v1.14.3 - Clean audits, safer globs

What's New in v1.14.3

This release removes a dependency that kept failing security audits, fixes a validate hang in pre-commit hooks, and stops refusing some symlinked spec files.

Improved

• No more braces audit warning - Installing OpenSpec no longer pulls in the unpatched braces package, so npm audit in your project stops reporting GHSA-vfj7-8cjw-p6xm through OpenSpec.
• Glob artifacts stay inside the change - The propose, ff, continue and explore workflows now choose and check a glob artifact's file path before anything writes it, including a skill or command the schema delegates creation to. A path that would leave the change directory, directly or through a symlink, is refused.

Fixed

• Symlinked spec files no longer refused - list --specs, show, validate and archive no longer error out when a capability's spec.md is a symlink inside the project. Symlinked layouts are not officially supported. A link that resolves outside the project is still refused.
• validate --all hanging in hooks - On a terminal that reports zero columns, as some pre-commit runners provide, the spinner no longer loops forever writing cursor escapes. OPEN_SPEC_INTERACTIVE=0 and CI now turn the spinner off too.
• Very wide brace patterns - A generates pattern whose braces expand to more than 1,024 paths is rejected with a clear error instead of running openspec status out of memory.

New Contributors

• @CRYPTONIKAV made their first contribution in #2104
• @surlymochan made their first contribution in #2103

Full Changelog: v1.14.2...v1.14.3