# pnpm workspace configuration.
#
# Hardening flags recommended by react-doctor's `require-pnpm-hardening`
# rule. `minimumReleaseAge` delays installs until new releases have had
# time to be vetted (mitigates "catch-and-unpublish" supply-chain
# attacks). `trustPolicy: no-downgrade` prevents pnpm from silently
# accepting packages whose trust signals (provenance / signatures)
# weaken between updates.
#
# See: https://react.doctor/docs/rules/react-doctor/require-pnpm-hardening

minimumReleaseAge: 10080  # 7 days, in minutes

trustPolicy: no-downgrade