Resolve braces to @pezkuwi/braces 3.0.4 (CVE-2026-93687)

braces resolves to @pezkuwi/braces 3.0.4: braces 3.0.3, the latest upstream release, has an open advisory with no fixed version (CVE-2026-93687, stack exhaustion through deeply nested patterns); the fork rejects nesting deeper than maxDepth (500) with a SyntaxError.

package.json

@@ -47,6 +47,7 @@
     "@types/yargs": "^17.0.35"
   },
   "resolutions": {
+    "braces": "npm:@pezkuwi/braces@^3.0.4",
     "typescript": "5.5.4"
   }
 }