{
  "_comment": "Vulnerabilities that are allowed past CI gates. Each entry MUST be reviewed and documented in docs/administration/security.md with a clear remediation plan and target date. Do NOT add new entries without justification.",
  "accepted": [
    "@astrojs/vercel",
    "@opentelemetry/propagator-jaeger",
    "@opentelemetry/sdk-node",
    "@vercel/nft",
    "astro",
    "brace-expansion",
    "cacache",
    "gaxios",
    "gcp-metadata",
    "glob",
    "make-fetch-happen",
    "minimatch",
    "node-gyp",
    "nodegit",
    "nodemailer",
    "rimraf",
    "sharp",
    "undici",
    "vite"
  ],
  "documentation": "docs/administration/security.md#accepted-risks"
}