[MonaaEid]

Description:
This pull request updates the brace-expansion dependency to the latest patch version in the GitHub Actions scripts. This change ensures improved security and compatibility for the scripts.

Dependency updates:

• Updated the brace-expansion package version from 1.1.18 to 1.1.21 in package-lock.json and updated the version constraint in package.json to ^1.1.21. This brings in the latest fixes and improvements for this dependency.

Related issue(s):
Fixes #2686

Notes for reviewer:

Checklist

• Documented (Code comments, README, etc.)
• Tested (unit, integration, etc.)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: hiero-ledger/hiero-sdk-python/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1571ee95-42b3-46cb-8b81-e1248738160f

📥 Commits

Reviewing files that changed from the base of the PR and between 4229ee8 and 0870127.

⛔ Files ignored due to path filters (1)

• .github/scripts/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• .github/scripts/package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The GitHub scripts package updates its brace-expansion override from ^1.1.16 to ^1.1.21.

Changes

Dependency override update

Layer / File(s)	Summary
Update dependency override .github/scripts/package.json	The brace-expansion override changes to ^1.1.21.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~3 minutes

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 08701

The GitHub scripts dependency now resolves to 1.1.21, addressing the reported vulnerability. No concrete merge-blocking risk remains.

Architecture Summary

Architecture risk: 🔵 Low · up to 08701

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/scripts/package.json: The brace-expansion override changes from ^1.1.16 to ^1.1.21.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the dependency update and the affected package files. The stated source version differs from the pull request description, but the title remains directly related to the ma…
Description check	✅ Passed	The description explains the brace-expansion update, its security objective, affected files, and linked issue. It is directly related to the changeset.
Linked Issues check	✅ Passed	Issue #2686 requires the project to address the vulnerable brace-expansion versions earlier than 1.1.21. .github/scripts/package.json changes the brace-expansion override from ^1.1.16 to `^1.1…
Out of Scope Changes check	✅ Passed	The reviewed change updates only the brace-expansion dependency override in .github/scripts/package.json. This change directly supports issue #2686. No unrelated code or behavior changes are shown…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}