fix(ci): bump brace-expansion to 5.0.7 to clear osv-scan GHSA-3jxr-9vmj-r5cp

[tin-berri]

Relevant issues

• osv-scan started failing on every PR run after GHSA-3jxr-9vmj-r5cp (brace-expansion 5.0.6, High 7.7, npm dev dep of the dashboard) entered the OSV database; the fix release 5.0.7 is out
• bumps the single lockfile entry (version, resolved, integrity from the npm registry); npm ci --dry-run validates the lockfile

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Screenshots / Proof of Fix

The osv-scan job on this PR passing is the proof; the same lockfile failed on PR #34029's run 29778431430 with

| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7 | npm | brace-expansion (dev) | 5.0.6 | 5.0.7 | ui/litellm-dashboard/package-lock.json |

Type

🚄 Infrastructure

Changes

• ui/litellm-dashboard/package-lock.json: brace-expansion 5.0.6 -> 5.0.7 (version, resolved URL, integrity), nothing else

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_osv_brace_expansion (a4e81e6) with litellm_internal_staging (214945a)}

[tin-berri]

@greptileai

[greptile-apps]

Greptile Summary

This PR updates a single dev-dependency entry in the dashboard's npm lockfile to pick up a patch release. The three changed lines (version, resolved URL, integrity) are consistent with a standard npm install brace-expansion@5.0.7 update.

• Only brace-expansion is touched; no package versions, dependency trees, or application code are affected.
• The integrity hash matches the 5.0.7 tarball published to the npm registry, and the PR notes that npm ci --dry-run passes.

Confidence Score: 5/5

Safe to merge — the change is a three-line lockfile patch with no effect on application code or the dependency graph.

Only three lines change in the lockfile (version string, resolved URL, integrity hash), all pointing at the published 5.0.7 tarball on the npm registry. No application logic, no package additions, and no other lockfile entries are touched. The OSV scan passing on this PR confirms the targeted entry is resolved.

No files require special attention.

Important Files Changed

Filename	Overview
ui/litellm-dashboard/package-lock.json	Bumps brace-expansion from 5.0.6 to 5.0.7 (version, resolved URL, and integrity hash); no other entries changed

_{Reviews (1): Last reviewed commit: "fix(ci): bump brace-expansion to 5.0.7 t..." | Re-trigger Greptile}