Build: Guard brotli-decompressor license review.

[JJJ]

Summary

• Exclude brotli-decompressor from GitHub dependency review's license parser. Version 6.0.1 publishes a slash-separated BSD-3-Clause/MIT expression, while its packaged LICENSE file contains BSD 3-Clause terms.
• The action ignores versions in exclusion purls. The required dependency policy audit now permits only the reviewed 5.0.3 and 6.0.1 lockfile versions, so another version requires fresh review. Vulnerability checks remain enabled.
• This addresses the license check blocking Dependabot PR build(deps): bump the cargo-minor-and-patch group in /src-tauri with 8 updates #353.

Validation

• Inspected the published 6.0.1 crate with cargo info and its packaged LICENSE file.
• npm run test:frontend on current main.
• Focused negative check: changing the locked version to 6.0.2 fails the dependency policy audit.
• git diff --check.

[Copilot]

Copilot review overview

🟡 Changes recommended

The pinned action ignores PURL versions, unintentionally exempting every brotli-decompressor version.

Review effort: Balanced
Findings: 1

Open (1)

• Version constraint ignored, exempting all brotli-decompressor releases · New

What changed in this PR

Attempts to unblock dependency review for brotli-decompressor 6.0.1 while preserving existing license policy.

Changes:

• Adds a documented license-check exemption for brotli-decompressor@6.0.1.

File	Description
.github/​workflows/​desktop-builds.yml	Adds the dependency license exception.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.