Security exception: braces GHSA-vfj7-8cjw-p6xm has no patched release #78

npm audit reports GHSA-vfj7-8cjw-p6xm (high): braces ≤ 3.0.3 can exhaust the stack on deeply nested brace patterns. No patched release exists. 3.0.3 is the latest, and the advisory lists no first patched version.

Where it comes from: tailwindcss@3.4.19 → micromatch@4.0.8 / chokidar@3.6.0 → braces@3.0.3. It is a build-time dependency only and never ships to a browser.

Exposure: Tailwind only passes braces the content globs from this repository's own tailwind.config.js. Visitors, submitters and issue bodies never reach it, so nobody outside can supply a nested pattern.

Plan:

• Register a P2 exception in quality/security-exceptions.yml with a short expiry, so the audit gate stays green for every deployment.
• Drop the exception when braces ships a fix, or when the site moves off Tailwind 3. If the exception expires first, the audit fails again and forces a fresh look.

The two brace-expansion advisories (GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr) are fixed by updating it to 5.0.12 in the same change.