# needed to prevent bad npm that has min-release-age but not exclude
engine-strict=true

min-release-age=14

# fast-uri 3.1.5 includes fixes for vulns (GHSA-7p8r-x3mc-p8w7). remove this when 3.1.5 is > 2wks old (rel 2026-07-31)
min-release-age-exclude[]=fast-uri

# js-yaml 4.3.1 includes fixes for GHSA-5p4m-2wfm-xmqj. remove when > 2wks old (rel 2026-07-31)
min-release-age-exclude[]=js-yaml

# nanoid 3.3.17 includes fixes for GHSA-2v37-7h3g-55p8. remove when > 2wks old (rel 2026-08-03)
min-release-age-exclude[]=nanoid

# mermaid 11.16.1 includes fixes for 5 GHSAs. remove when > 2wks old (rel 2026-08-04)
min-release-age-exclude[]=mermaid

# dompurify 3.4.13 includes fixes for GHSA-55q2-fjhq-7xh7. remove when > 2wks old (rel 2026-08-03)
min-release-age-exclude[]=dompurify

# minimatch 10.2.6 includes fixes for vulns. remove this when 10.2.6 is > 2wks  old
min-release-age-exclude[]=minimatch

# brace-expansion 5.0.8 includes fixes for vulns. remove this when 5.0.8 is > 2wks  old
min-release-age-exclude[]=brace-expansion

# postcss 8.5.23 includes fixes for vulns. remove this when 8.5.23 is > 2wks  old
min-release-age-exclude[]=postcss

# undici 6.28.0 includes fixes for vulns. remove this when 6.28.0 is > 2wks old
min-release-age-exclude[]=undici

# @nous-research/image-size 2.0.3 includes fixes for vulns. remove this when 2.0.3 is > 2wks old
min-release-age-exclude[]=@nous-research/image-size