoreGhsas:
    # extract-zip symlink path traversal; no patched release exists (latest is
    # still 2.0.1). Reached via @wdio/utils > @puppeteer/browsers, which only
    # unpacks the browser drivers we never download (see allowBuilds above)
    - GHSA-jmr9-qjv8-65gv
    - GHSA-7pqw-9j4j-h8q3
    # braces stack exhaustion on deeply nested patterns; no patched release
    # exists (latest is still 3.0.3). Only reached via mocha > chokidar, which
    # expands our own test globs, never untrusted input
    - GHSA-vfj7-8cjw-p6xm

minimumReleaseAgeExclude:
  - '@tauri-apps/api@2.12.0'
  - '@tauri-apps/cli-darwin-arm64@2.12.0'
  - '@tauri-apps/cli-darwin-x64@2.12.0'
  - '@tauri-apps/cli-linux-arm-gnueabihf@2.12.0'
  - '@tauri-apps/cli-linux-arm64-gnu@2.12.0'
  - '@tauri-apps/cli-linux-arm64-musl@2.12.0'
  - '@tauri-apps/cli-linux-riscv64-gnu@2.12.0'
  - '@tauri-apps/cli-linux-x64-gnu@2.12.0'
  - '@tauri-apps/cli-linux-x64-musl@2.12.0'
  - '@tauri-apps/cli-win32-arm64-msvc@2.12.0'
  - '@tauri-apps/cli-win32-ia32-msvc@2.12.0'
  - '@tauri-apps/cli-win32-x64-msvc@2.12.0'
  - '@tauri-apps/cli@2.12.0'