chore(deps): bump brace-expansion

[dependabot]

Bumps and brace-expansion. These dependencies needed to be updated together.
Updates brace-expansion from 5.0.9 to 5.0.12

Commits

• f341015 5.0.12
• 33a5ef1 Merge commit from fork
• 8247927 5.0.11
• 935d78f Merge commit from fork
• df7682f 5.0.10
• 1ade9de npm run format
• 6735c94 Merge commit from fork
• 4e70465 chore: ensure prettier formatting (#154)
• fd7a5e3 Bump ip-address from 10.2.0 to 10.4.0 (#152)
• 1790143 Bump uuid and @​tapjs/processinfo (#120)
• See full diff in compare view

Updates brace-expansion from 2.1.4 to 2.1.7

Commits

• f341015 5.0.12
• 33a5ef1 Merge commit from fork
• 8247927 5.0.11
• 935d78f Merge commit from fork
• df7682f 5.0.10
• 1ade9de npm run format
• 6735c94 Merge commit from fork
• 4e70465 chore: ensure prettier formatting (#154)
• fd7a5e3 Bump ip-address from 10.2.0 to 10.4.0 (#152)
• 1790143 Bump uuid and @​tapjs/processinfo (#120)
• See full diff in compare view

Updates brace-expansion from 1.1.18 to 1.1.21

Commits

• f341015 5.0.12
• 33a5ef1 Merge commit from fork
• 8247927 5.0.11
• 935d78f Merge commit from fork
• df7682f 5.0.10
• 1ade9de npm run format
• 6735c94 Merge commit from fork
• 4e70465 chore: ensure prettier formatting (#154)
• fd7a5e3 Bump ip-address from 10.2.0 to 10.4.0 (#152)
• 1790143 Bump uuid and @​tapjs/processinfo (#120)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Changyong Gong (chagong)]

Dependency paths, lockfile-only patch scope, and current-head CI verified.

[Changyong Gong (chagong)]

Decision: MERGED

Dependabot PR Manager result

Repository: microsoft/vscode-java-dependency
Pull request: microsoft/vscode-java-dependency#1104 — chore(deps): bump brace-expansion
Update: Security-related grouped patch updates: brace-expansion 5.0.9 -> 5.0.12, 2.1.4 -> 2.1.7, and 1.1.18 -> 1.1.21.
Safety assessment: Single Dependabot-authored commit; standard dependency gate passed with a generated lockfile-only diff. npm explain confirmed all three versions remain required transitively through declared minimatch, mocha, and tslint dependency paths; patch releases address CVE-2026-102277 with no source or configuration changes.
Final state: Head 2b06a454f334fc9e3dfe060260a6779bbdb96319; merged as squash commit ee9d2917286fa72b1d5934653540a366fe3e2cab; review decision APPROVED; 33 successful, 0 failed, and 0 non-terminal checks.
Actions taken: Verified target identity, bot-only provenance, complete diff, dependency paths, branch ancestry (behind_by: 0), reviews, and current-head checks; ran clean npm ci --ignore-scripts plus npm explain; approved the PR; refreshed reviews and checks; squash-merged successfully. No rebase, recreation, rerun, remediation, or push was needed.
Reason: None
Next action: None