# needed to prevent bad npm that has min-release-age but not exclude
engine-strict=true

min-release-age=14
# allow assistant-ui packages & a couple specific deps since they update a LOT.
# remove this when we stabilize (or we haven't updated in 2 wks)
min-release-age-exclude[]=@assistant-ui/*
min-release-age-exclude[]=assistant-cloud
min-release-age-exclude[]=assistant-stream
min-release-age-exclude[]=@radix-ui/*
min-release-age-exclude[]=radix-ui
min-release-age-exclude[]=safe-content-frame

# react-router 8.3.0 includes fixes for vulns. remove this when 8.3.0 is > 2wks old.
min-release-age-exclude[]=react-router

# eslint 10.8.0 includes fixes for vulns. remove this when 10.8.0 is > 2wks old.
min-release-age-exclude[]=eslint
min-release-age-exclude[]=@eslint/*

# tar 7.5.21 includes fixes for vulns. remove this when 7.5.21 is > 2wks  old
min-release-age-exclude[]=tar

# concurrently 10.0.4 includes fixes for vulns. remove this when 10.0.4 is > 2wks  old
min-release-age-exclude[]=concurrently

# fast-uri 3.1.4 includes fixes for vulns. remove this when 3.1.4 is > 2wks  old
min-release-age-exclude[]=fast-uri

# minimatch 10.2.6 includes fixes for vulns. remove this when 10.2.6 is > 2wks  old
min-release-age-exclude[]=minimatch


# brace-expansion 5.0.9 includes fixes for vulns. remove this when 5.0.9 is > 2wks  old
min-release-age-exclude[]=brace-expansion

# js-yaml 4.3.1 includes fixes for GHSA-5p4m-2wfm-xmqj. remove when > 2wks old (rel 2026-07-31)
min-release-age-exclude[]=js-yaml

# nanoid 3.3.17 includes fixes for GHSA-2v37-7h3g-55p8. remove when > 2wks old (rel 2026-08-03)
min-release-age-exclude[]=nanoid

# mermaid 11.16.1 includes fixes for 5 GHSAs. remove when > 2wks old (rel 2026-08-04)
min-release-age-exclude[]=mermaid

# dompurify 3.4.13 includes fixes for GHSA-55q2-fjhq-7xh7. remove when > 2wks old (rel 2026-08-03)
min-release-age-exclude[]=dompurify

# vite 8.2.0 is the first release depending on rolldown >= 1.2.1, which fixes
# a rolldown panic that breaks `npm run build` in apps/desktop
# (rolldown/rolldown#10337 — a regression in 1.1.5, the version vite 8.1.5
# pins as ~1.1.5). @oxc-project/types is here because rolldown 1.2.1 pins it
# as `=0.142.0` — an exact pin, so no older release satisfies it and the age
# gate would fail the whole install with ETARGET.
# remove these once vite 8.2.0 is > 2wks old.
min-release-age-exclude[]=vite
min-release-age-exclude[]=rolldown
min-release-age-exclude[]=@rolldown/*
min-release-age-exclude[]=@oxc-project/types

# ink needs
min-release-age-exclude[]=lightningcss
min-release-age-exclude[]=postcss