{
  "suppressions": [
    {
      "advisory": "GHSA-mh99-v99m-4gvg",
      "package": "brace-expansion",
      "introducedBy": "aws-cdk-lib@2.262.1",
      "scope": "Build-time CDK synthesis only; no untrusted pattern input or runtime deployment artifact.",
      "reason": "The vulnerable copy is bundled by the latest aws-cdk-lib release and cannot be overridden or updated independently. Dependabot monitors the pinned CDK dependency.",
      "reviewBy": "2026-08-10",
      "tracking": "SH-133"
    }
  ]
}