Update brace-expansion for CVE-2026-33750

[SamMonoRT]

Summary

• update the vulnerable �race-expansion lockfile entry under @typescript-eslint/typescript-estree from 2.0.2 to 2.0.3n- update the vulnerable �race-expansion lockfile entry under glob from 5.0.4 to 5.0.5n

Verification

• confirmed the previous vulnerable tarball references are no longer present in src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript/package-lock.json`n- validated the edited package-lock.json contains no JSON errors

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Copilot wasn't able to review any files in this pull request.

Files not reviewed (1)

• src/Libraries/Microsoft.Extensions.AI.Evaluation.Reporting/TypeScript/package-lock.json: Language not supported

[shyamnamboodiripad]

Thank you for fixing!

[SamMonoRT]

@shyamnamboodiripad - any ideas why dependabot wouldn't update these like in #7440 ? Also, I'm not sure how to resolve the CI errors

[shyamnamboodiripad]

@shyamnamboodiripad - any ideas why dependabot wouldn't update these like in #7440 ? Also, I'm not sure how to resolve the CI errors

@SamMonoRT I suspect the failures may be happening because some of these packages may not exist in the dotnet-public-npm feed. See this earlier comment

There was also this dependabot PR #7456 which was failing originally - but started passing subsequently. @peterwald did you just clone the branch locally and run the script mentioned in the above comment to get the missing packages downloaded into the feed? Can @SamMonoRT run the same to unblock the current PR?

[peterwald]

There was also this dependabot PR #7456 which was failing originally - but started passing subsequently. @peterwald did you just clone the branch locally and run the script mentioned in the above comment to get the missing packages downloaded into the feed? Can @SamMonoRT run the same to unblock the current PR?

On the referenced PR, it was building just fine locally. It was a file permissions failure in CI. I just retried it and eventually it worked. I've updated the branch, so it will try again and we'll see.

[peterwald]

Something is not right with the package in the public feed. I see that the hashes don't match and that is what is failing the build now.