{
  "suppressions": [
    {
      "id": "npmaudit-brace-expansion",
      "justification": "Accepted risk on decommission (2026-07-27): brace-expansion <=5.0.7 (CVE-2026-14257, OOM DoS) is bundled inside the aws-cdk-lib tarball and cannot be updated independently; no patched aws-cdk-lib release exists. The rustdesk-server stack was fully torn down 2026-07-27 and this repo is being archived — the dependency will never be installed or executed again. This suppression exists solely to land the final decommission-docs commit."
    }
  ]
}