Release a patch with @parcel/watcher 2.6.0 to drop braces (GHSA-vfj7-8cjw-p6xm)

[yaroslavrick]

@tailwindcss/cli@4.3.3 pins @parcel/watcher@2.5.1, which pulls micromatch@4.0.8 → braces@3.0.3. braces is affected by GHSA-vfj7-8cjw-p6xm (CVE-2026-93687, stack overflow on deeply nested patterns) and has no fixed release: the fix PR micromatch/braces#72 was closed on 2026-10-05, and its author reports the maintainers do not plan to ship one.

main already has @parcel/watcher@2.6.0 since #20381, and 2.6.0 depends on picomatch instead of micromatch, so a release from main removes braces from the CLI's tree entirely. Right now npm audit / bun audit fail for every project on 4.3.3 with no way to fix it short of an overrides entry.

Could you cut a 4.3.4 (or 4.4.0) with that bump? Thanks!

[xop01]

@parcel/watcher 2.6.0 no longer depends on micromatch, so it no longer pulls in braces. 2.5.1 does (micromatch 4, which depends on braces 3.0.3). @tailwindcss/cli 4.3.3 is still on 2.5.1, and there is still no braces release newer than 3.0.3, so the advisory stays until that pin moves.

You can drop it in your own app without waiting on a Tailwind release:

"overrides": {
  "@parcel/watcher": "2.6.0"
}

Reinstall, then run npm audit again. If file watching in the CLI breaks, take the override back out. That is the local fix. A Tailwind release that depends on @parcel/watcher 2.6.0 is what clears it for everyone else.

@yaroslavrick

[yaroslavrick]

Thanks, @xop01! The override could work as a stopgap, but I'd rather not pin a transitive dependency over Tailwind's own version, so I'll wait for a release that ships @parcel/watcher 2.6.0.

[Sarvagya-24-chaturvedi]

Hi @yaroslavrick,

Completely understandable—avoiding manual overrides for transitive dependencies (especially native binding packages like @parcel/watcher) in production is the right call to prevent unexpected ABI/binary mismatch issues.

If you don't want to use overrides, here are the two cleanest, production-safe approaches while waiting for the official 4.3.4 / 4.4.0 release:

---

Option 1: Use Tailwind's Official @next Build (No Overrides)

Tailwind Labs publishes official canary builds directly from main to npm for every merged PR. Because #20381 is already merged into main, the @next tag has @parcel/watcher@2.6.0 pinned and tested by Tailwind itself:

npm install @tailwindcss/cli@next

• Why this satisfies your requirement: You are not overriding any transitive dependencies yourself; you are running Tailwind's own official dependency tree and lockfile.
• Once 4.3.4 / 4.4.0 is tagged, you can switch back to standard @latest.

---

Option 2: Allowlist the Advisory in CI (Leave Dependencies Untouched)

If your main blocker is npm audit failing your CI/CD pipelines right now, you don't need to touch your dependencies at all. You can temporarily allowlist this specific advisory in your CI step:

1. If using audit-ci:

   npx audit-ci --allowlist GHSA-vfj7-8cjw-p6xm

2. If using better-npm-audit:

   npx better-npm-audit audit -i GHSA-vfj7-8cjw-p6xm

3. Or temporarily ignore it in your audit command:
   Since @tailwindcss/cli is a development/build-time tool and braces is only invoked during local file globbing (not exposed to untrusted external input in production), this advisory cannot be exploited at runtime.

---

Release Cadence Note

Tailwind v4 patch releases with dependency bumps usually ship every few days once changes accumulate on main. Watching the Releases page will notify you the moment 4.3.4 or 4.4.0 drops.

[FelixFangX]

Heads up on the @next suggestion: on npm the next dist-tag for @tailwindcss/cli currently points to 4.0.0 from January 2025, not to a build from main. Installing it would downgrade you from 4.3.3. You can check with npm view @tailwindcss/cli dist-tags.

The builds from main are published under insiders. The current one, 0.0.0-insiders.f7f47f8 (published Oct 16), already depends on @parcel/watcher@2.6.0, so there's no braces in its tree. That's fine for checking things before the release, but I wouldn't ship an insiders build.

So until 4.3.4/4.4.0 is out, the options are still the override or waiting. For what it's worth, I tried the override on a clean 4.3.3 project: npm ls braces comes back empty, npm audit is clean, and both a one-off build and --watch behave the same as with 2.5.1. If you're on pnpm, the equivalent is pnpm.overrides (or overrides in pnpm-workspace.yaml): "@parcel/watcher": "2.6.0". Drop it once the release lands.

[Icaro0310]

You don't have to wait for the release to unblock your audit. Force the newer watcher with an override and the braces chain disappears:

// npm, in package.json
"overrides": { "@parcel/watcher": "2.6.0" }

// pnpm equivalent:
// pnpm.overrides: { "@tailwindcss/cli>@parcel/watcher": "2.6.0" }

The actual exposure here is close to zero though. The braces bug needs a hostile glob pattern, and the only patterns micromatch ever sees in the CLI are the content globs from your own config. It's a scanner flag, not a reachable vuln in a build tool.

Still, the pin is real and the bump is already on main, so a patch release of the CLI is the clean fix. Until then the override gets you the same tree.

—
Related work of mine: github.com/Icaro0310 · Website: icaro0310.github.io

[zuhairhalawa]

On the audit part: GHSA-vfj7-8cjw-p6xm was withdrawn on 2026-10-23 as "not a practically exploitable vulnerability", so the braces finding no longer needs an override or a new Tailwind release to clear. npm's audit data returns nothing for braces 3.0.3 or micromatch 4.0.8 any more, and a lockfile resolved from @tailwindcss/cli@4.3.3 (still on @parcel/watcher 2.5.1, micromatch 4.0.8 and braces 3.0.3) reports "found 0 vulnerabilities" with npm 11.13.

Bumping @parcel/watcher to 2.6.0 is still a reasonable dependency update, since it drops micromatch from the tree, but it is no longer what keeps the audit red. A scanner that mirrors the GitHub advisory database and hasn't re-synced since the withdrawal may keep showing the old result.

[zuhairhalawa]

If the audit passes for you now, could you mark the answer as accepted? It will make it easier for others who run into the same braces finding.