# Non-stdlib dependency allowlist. One module path per line; # starts a comment.
# Adding a line requires an ADR in harness/decisions.md. Stdlib first for what you can verify by
# reading it; a maintained module for anything somebody else specified (ADR-0083).
# Only direct requirements are checked here; the total module count is capped by DEPS_MAX.
# Infrastructure clients (Redis, S3, search) are dependencies like any other and get no exemption.

github.com/yuin/goldmark
golang.org/x/text          # NFC normalisation (ADR-0015); collation later if earned
golang.org/x/image         # CatmullRom resampling + WebP decode (ADR-0040); no stdlib resizer exists
gopkg.in/yaml.v3           # frontmatter + site declaration (ADR-0020)
github.com/alecthomas/chroma/v2   # server-side syntax highlighting (ADR-0075); the only mature pure-Go one