# pnpm ≥ 10 settings (pnpm 12 no longer reads the "pnpm" field in package.json)
onlyBuiltDependencies:
  - "@node-rs/argon2"
  - esbuild
  - sharp
# Supply-chain policy: refuse packages published less than 24 h ago (pnpm 12 default, made explicit).
minimumReleaseAge: 1440