.yarnrc.yml

approvedGitRepositories:
  - "https://github.com/coursetable/passport-cas"

enableScripts: true

nodeLinker: node-modules

npmMinimalAgeGate: 1d

# Advisory suppressions (audit gate). Keep each entry scoped to a single advisory
# id with a justification and an exit condition, and revisit on dependency bumps.
npmAuditIgnoreAdvisories:
  # eslint (deprecation): eslint 9.39.4 is flagged end-of-support by npm's version-support
  # policy. This is a devDependency lint toolchain advisory, not a runtime vulnerability, and
  # 9.39.4 is already the latest 9.x. Moving off it requires an eslint 10 major upgrade with a
  # flat-config migration, which is out of scope here. Remove this entry when the toolchain
  # moves to eslint 10.
  - "eslint (deprecation)"
  # GHSA-qwww-vcr4-c8h2 (react-router RSC-mode CSRF bypass, id 1124282).
  # Not applicable: this client is a plain Vite SPA with no React Server Components
  # (no RSC data/server routes), so the RSC-mode action path the advisory targets is
  # never reached. Fix requires react-router >=8.3.0, but react-router-dom has no 8.x
  # (v8 dropped the -dom package), making the "proper" fix a full v7->v8 migration plus
  # a React >=19.2.7 bump. Remove this entry once a 7.x patch lands or we migrate to v8.
  - "1124282"