Update brace-expansion, diff, fast-uri and nanoid to resolve security alerts

[Copilot]

Dependabot flagged five dev-dependency versions with actionable security alerts. All are transitive except diff, which is pinned through the existing overrides.mocha entry.

package.json

• Bumped the existing overrides.mocha.diff pin from 7.0.0 to 8.0.3. No new override was introduced; mocha declares diff: ^7.0.0, so the pin is what selects the version.

package-lock.json

Dependency	Before	After	Published
brace-expansion (via minimatch@3)	1.1.13	1.1.18	2026-07-30
brace-expansion (via minimatch@9, 3 entries)	2.0.3	2.1.4	2026-07-30
diff	7.0.0	8.0.3	2026-01-12
fast-uri	3.1.5	3.1.7	2026-09-02
nanoid	3.3.16	3.3.18	2026-08-07

Notes for reviewers

• Resolved with --min-release-age 7; publish dates were checked against the registry, and the 2-day-old brace-expansion@2.1.7 was deliberately avoided in favour of 2.1.4.
• No --force, no .npmrc changes, no new overrides/resolutions entries.
• diff@8 is ESM-first but still ships a CJS entry via exports.require, so mocha's require('diff') and its failure-diff rendering continue to work.

• Fixes Update dependencies with actionable security alerts #8960

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟢 Approval recommended

Changes are limited to dependency updates, with only a minor lockfile-instruction conflict noted.

Pull request overview

Updates vulnerable transitive development dependencies and Mocha’s existing diff override.

Changes:

• Bumps the Mocha diff override to 8.0.3.
• Refreshes affected lockfile dependency resolutions and integrity metadata.

File summaries

File	Summary
package.json	Updates the existing Mocha diff override.
package-lock.json	Records the dependency upgrades; reconcile the lockfile update with repository instructions.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.