chore(deps-dev): bump brace-expansion from 1.1.16 to 1.1.21 in /npm-package

[dependabot]

Bumps brace-expansion from 1.1.16 to 1.1.21.

Commits

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• Additional commits viewable in compare view

[Changyong Gong (chagong)]

Dependabot (@dependabot) rebase

[Changyong Gong (chagong)]

Security patch is lockfile-only, the transitive ESLint dependency remains required, and all current-head checks pass.

[Changyong Gong (chagong)]

Decision: MERGED

Dependabot PR Manager result

Repository: microsoft/vscode-gradle
Pull request: microsoft/vscode-gradle#1946 — chore(deps-dev): bump brace-expansion from 1.1.16 to 1.1.21 in /npm-package
Update: brace-expansion 1.1.16 -> 1.1.21 (patch, indirect development dependency, security-related; fixes five CPU, memory, and recursion denial-of-service advisories).
Safety assessment: Verified a signed, bot-only head and a lockfile-only Standard Dependency Gate diff. The package remains required transitively by ESLint through minimatch; the patch stays within ^1.1.7 and is low risk.
Final state: Head 3c8f8d812a62b2461ac8bf1f36d55ff66cb632f9; merged via squash as 7e0fd2a3294874f14a3f4be1cda363cb8d50c089; review APPROVED; CI 16/16 successful with no failed or non-terminal checks.
Actions taken: Requested and verified Dependabot rebase 2da6e5fc50600cedce82f90f5782d4f0df714f69 -> 3c8f8d812a62b2461ac8bf1f36d55ff66cb632f9; clean npm ci and npm explain brace-expansion succeeded; isolated compile failure was reproduced unchanged on the merge base and classified UNRELATED because generated API/protobuf inputs were absent; approved the current head and squash-merged it.
Reason: None
Next action: None