threshold-ui/pnpm-overrides.md

package.json Overrides

This file documents the rationale for each dependency override defined in package.json under pnpm.overrides. These overrides force specific versions of transitive dependencies, primarily for security and compatibility reasons.

Package	Version	Pulled in by	What to check before removing
micromatch	^4.0.8	anymatch (^3.1.4), common-tags (3.1.10), sane (^3.1.4), find-yarn-workspace-root / findup-sync (^4.0.2), ember-template-lint / stylelint (^4.0.5) all declare ranges that would resolve below 4.0.8.	Once all dependents declare a range of ^4.0.8 or higher, the override can be removed.
css-select>nth-check	^2.0.1	css-select pins an older nth-check.	Check whether a newer css-select release drops the pinned nth-check <2.0.0 requirement. Used by ember-inline-svg.
ansi-html	^0.0.9	Both broccoli-middleware and broccoli pin "ansi-html": "^0.0.7".	Check whether newer broccoli / ember-cli releases update these to drop the sub-0.0.9 pin.
fireworm>async	^2.6.4	fireworm pins an older async.	Check whether fireworm has been updated or replaced; if testem updates fireworm, this override can be removed.
ember-cli-babel>@babel/runtime	7.27.6	ember-cli-babel restricts the version it resolves.	Review when upgrading ember-cli-babel; once its @babel/runtime range is broad enough, remove and verify the build.
ember-try-config>package-json	^10.0.1	ember-try-config pins an older package-json.	Check whether a newer ember-try-config release widens its package-json range to include v10+.
ember-loading>ember-concurrency	^4.0.0	ember-loading declares "ember-concurrency": "^2.0.3".	The override and the patch (patches/ember-loading.patch) are a pair — the override forces v4 to be installed, the patch updates the source to use v4. Both must be removed together if ember-loading ever ships a version that natively supports v4.
tmp	^0.2.7	10+ packages pin old versions of tmp (broccoli, can-symlink, ember-cli-typescript, external-editor, fixturify-project, sane, testem, and others)	Check whether the main Ember toolchain packages (broccoli, ember-cli, testem) have been updated to allow tmp ^0.2.x.
tar	^7.5.22	Both cacache (^6.1.11) and @electron/rebuild (^6.0.5) pin old ranges.	Check whether a newer ember-electron brings in versions of @electron/rebuild and cacache that allow tar ^7.x.
nomnom>underscore	^1.13.8	nomnom pins "underscore": "~1.6.0". All other consumers already declare ranges that include 1.13.8.	nomnom@1.8.1 is the last published version and the package is abandoned. jsonlint is the actual consumer, currently pinned to ^1.6.3 which still depends on nomnom.
ember-cli>markdown-it	^14.3.2	ember-cli (~5.12.0) pins old ranges.	Once ember-cli has been updated to at least 6.3.0 then this override can be removed.

Security overrides added by the Threshold fork

The overrides keyed <name>@>=X.0.0 <Y.0.0 were generated from pnpm audit (see the "About this fork" section in the README). Each one only raises a transitive dependency to the latest patched release within the same major line (patch/minor, lockfile-only effect). They are build/test tooling dependencies (ember-cli, testem, stylelint, openapi-generator, ...), not shipped code. Remove an entry once the dependents release versions that no longer need it; re-run pnpm audit after removing.

Packages covered: @babel/core, @humanfs/node, @xmldom/xmldom, axios, baseline-browser-mapping, body-parser, brace-expansion, browserslist, colord, compression, diff, engine.io, follow-redirects, form-data, handlebars, immutable, ip-address, js-yaml, linkify-it, morgan, nanoid, postcss, postcss-selector-parser, proxy-addr, qs, seroval, shell-quote, socket.io-parser, source-map-js, websocket-driver, ws.

Known unfixed without a major bump or an upstream fix: svgo@1 (via ember-inline-svg), @faker-js/faker@8 (api addon mirage data), uuid@8 (testem), diff@7 (sinon), postcss-selector-parser@6 (stylelint), basic-ftp@5 (openapi-generator), extract-zip@2, http-cache-semantics@4, braces@3, sprintf-js@1 (no patched release).