# package.json Overrides

This file documents the rationale for each dependency override defined in `package.json` under `pnpm.overrides`.
These overrides force specific versions of transitive dependencies, primarily for security and compatibility reasons.

| Package | Version | Pulled in by                                                                                                                                                                                                                   | What to check before removing                                                                                                                                                                                                                            |
|---------|---------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `micromatch` | `^4.0.8` | `anymatch` (`^3.1.4`), `common-tags` (`3.1.10`), `sane` (`^3.1.4`), `find-yarn-workspace-root` / `findup-sync` (`^4.0.2`), `ember-template-lint` / `stylelint` (`^4.0.5`) all declare ranges that would resolve below `4.0.8`. | Once all dependents declare a range of `^4.0.8` or higher, the override can be removed.                                                                                                                                                                  |
| `css-select>nth-check` | `^2.0.1` | `css-select` pins an older `nth-check`.                                                                                                                                                                                        | Check whether a newer `css-select` release drops the pinned `nth-check` `<2.0.0` requirement. Used by `ember-inline-svg`.                                                                                                                                |
| `ansi-html` | `^0.0.9` | Both `broccoli-middleware` and `broccoli` pin `"ansi-html": "^0.0.7"`.                                                                                                                                                         | Check whether newer `broccoli` / `ember-cli` releases update these to drop the sub-`0.0.9` pin.                                                                                                                                                          |
| `fireworm>async` | `^2.6.4` | `fireworm` pins an older `async`.                                                                                                                                                                                              | Check whether `fireworm` has been updated or replaced; if `testem` updates `fireworm`, this override can be removed.                                                                                                                                     |
| `ember-cli-babel>@babel/runtime` | `7.27.6` | `ember-cli-babel` restricts the version it resolves.                                                                                                                                                                           | Review when upgrading `ember-cli-babel`; once its `@babel/runtime` range is broad enough, remove and verify the build.                                                                                                                                   |
| `ember-try-config>package-json` | `^10.0.1` | `ember-try-config` pins an older `package-json`.                                                                                                                                                                               | Check whether a newer `ember-try-config` release widens its `package-json` range to include v10+.                                                                                                                                                        |
| `ember-loading>ember-concurrency` | `^4.0.0` | `ember-loading` declares `"ember-concurrency": "^2.0.3"`.                                                                                                                                                                      | The override and the patch (`patches/ember-loading.patch`) are a pair — the override forces v4 to be installed, the patch updates the source to use v4. Both must be removed together if `ember-loading` ever ships a version that natively supports v4. |
| `tmp` | `^0.2.7` | 10+ packages pin old versions of `tmp` (`broccoli`, `can-symlink`, `ember-cli-typescript`, `external-editor`, `fixturify-project`, `sane`, `testem`, and others)                                                               | Check whether the main Ember toolchain packages (`broccoli`, `ember-cli`, `testem`) have been updated to allow `tmp ^0.2.x`.                                                                                                                             |
| `tar` | `^7.5.10` | Both `cacache` (`^6.1.11`) and `@electron/rebuild` (`^6.0.5`) pin old ranges.                                                                                                                                                  | Check whether a newer `ember-electron` brings in versions of `@electron/rebuild` and `cacache` that allow `tar ^7.x`.                                                                                                                                    |
| `nomnom>underscore` | `^1.13.8` | `nomnom` pins `"underscore": "~1.6.0"`. All other consumers already declare ranges that include 1.13.8.                                                                                                                        | `nomnom@1.8.1` is the last published version and the package is abandoned. `jsonlint` is the actual consumer, currently pinned to `^1.6.3` which still depends on `nomnom`.                                                                              |
| `ember-cli>markdown-it` | `^14.2.0` | `ember-cli` (`~5.12.0`) pins old ranges. | Once `ember-cli` has been updated to at least `6.3.0` then this override can be removed. |