Update brace-expansion npm lockfile entries

[Copilot]

Component Governance flagged a vulnerable transitive brace-expansion npm dependency in the VS Code feed. This updates the resolved dependency path without overrides, resolutions, or force install flags.

• Dependency update

  • Regenerated package-lock.json entries for brace-expansion
  • Updated affected 2.x transitive paths to a patched release
  • Refreshed the related 5.x lockfile entry resolved by npm

• Validation

  • Verified the updated brace-expansion versions have no known GitHub advisories
  • Confirmed the lockfile no longer resolves the vulnerable 2.1.0 version

• Fixes Update vulnerable npm dependencies #969

[Raymond Zhao (rzhao271)]

Copilot Please first revert all dependency and lockfile changes made in this PR so the branch is restored to its original dependency state. Then regenerate the update from that clean baseline while observing the repository’s 7-day npm release hold:

npm update brace-expansion --package-lock-only --min-release-age=7
npm install --min-release-age=7
npm test

The Component Governance dependency path containing brace-expansion@2.1.0 must resolve to at least 2.1.3, using a release at least seven days old. The resolved 2.x version may be newer if it satisfies the age gate.

min-release-age is measured in days and should be applied while npm reconstructs the dependency tree. If no non-vulnerable release is old enough, leave the vulnerable version unchanged and report that the hold blocks remediation; do not use overrides, resolutions, --force, --legacy-peer-deps, or equivalent bypasses.

[Copilot]

Copilot Please first revert all dependency and lockfile changes made in this PR so the branch is restored to its original dependency state. Then regenerate the update from that clean baseline while o...

Addressed in 982f9c2: reverted the previous lockfile update, regenerated from the clean baseline with npm update brace-expansion --package-lock-only --min-release-age=7, then ran npm install --min-release-age=7 and npm test. The affected 2.x paths now resolve to brace-expansion@2.1.4, which satisfies the >=2.1.3 requirement and predates the 7-day hold.