Skip to content

fix(deps): vuln minor upgrades — 11 packages (minor: 5 · patch: 6) [package.json] - #34

Open
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
trunkfrom
engraver-auto-version-upgrade/minorpatch/npm/0-1792397169
Open

fix(deps): vuln minor upgrades — 11 packages (minor: 5 · patch: 6) [package.json]#34
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
trunkfrom
engraver-auto-version-upgrade/minorpatch/npm/0-1792397169

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Oct 19, 2026

Copy link
Copy Markdown

Summary: Critical-severity security update — 11 packages upgraded (MINOR changes included)

Manifests changed:

  • package.json (yarn)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
form-data 4.0.0 4.0.6 patch Transitive 2 CRITICAL, 2 HIGH
@babel/traverse 7.18.2 7.29.10 minor Transitive 2 CRITICAL
brace-expansion 2.0.1 2.1.7 minor Transitive 10 HIGH, 4 MEDIUM, 2 LOW
brace-expansion 1.1.11 1.1.21 patch Transitive 10 HIGH, 4 MEDIUM, 2 LOW
minimatch 3.1.2 3.1.5 patch Transitive 6 HIGH
minimatch 9.0.4 9.0.9 patch Transitive 6 HIGH
js-yaml 3.14.1 3.15.2 minor Transitive 5 HIGH, 4 MEDIUM
js-yaml 4.1.0 4.3.2 minor Transitive 5 HIGH, 4 MEDIUM
flatted 3.2.5 3.4.4 minor Transitive 4 HIGH
path-to-regexp 6.2.2 6.3.0 minor Transitive 4 HIGH
picomatch 2.3.1 2.3.2 patch Transitive 2 HIGH, 2 MEDIUM
cross-spawn 7.0.3 7.0.6 patch Transitive 2 HIGH
json5 2.2.1 2.2.3 patch Transitive 2 HIGH
semver 6.3.0 6.3.1 patch Transitive 2 HIGH

Security Details

🚨 Critical & High Severity (64 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
@babel/traverse CVE-2023-45133 CRITICAL Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code 7.18.2 - -
@babel/traverse GHSA-67hx-6x53-jw92 CRITICAL Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code 7.18.2 7.23.2 -
form-data CVE-2025-7783 CRITICAL Usage of unsafe random function in form-data for choosing boundary 4.0.0 - -
form-data GHSA-fjxv-7rqg-78g4 CRITICAL form-data uses unsafe random function in form-data for choosing boundary 4.0.0 2.5.4 -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 2.0.1 1.1.18 -
brace-expansion GHSA-6j4f-fj2g-mc7p HIGH brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion 1.1.11 5.0.10 -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 2.0.1 5.0.7 -
brace-expansion CVE-2026-102276 HIGH brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion 2.0.1 - -
brace-expansion CVE-2026-13149 HIGH - 1.1.11 - -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 1.1.11 1.1.18 -
brace-expansion GHSA-qhr7-859c-m2p7 HIGH brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion 2.0.1 5.0.11 -
brace-expansion CVE-2026-102278 HIGH brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion 2.0.1 - -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 1.1.11 5.0.7 -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 2.0.1 - -
brace-expansion CVE-2026-102276 HIGH brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion 1.1.11 - -
brace-expansion CVE-2026-13149 HIGH - 2.0.1 - -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 2.0.1 5.0.8 -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 2.0.1 - -
brace-expansion CVE-2026-102278 HIGH brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion 1.1.11 - -
brace-expansion GHSA-qhr7-859c-m2p7 HIGH brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion 1.1.11 5.0.11 -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 1.1.11 - -
brace-expansion GHSA-6j4f-fj2g-mc7p HIGH brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion 2.0.1 5.0.10 -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 1.1.11 5.0.8 -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 1.1.11 - -
cross-spawn GHSA-3xgq-45jj-v275 HIGH Regular Expression Denial of Service (ReDoS) in cross-spawn 7.0.3 7.0.5 -
cross-spawn CVE-2024-21538 HIGH - 7.0.3 - -
flatted CVE-2026-32141 HIGH flatted: Unbounded recursion DoS in parse() revive phase 3.2.5 - -
flatted GHSA-25h7-pfq9-p65f HIGH flatted vulnerable to unbounded recursion DoS in parse() revive phase 3.2.5 3.4.0 -
flatted CVE-2026-33228 HIGH flatted: Prototype Pollution via parse() 3.2.5 - -
flatted GHSA-rf6f-7fwh-wjgh HIGH Prototype Pollution via parse() in NodeJS flatted 3.2.5 3.4.2 -
form-data CVE-2026-12143 HIGH form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) 4.0.0 - -
form-data GHSA-hmw2-7cc7-3qxx HIGH form-data: CRLF injection in form-data via unescaped multipart field names and filenames 4.0.0 2.5.6 -
js-yaml GHSA-5p4m-2wfm-xmqj HIGH JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported 4.1.0 4.3.1 -
js-yaml CVE-2026-59869 HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 3.14.1 - -
js-yaml GHSA-2883-xcg3-v3hh HIGH js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources 4.1.0 4.3.2 -
js-yaml CVE-2026-84375 HIGH js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources 4.1.0 - -
js-yaml GHSA-52cp-r559-cp3m HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 4.1.0 3.15.0 -
js-yaml CVE-2026-59869 HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 4.1.0 - -
js-yaml GHSA-5p4m-2wfm-xmqj HIGH JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported 3.14.1 4.3.1 -
js-yaml GHSA-52cp-r559-cp3m HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 3.14.1 3.15.0 -
js-yaml GHSA-2883-xcg3-v3hh HIGH js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources 3.14.1 4.3.2 -
js-yaml CVE-2026-84375 HIGH js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources 3.14.1 - -
json5 GHSA-9c47-m6qq-7p4h HIGH Prototype Pollution in JSON5 via Parse Method 2.2.1 2.2.2 -
json5 CVE-2022-46175 HIGH - 2.2.1 - -
minimatch CVE-2026-27903 HIGH minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 9.0.4 - -
minimatch GHSA-7r86-cg39-jmmj HIGH minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 3.1.2 10.2.3 -
minimatch GHSA-23c5-xmqv-rm74 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 3.1.2 10.2.3 -
minimatch CVE-2026-27904 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 3.1.2 - -
minimatch GHSA-3ppc-4f35-3m26 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 3.1.2 10.2.1 -
minimatch CVE-2026-27903 HIGH minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 3.1.2 - -
minimatch CVE-2026-26996 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 9.0.4 - -
minimatch GHSA-23c5-xmqv-rm74 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 9.0.4 10.2.3 -
minimatch GHSA-3ppc-4f35-3m26 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 9.0.4 10.2.1 -
minimatch CVE-2026-27904 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 9.0.4 - -
minimatch CVE-2026-26996 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 3.1.2 - -
minimatch GHSA-7r86-cg39-jmmj HIGH minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 9.0.4 10.2.3 -
path-to-regexp GHSA-9wv6-86v2-598j HIGH path-to-regexp outputs backtracking regular expressions 6.2.2 1.9.0 -
path-to-regexp CVE-2024-45296 HIGH path-to-regexp outputs backtracking regular expressions 6.2.2 - -
path-to-regexp CVE-2026-4867 HIGH path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters 6.2.2 - -
path-to-regexp GHSA-37ch-88jc-xwx2 HIGH path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters 6.2.2 0.1.13 -
picomatch CVE-2026-33671 HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 2.3.1 - -
picomatch GHSA-c2c7-rcm5-vvqj HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 2.3.1 4.0.4 -
semver GHSA-c2qf-rxjj-qqgw HIGH semver vulnerable to Regular Expression Denial of Service 6.3.0 7.5.2 -
semver CVE-2022-25883 HIGH - 6.3.0 - -
ℹ️ Other Vulnerabilities (22)
Package CVE Severity Summary Unsafe Version Fixed In Case
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 1.1.11 - -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 2.0.1 5.0.5 -
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 2.0.1 - -
brace-expansion GHSA-q2hr-2g5m-vwhr MODERATE brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service 2.0.1 5.0.12 -
brace-expansion CVE-2026-102277 MODERATE brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service 2.0.1 - -
brace-expansion CVE-2026-102277 MODERATE brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service 1.1.11 - -
brace-expansion GHSA-q2hr-2g5m-vwhr MODERATE brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service 1.1.11 5.0.12 -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 1.1.11 5.0.5 -
js-yaml CVE-2026-53550 MODERATE js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases 4.1.0 - -
js-yaml CVE-2025-64718 MODERATE js-yaml has prototype pollution in merge (<<) 3.14.1 - -
js-yaml CVE-2026-53550 MODERATE js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases 3.14.1 - -
js-yaml GHSA-mh29-5h37-fv8m MODERATE js-yaml has prototype pollution in merge (<<) 4.1.0 4.1.1 -
js-yaml CVE-2025-64718 MODERATE js-yaml has prototype pollution in merge (<<) 4.1.0 - -
js-yaml GHSA-h67p-54hq-rp68 MODERATE JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases 4.1.0 4.2.0 -
js-yaml GHSA-mh29-5h37-fv8m MODERATE js-yaml has prototype pollution in merge (<<) 3.14.1 4.1.1 -
js-yaml GHSA-h67p-54hq-rp68 MODERATE JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases 3.14.1 4.2.0 -
picomatch GHSA-3v7f-55p6-f55p MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 2.3.1 4.0.4 -
picomatch CVE-2026-33672 MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 2.3.1 - -
brace-expansion CVE-2025-5889 LOW juliangruber brace-expansion index.js expand redos 2.0.1 - -
brace-expansion GHSA-v6h2-p8h4-qcjw LOW brace-expansion Regular Expression Denial of Service vulnerability 1.1.11 2.0.2 -
brace-expansion CVE-2025-5889 LOW juliangruber brace-expansion index.js expand redos 1.1.11 - -
brace-expansion GHSA-v6h2-p8h4-qcjw LOW brace-expansion Regular Expression Denial of Service vulnerability 2.0.1 2.0.2 -

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

@dd-octo-sts
dd-octo-sts Bot marked this pull request as ready for review October 19, 2026 19:36
@dd-prapprover-prod-77c48c

dd-prapprover-prod-77c48c Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

  • ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-10-23T20:49:21Z
  • ✅ CI tests passed - 2026-10-23T20:49:26Z
  • ✅ Approved (commit: 31e2c33) - 2026-10-23T20:49:28Z
  • ✅ Merge Started
  • ⬜ Merged

➡️ Current phase: merge in progress...

dd-prapprover-prod-77c48c[bot]
dd-prapprover-prod-77c48c Bot approved these changes Oct 19, 2026
View reviewed changes

@dd-prapprover-prod-77c48c dd-prapprover-prod-77c48c Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR has been automatically approved by the DD PR Approver bot.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dd-prapprover-prod-77c48c dd-prapprover-prod-77c48c[bot] dd-prapprover-prod-77c48c[bot] approved these changes

Assignees

No one assigned

Labels

adms-critical-severity adms-dependency-update adms-high-severity adms-low-severity adms-medium-severity adms-minor-update adms-mode-all-vulns adms-npm bot_family:adms-dependency-update campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants