chore(deps): bump braces to patch the nested-pattern stack overflow advisory

[langz]

Note

Draft placeholder with nothing to merge yet. It keeps the follow-up for Dependabot alert #619 visible until a fixed braces is released.

braces@3.0.3 is flagged by GHSA-vfj7-8cjw-p6xm (high): deeply nested patterns can overflow the stack. Only dev tooling reaches it, through micromatch@4.0.8 (already the latest) and chokidar@3.6.0, so the response target for dev-only findings applies: within 30 days, by 2026-11-04. Removing chokidar@3 would not help, because micromatch still depends on braces.

There is no fix to apply yet. 3.0.3 is the latest release, and no upstream fix is merged. micromatch/braces#75 was closed unmerged, and the candidates #78 and #79 are still open. Per the vulnerability policy, the alert stays open, and pinning a fork or an unmerged commit is not an option. If there is still no release close to the deadline, deferring needs risk-owner sign-off.

Prompt to continue

Continue draft PR https://github.com/dnbexperience/eufemia/pull/9633 (branch chore/deps-braces) for Dependabot alert #619 (braces, GHSA-vfj7-8cjw-p6xm).

1. Check for a patched release: `yarn npm info braces --fields dist-tags,time`, `gh api /advisories/GHSA-vfj7-8cjw-p6xm --jq '.vulnerabilities'`, and the open upstream PRs (micromatch/braces#78, #79). If there is still none, stop and report. Never pin a fork, a git commit or an unmerged PR. If 2026-11-04 is close, remind me that deferring needs risk-owner sign-off.
2. If a fixed version exists, wait until it is at least 3 days old (`npmMinimalAgeGate`; never bypass it). yarn.lock resolves `braces@npm:^3.0.3, braces@npm:~3.0.2` (from micromatch@4.0.8 and chokidar@3.6.0). For a 3.0.x fix, run `yarn up -R braces`. Otherwise add a targeted root `resolutions` entry for the descriptor whose range excludes the fix, but only if the new version is compatible. Then run `yarn dedupe`.
3. Verify: `yarn why braces` lists only the fixed version, `yarn dedupe --check` passes, `audit:ci` passes for @dnb/eufemia, eufemia-mcp-lambda and eufemia-analytics, and `yarn lint` plus `yarn workspace @dnb/eufemia test` pass, since micromatch sits under most of the tooling.
4. Commit, push, remove the placeholder note and this prompt from the description, and mark the PR ready for review. Keep the title.

[jonschlinkert]

See micromatch/braces#70 (comment). This is not a vulnerability, and maxLength completely prevents this already.

[langz]

Re-checked — not ready yet. There is still no fixed braces release: 3.0.3 is the latest, and the advisory lists no patched version. micromatch/braces#75 was closed unmerged, and micromatch/braces#78 and micromatch/braces#79 are still open.

Thanks for the context, @jonschlinkert. Our policy keeps the alert open until the advisory is withdrawn or a fixed version is released, which is why this stays as a draft.

[langz]

Rebased onto main (fbbce6a). The branch still only has the empty placeholder commit.

Status: braces 3.0.3 is still the latest release, and GHSA-vfj7-8cjw-p6xm still has no patched version. There is nothing to apply yet. The response deadline is 2026-11-04.