Update vulnerable npm dependency paths

[Copilot]

Component Governance flagged vulnerable brace-expansion and js-yaml resolutions in the VS Code feed. This updates the affected npm lockfile paths while preserving the existing dependency graph shape.

• Root package lock

  • Updated transitive brace-expansion paths to patched 1.x, 2.x, and 5.x releases.
  • Updated js-yaml to 4.3.2.

• Nested package locks

  • Updated matching dependency paths in api/package-lock.json.
  • Updated matching dependency paths in examples/sample1/package-lock.json.

• Dependency policy

  • No overrides, resolutions, force flags, or legacy peer dependency flags added.

• Fixes Update vulnerable npm dependencies #1783

[Raymond Zhao (rzhao271)]

Copilot Redo the changes taking a 7 day min release age into account.

[Copilot]

Copilot Redo the changes taking a 7 day min release age into account.

Addressed in e1c85b3 by re-resolving the affected lockfile paths with a 7-day release-age cutoff. The lockfiles now use brace-expansion 1.1.18 / 2.1.4 / 5.0.9 and js-yaml 4.3.2.