build(deps): refresh brace-expansion to latest

[rohanshrma222]

Pull Request Checklist

Please ensure that your PR meets the following requirements:

• I have read the CONTRIBUTING guide.
• I have updated the documentation (not applicable dependency-only change).
• My code follows the style guidelines of this project.
• I have performed a self-review of my own code.
• I have added tests that prove my fix is effective or that my feature works (not applicable for a dependency update).
• New and existing unit tests pass locally with my changes, where applicable.

Description

Refreshes the transitive brace-expansion dependency (pulled in everywhere via various versions of minimatch) across every lockfile in the repo where it had drifted out of date, to avoid drift in glob/pattern handling as r

brace-expansion is 100% transitive here no package.json decs a pure lockfile refresh with no package.json/overrideschanges. Three major lines are in play depending on which minimatch version resolves it in a given project; each was bumped to its latest currently-safe patch:

• 1.x → 1.1.16
• 2.x → 2.1.2
• 5.x → 5.0.7 (not 5.0.8 — that release was published only is rejected by this repo's own pnpm minimumReleaseAgesupply-chain policy; 5.0.7 is the latest release that clears it)
  Files touched: apps/next-js, examples/javascript, examples/moss-pikachu/promo, examples/voice-agents/insurance-adjuster/ui, moss-live-labs/examples/image-search/react-app, sdks/javascriprcel/agent-react (pnpm), packages/vitepress-plugin-moss (pnpm). apps/moss-vscode and its promo/ sibling needed no change — already current.

Verified per-project via lint/typecheck/build/test where the environment allowed; all failures encountered were confirmed pre-existing by reproducing them
against the original, unmodified lockfiles. sdks/javascript/sdkstall in this environment (needs a Rust-built native binaryunrelated to this change), so that lockfile was validated via JSON-parse only.

Fixes #469

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

[HarshaNalluru]

@codex review

[Copilot]

Copilot wasn't able to review any files in this pull request.

Files not reviewed (8)

• apps/livekit-moss-vercel/agent-react/pnpm-lock.yaml: Generated file
• apps/next-js/package-lock.json: Generated file
• examples/javascript/package-lock.json: Generated file
• examples/moss-pikachu/promo/package-lock.json: Generated file
• examples/voice-agents/insurance-adjuster/ui/package-lock.json: Generated file
• moss-live-labs/examples/image-search/react-app/package-lock.json: Generated file
• packages/vitepress-plugin-moss/pnpm-lock.yaml: Generated file
• sdks/javascript/sdk/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[HarshaNalluru]

/review

[github-actions]

Codex review

No issues found.

[rohanshrma222]

@HarshaNalluru This CI issue is pre-existing

Root cause is that pip install ruff has no version pin, and ruff just released 0.16.0 which expanded its default rule set. With 0.16.0, ruff check . fails with 475 errors across pre-existing files.

Should i raise a new issue and fix it there?

[HarshaNalluru]

checks failing

[rohanshrma222]

@HarshaNalluru This CI issue is pre-existing

Root cause is that pip install ruff has no version pin, and ruff just released 0.16.0 which expanded its default rule set. With 0.16.0, ruff check . fails with 475 errors across pre-existing files.

Should i raise a new issue and fix it there?

?

[rohanshrma222]

checks failing

PTAL at the above comment.

[HarshaNalluru]

@rohanshrma222 thanks for the flag, make a new PR to fix that issue and come back to this

[rohanshrma222]

@rohanshrma222 thanks for the flag, make a new PR to fix that issue and come back to this

That issue was already fixed in another PR.