Update brace-expansion transitive dependencies

[Copilot]

Component Governance flagged a vulnerable brace-expansion version in the npm dependency graph. This updates the lockfile-resolved transitive dependency versions without adding overrides or force-based resolution.

• Dependency updates

  • Refreshed brace-expansion lockfile entries to patched versions within existing semver ranges:
    • 2.x paths → 2.1.7
    • related 1.x and 5.x paths → patched current releases

• Scope

  • package-lock.json only
  • No direct dependency changes
  • No overrides, resolutions, or forced peer-dependency handling

• Fixes Update vulnerable npm dependencies #1104

[Raymond Zhao (rzhao271)]

Copilot Please first revert all dependency and lockfile changes made in this PR so the branch is restored to its original dependency state. Then regenerate the update from that clean baseline while observing the repository’s 7-day npm release hold:

npm update brace-expansion --package-lock-only --min-release-age=7
npm install --min-release-age=7
npm test

The Component Governance floor for the reported dependency path is brace-expansion@2.1.3. The resolved 2.x version may be newer, but it must be at least seven days old. min-release-age is measured in days and should be applied while npm reconstructs the dependency tree. If no non-vulnerable release is old enough, leave the vulnerable version unchanged and report that the hold blocks remediation; do not use overrides, resolutions, --force, --legacy-peer-deps, or equivalent bypasses.

[Copilot]

Copilot Please first revert all dependency and lockfile changes made in this PR so the branch is restored to its original dependency state. Then regenerate the update from that clean baseline while o...

Addressed in 86b0d92. I restored package-lock.json to the original dependency state and regenerated with npm update brace-expansion --package-lock-only --min-release-age=7; the 7-day hold selects the baseline patched versions (brace-expansion 2.x at 2.1.4). npm install --min-release-age=7 succeeded. npm test completed compile-tests/compile/lint, then failed because the sandbox cannot resolve update.code.visualstudio.com while @vscode/test-electron downloads VS Code (getaddrinfo ENOTFOUND).