build(deps-dev): bump brace-expansion from 1.1.18 to 1.1.21

[dependabot]

Bumps brace-expansion from 1.1.18 to 1.1.21.

Commits

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Changyong Gong (chagong)]

Decision: NOT_MERGED

Dependabot PR Manager result

Repository: microsoft/vscode-java-pack
Pull request: microsoft/vscode-java-pack#1772 - build(deps-dev): bump brace-expansion from 1.1.18 to 1.1.21
Update: brace-expansion 1.1.18 -> 1.1.21; patch, previously audited as security-related.
Safety assessment: Validated Dependabot target and sole bot-authored commit; Standard Dependency Gate scope passes (lockfile version, URL, integrity only). Prior report identifies a transitive development dependency via minimatch/tslint and glob, with no direct declaration to remove; necessity and upstream risk analysis were not independently repeated after the definitive policy-evidence blocker. Existing provenance ledger is valid and empty; no requested-change reviews or unresolved threads.
Final state: Head dc1b3e7; OPEN, MERGEABLE, BLOCKED; REVIEW_REQUIRED. CI: 63 current-head terminal checks, 62 SUCCESS, 1 SKIPPED; no failed or non-terminal checks. Required-check discovery reports none, but complete classic protection requirements remain unverifiable.
Actions taken: Refreshed metadata, complete diff, commits, reviews, threads, all comments, active rules, complete current-head checks and commit statuses. Confirmed base 7c60d51 is the head's parent and behind_by=0; no recovery needed. REST classic-protection read returned HTTP 403; GraphQL fallback returned FORBIDDEN. Active rules require one code-owner approval and last-push approval. No rerun, rebase, recreation, remediation, commit, push, review request, approval, or merge attempted; head unchanged.
Reason: Complete required-check and approval policy cannot be verified because the credential cannot read classic branch protection. Review is also currently required.
Next action: Grant the manager credential read access to classic branch protection, then rerun management to complete the audit and obtain a qualifying code-owner approval before merging.

[wenyt (wenytang-ms)]

Reviewed the lockfile-only transitive devDependency bump for brace-expansion 1.1.18 -> 1.1.21. CI is green, including the E2E matrix, and this looks safe to merge.