diff --git a/osv-scanner.toml b/osv-scanner.toml
new file mode 100644
index 0000000..2b1126c
--- /dev/null
+++ b/osv-scanner.toml
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# Known vulnerabilities accepted for the docs site's package-lock.json.
+# OpenSSF Scorecard reads this file; Dependabot dismissals do not reach it.
+
+[[IgnoredVulns]]
+id = "GHSA-vfj7-8cjw-p6xm"
+ignoreUntil = 2027-04-15
+reason = "braces 3.0.3 has no patched release. Build-time only dependency of the docs site via Docusaurus (chokidar, micromatch). Its inputs are the repo's own glob patterns, not untrusted data. See #330."
diff --git a/package-lock.json b/package-lock.json
index aae68b3..709fc93 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -20784,9 +20784,9 @@
       }
     },
     "node_modules/webpack-dev-middleware": {
-      "version": "7.4.5",
-      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-7.4.5.tgz",
-      "integrity": "sha512-uxQ6YqGdE4hgDKNf7hUiPXOdtkXvBJXrfEGYSx7P7LC8hnUYGK70X6xQXUvXeNyBDDcsiQXpG2m3G9vxowaEuA==",
+      "version": "7.4.6",
+      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-7.4.6.tgz",
+      "integrity": "sha512-yBWCMvIfUmuhAE8vdqUKzH0vg9kuWN0KeG4vBnqRplUFHRU7lMQjkiJWxVQzvo2BTewqhPhDlMB41rAt2jVA9A==",
       "license": "MIT",
       "dependencies": {
         "colorette": "^2.0.10",