Merge pull request #7287 from github/security/bump-deps-vuln-267586

Bump brace-expansion to 1.1.21 (GHSA-q2hr-2g5m-vwhr)

Author: jencarlucci

package-lock.json

@@ -19,6 +19,7 @@
     "eslint-plugin-json": "^3.1.0"
   },
   "overrides": {
+    "brace-expansion": ">=1.1.21 <2",
     "lodash": ">=4.18.0",
     "js-yaml": "^4.3.2"
   }