fix(deps): bump brace-expansion from 1.1.18 to 1.1.21

[dependabot]

Bumps brace-expansion from 1.1.18 to 1.1.21.

Commits

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Changyong Gong (chagong)]

Decision: MERGED

Dependabot PR Manager result

Repository: microsoft/vscode-java-test
Pull request: microsoft/vscode-java-test#1942 - fix(deps): bump brace-expansion from 1.1.18 to 1.1.21
Update: brace-expansion 1.1.18 -> 1.1.21, 2.1.4 -> 2.1.7, and 5.0.9 -> 5.0.12; three transitive patch updates with security hardening.
Safety assessment: Dependabot-only history; Standard Dependency Gate passed. Lockfile-only changes retain needed coverage-pattern matching, test discovery, Mocha, and lint dependencies. Upstream fixes bound pathological expansion; public APIs and engine requirements are unchanged. Low risk; no direct brace-expansion declaration to remove.
Final state: MERGED at 2026-10-10T08:52:54Z; head 87b25c4; review APPROVED; merge state UNKNOWN after merge (CLEAN and MERGEABLE immediately before merge). CI: 9 successful, 0 failed, 0 pending; both required checks passed. Failure causality: none.
Actions taken: Verified base ancestry, complete diff, dependency tree with npm ls --package-lock-only, upstream patches, reviews, and current-head CI. Existing Linux/Windows/macOS CI passed lint, Java build, bundling, and extension tests; no local build or tests run. Approved audited head and squash-merged as 4aafc3b; mergedAt verified. No rebase, rerun, remediation, or push needed. Classic protection lookup returned 403; effective required checks and active branch rules were verified separately.
Reason: None
Next action: None