approvedGitRepositories:
  - "**"

# Install scripts do not run. No dependency has one today, so this costs nothing, and a dependency
# that is compromised later cannot run code on every install (CI and developer machines alike). A
# package that really needs its script gets `dependenciesMeta: { <name>: { built: true } }` in package.json.
enableScripts: false

nodeLinker: node-modules

# A version published less than three days ago is not picked when yarn resolves, so a release that is
# malicious or broken has time to be noticed and pulled before it reaches the lockfile. Versions already
# in the lockfile are not affected. For an urgent fix, list the package in `npmPreapprovedPackages`.
npmMinimalAgeGate: "3d"

# Peer metadata that upstream packages get wrong. Extensions can only add what
# a package left out; they cannot widen a range a package already declares.
packageExtensions:
  # dashjs' @svta helpers peer-depend on sibling @svta packages that dashjs never
  # lists, so they were never installed at all. Pin the versions the helpers ask for.
  "dashjs@*":
    dependencies:
      "@svta/cml-cta": "1.0.6"
      "@svta/cml-structured-field-values": "1.1.3"
      "@svta/cml-utils": "1.5.0"
  # goober (styling inside the React Query devtools) peer-depends on csstype, which
  # @tanstack/query-devtools does not list; it is already installed for other packages.
  "@tanstack/query-devtools@*":
    dependencies:
      csstype: "^3.0.10"
  # media-chrome's React wrapper only needs React when a host renders it from React.
  "ce-la-react@*":
    peerDependenciesMeta:
      react:
        optional: true

# @emoji-mart/react 1.1.x still declares React ^18 as its peer (the picker renders
# fine on React 19), and yarn cannot widen a declared range, so that known-good
# report is silenced. Any other peer mismatch still prints in full.
logFilters:
  - pattern: "react is listed by your project with version * which doesn't satisfy what @emoji-mart/react*"
    level: discard
  - pattern: "Some peer dependencies are incorrectly met by your project*"
    level: discard