Comment # 2 on bug 1224382 from Benjamin Greiner

Bogus CVE. braces is only pulled in by eslint and not installed or used at
runtime.