Website-Frontend CI currently fails on GHSA-vfj7-8cjw-p6xm in
development-only braces 3.0.3. No patched package release exists. Record
EX-0008 for this advisory and its propagated findings only, expiring
November 10, 2026, with a review on October 17.
The implementation retains the full audit, rejects all production
high/critical findings and all critical findings, checks exact locked
development paths/version, fails on audit errors or expiry, and requires
reassessment for any newer braces release. Lint, tests, build, secret
scanning, SAST and Trivy remain enabled. No global scanner suppression
is added.
Validation: Markdown lint and offline link/fragment checks pass. The
consumer guard passes against the current website lockfile and
regression cases for acceptance, expiry, unrelated/mixed advisories,
runtime paths, critical findings, new releases and audit errors. This
register change is the approval record required by the exception policy;
consumer release remains gated by its normal CI.
Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: GPT-6 <codex@openai.com>
james.maesandGPT-6
5c21fc7771