Bump brace-expansion from 1.1.11 to 1.1.21 in /dependabot-sandbox

[dependabot]

Bumps brace-expansion from 1.1.11 to 1.1.21.

Release notes

Sourced from brace-expansion's releases.

v1.1.15

• Backport v5.0.6 change to v1 (#111) 0b09384

---

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

• pkg: publish on tag 1.x c460dbd
• fmt ccb8ac6
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

---

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• Additional commits viewable in compare view

[github-actions]

🤖 Automated severity filter: severity could not be determined

Leaving this security update open for manual review.

Reason: no OSV ecosystem mapping for npm_and_yarn (Docker-based updates have no advisory coverage)

[jvacek]

@dependabot recreate

[github-actions]

🤖 Automated severity filter

Closing this security update: it fixes no advisory rated critical (CVSS ≥ 9.0), the threshold configured for this repository (see .github/dependabot.yml). Highest severity fixed by this PR: high.

Advisories fixed by this update:

Advisory	Severity	CVE
GHSA-3jxr-9vmj-r5cp	high	CVE-2026-13149
GHSA-6j4f-fj2g-mc7p	high	CVE-2026-102276
GHSA-f886-m6hf-6m8v	moderate	CVE-2026-33750
GHSA-mh99-v99m-4gvg	high	CVE-2026-14257
GHSA-q2hr-2g5m-vwhr	moderate	CVE-2026-102277
GHSA-qhr7-859c-m2p7	high	CVE-2026-102278
GHSA-rgw5-rvv9-x895	high	CVE-2026-69152
GHSA-v6h2-p8h4-qcjw	low	CVE-2025-5889

To keep this update anyway, bump the dependency manually or reopen this PR with @dependabot reopen (the filter only runs when a PR is opened or updated, so a reopened PR will not be closed again).

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.