opensearch-dashboards-3/3.6.0 package update (#68305)

* opensearch-dashboards-3/3.6.0 package update

* Correct expected commit for opensearch-build

* reportsDashboard plugin no longer requires the test cleanup in 3.6.0.0

---------

Co-authored-by: staging-update-bot <staging-update-bot@chainguard.dev>
Co-authored-by: Adam Dyess <adam.dyess@chainguard.dev>

Export:  27396b365c04b34fd5e247f7d67bfbfc1991523d

Author: octo-sts-6[bot]

opensearch-dashboards-3.yaml

@@ -1,7 +1,7 @@
 package:
   name: opensearch-dashboards-3
-  version: "3.5.0"
-  epoch: 15
+  version: "3.6.0"
+  epoch: 0
   description: Open source visualization dashboards for OpenSearch
   copyright:
     - license: Apache-2.0
@@ -75,7 +75,7 @@ pipeline:
     with:
       repository: https://github.com/opensearch-project/OpenSearch-Dashboards.git
       tag: ${{package.version}}
-      expected-commit: 7e86cf810d6e616a3453dd93062d7e22fa16c477
+      expected-commit: 47091b2bb937be28e29cde7c3d2c3c9ee6803c27
 
   - runs: |
       # Workaround for "OpenSearch Dashboards should not be run as root.  Use --allow-root to continue."
@@ -95,7 +95,6 @@ pipeline:
       # fix GHSA-6475-r3vj-m8vf, GHSA-xxjr-mmjv-4gpg, GHSA-r6q2-hw4h-h46w, GHSA-8qq5-rm4j-mr97, GHSA-w7fw-mjwx-w883
       # fix CVE-2026-2739 (bn.js), CVE-2025-69873 (ajv), CVE-2026-27904/CVE-2026-26996/CVE-2026-27903 (minimatch)
       # fix CVE-2026-0540/CVE-2025-15599 (dompurify), GHSA-5c6j-r48x-rmvq (serialize-javascript)
-      # fix GHSA-f886-m6hf-6m8v (brace-expansion)
       # fix GHSA-f23m-r3pf-42rh GHSA-r5fr-rjxr-66jc (lodash/lodash-es)
       resolutions='{
         "**/cookie": "^0.7.0",
@@ -123,7 +122,6 @@ pipeline:
         "**/serialize-javascript": "^7.0.3",
         "picomatch": "^2.3.2",
         "**/picomatch": "^2.3.2",
-        "brace-expansion": "^1.1.13",
         "basic-ftp": "^5.2.2",
         "@hapi/content": "^6.0.1"
       }'
@@ -209,7 +207,7 @@ pipeline:
       repository: https://github.com/opensearch-project/opensearch-build
       tag: ${{package.version}}
       destination: opensearch-build
-      expected-commit: 139499ff11880353a9a2e47efabe762e7261754d
+      expected-commit: 18761b2bc0e7c224ff402da1380a5c6e56330f0f
 
   - runs: |
       install -Dm755 opensearch-build/docker/release/config/opensearch-dashboards/opensearch-dashboards-docker-entrypoint-2.x.sh "${{targets.destdir}}/usr/share/opensearch-dashboards/opensearch-dashboards-docker-entrypoint.sh"
@@ -257,7 +255,6 @@ subpackages:
             "@babel/runtime": "^7.26.10",
             "canvg": "^4.0.3",
             "pbkdf2": "3.1.3",
-            "brace-expansion": "^1.1.13",
             "form-data": "4.0.4",
             "@smithy/config-resolver": "4.4.0",
             "lodash": "4.18.0",
@@ -316,11 +313,15 @@ subpackages:
             tar xzf /tmp/minimatch-3.1.4.tgz -C "$dir" --strip-components=1
           done
 
-          if [ ${{range.value}} = "reportsDashboards" ]
-          then
+          if [ "${{range.value}}" = "reportsDashboards" ]; then
             # Remove a test directory of the `resolver` package to prevent surfacing a false-positive.
             # See https://github.com/browserify/resolve/issues/288
-            rm -r build/opensearch-dashboards/${{range.value}}/node_modules/resolve/test
+            RESOLVE_TEST="build/opensearch-dashboards/${{range.value}}/node_modules/resolve/test"
+            if [ -d "$RESOLVE_TEST" ]; then
+              rm -r "$RESOLVE_TEST"
+            else
+              echo "Directory $RESOLVE_TEST no longer exists, skipping removal"
+           fi
           fi
 
           mkdir -p "${{targets.contextdir}}/usr/share/opensearch-dashboards/plugins"