No-op: brace-expansion already at 2.1.4 in package-lock.json

[Copilot]

The issue requests bumping brace-expansion from 2.0.3 to at least 2.1.3. The lockfile already satisfies this, so no code changes are proposed.

State of package-lock.json on main (b427082)

Path	Version
node_modules/brace-expansion	1.1.18
node_modules/glob/node_modules/brace-expansion	2.1.4
node_modules/mocha/node_modules/brace-expansion	2.1.4
node_modules/vscode-languageclient/node_modules/brace-expansion	2.1.4
node_modules/@vscode/vsce/node_modules/brace-expansion	5.0.9

The 2.x line is at 2.1.4 (≥ required 2.1.3); no 2.0.3 exists anywhere in the tree.

Verification

• npm install --min-release-age 7 --package-lock-only and npm update brace-expansion --min-release-age 7 --package-lock-only (npm 12.0.2) both produce an empty diff — the pinned versions are the newest resolvable under the declared ranges and the 7-day release hold.
• Full npm ci tree inspected: only 1.1.18, 2.1.4, 5.0.9 present, including bundled copies.
• GitHub Advisory Database reports no known vulnerabilities for any of those three versions.

Out of scope

npm audit flags 8 unrelated findings (ajv, diff, js-yaml, qs, serialize-javascript/mocha, underscore). Fixing serialize-javascript requires a breaking mocha@12 upgrade, so these are better handled in a separate change.

The alert that generated this issue appears to predate the bump already merged into main, and the issue can likely be closed without a lockfile change.

• Fixes Update dependencies with actionable security alerts #1111