package-audit.jsonc

// audit-ci allowlist for projects based on Vortex.
//
// Lists the npm advisories that the security audit skips. An entry stops
// applying once its expiry date is reached.
//
// https://github.com/IBM/audit-ci
{
  "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
  "allowlist": [
    {
      "GHSA-vfj7-8cjw-p6xm": {
        "active": true,
        "notes": "No patched braces release exists yet. It is reached only through stylelint, which expands the glob patterns in this project's lint scripts, so no outside input reaches it and nothing from it ships with the site.",
        "expiry": "2026-12-31"
      }
    }
  ]
}