Skip to content

fix(deps): vuln minor upgrades — 11 packages (minor: 4 · patch: 7) [package.json] - #301

Merged
simaoseica-dd merged 2 commits into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/0-1791183296
Oct 13, 2026
Merged

simaoseica-dd merged 2 commits into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/0-1791183296

Conversation

@gh-worker-campaigns-3e9aa4

Copy link
Copy Markdown
Contributor

⚠️ One or more lockfile regeneration steps failed. The updates listed below may not all have been applied — verify against the diff before merging. Package counts and totals reflect what was attempted, not what landed. See the engraver logs for details.

Summary: High-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

  • package.json (yarn)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.


Updates

Package From To Type Dep Type Vulnerabilities Fixed
brace-expansion 5.0.4 5.0.12 patch Transitive 10 HIGH, 6 MEDIUM
brace-expansion 2.0.1 2.1.7 minor Transitive 10 HIGH, 4 MEDIUM, 2 LOW
brace-expansion 1.1.11 1.1.21 patch Transitive 10 HIGH, 4 MEDIUM, 2 LOW
minimatch 9.0.5 9.0.9 patch Transitive 6 HIGH
js-yaml 3.14.2 3.15.2 minor Transitive 5 HIGH, 2 MEDIUM
js-yaml 4.1.1 4.3.2 minor Direct 5 HIGH, 2 MEDIUM
fast-uri 3.1.6 3.1.8 patch Transitive 4 HIGH, 2 MEDIUM
browserslist 4.24.4 4.29.3 minor Transitive 4 HIGH
picomatch 2.3.1 2.3.2 patch Transitive 2 HIGH, 2 MEDIUM
picomatch 4.0.3 4.0.7 patch Transitive 2 HIGH, 2 MEDIUM
undici 6.28.0 6.28.1 patch Transitive 2 HIGH, 2 MEDIUM, 2 LOW
form-data 4.0.5 4.0.6 patch Transitive 2 HIGH
ajv 8.17.1 8.20.0 minor Transitive 2 MEDIUM
@humanfs/node 0.16.7 0.16.8 patch Transitive 1 MEDIUM
@babel/core 7.28.3 7.28.6 patch Transitive 2 LOW

Security Details

🚨 Critical & High Severity (62 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
brace-expansion GHSA-qhr7-859c-m2p7 HIGH brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion 1.1.11 5.0.11 -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 1.1.11 - -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 2.0.1 5.0.8 -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 2.0.1 - -
brace-expansion GHSA-6j4f-fj2g-mc7p HIGH brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion 2.0.1 5.0.10 -
brace-expansion CVE-2026-102276 HIGH brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion 2.0.1 - -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 1.1.11 1.1.18 -
brace-expansion CVE-2026-102276 HIGH brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion 1.1.11 - -
brace-expansion GHSA-6j4f-fj2g-mc7p HIGH brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion 1.1.11 5.0.10 -
brace-expansion CVE-2026-102278 HIGH brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion 1.1.11 - -
brace-expansion CVE-2026-102276 HIGH brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion 5.0.4 - -
brace-expansion CVE-2026-13149 HIGH - 2.0.1 - -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 2.0.1 1.1.18 -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 2.0.1 - -
brace-expansion GHSA-qhr7-859c-m2p7 HIGH brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion 2.0.1 5.0.11 -
brace-expansion CVE-2026-102278 HIGH brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion 2.0.1 - -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 1.1.11 - -
brace-expansion GHSA-6j4f-fj2g-mc7p HIGH brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion 5.0.4 5.0.10 -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 2.0.1 5.0.7 -
brace-expansion GHSA-qhr7-859c-m2p7 HIGH brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion 5.0.4 5.0.11 -
brace-expansion CVE-2026-102278 HIGH brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion 5.0.4 - -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 5.0.4 1.1.18 -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 1.1.11 5.0.8 -
brace-expansion CVE-2026-13149 HIGH - 1.1.11 - -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 1.1.11 5.0.7 -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 5.0.4 - -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 5.0.4 5.0.8 -
brace-expansion CVE-2026-13149 HIGH - 5.0.4 - -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 5.0.4 5.0.7 -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 5.0.4 - -
browserslist CVE-2026-73089 HIGH Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM 4.24.4 - -
browserslist GHSA-c83g-rgw3-j3cx HIGH Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM 4.24.4 4.28.7 -
browserslist CVE-2026-73088 HIGH Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) 4.24.4 - -
browserslist GHSA-73wf-gq98-2v4g HIGH Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) 4.24.4 4.28.7 -
fast-uri CVE-2026-84292 HIGH fast-uri vulnerable to authority injection via an unvalidated port in serialize 3.1.6 - -
fast-uri CVE-2026-84394 HIGH fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority 3.1.6 - -
fast-uri GHSA-qw65-cvwx-89v3 HIGH fast-uri vulnerable to authority injection via an unvalidated port in serialize 3.1.6 2.4.6 -
fast-uri GHSA-58mr-gqgx-xq4g HIGH fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority 3.1.6 2.4.6 -
form-data GHSA-hmw2-7cc7-3qxx HIGH form-data: CRLF injection in form-data via unescaped multipart field names and filenames 4.0.5 2.5.6 -
form-data CVE-2026-12143 HIGH form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) 4.0.5 - -
js-yaml GHSA-5p4m-2wfm-xmqj HIGH JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported 3.14.2 4.3.1 -
js-yaml GHSA-5p4m-2wfm-xmqj HIGH JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported 4.1.1 4.3.1 -
js-yaml GHSA-2883-xcg3-v3hh HIGH js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources 3.14.2 4.3.2 -
js-yaml CVE-2026-84375 HIGH js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources 3.14.2 - -
js-yaml GHSA-52cp-r559-cp3m HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 3.14.2 3.15.0 -
js-yaml CVE-2026-84375 HIGH js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources 4.1.1 - -
js-yaml GHSA-2883-xcg3-v3hh HIGH js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources 4.1.1 4.3.2 -
js-yaml CVE-2026-59869 HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 4.1.1 - -
js-yaml GHSA-52cp-r559-cp3m HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 4.1.1 3.15.0 -
js-yaml CVE-2026-59869 HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 3.14.2 - -
minimatch GHSA-7r86-cg39-jmmj HIGH minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 9.0.5 10.2.3 -
minimatch CVE-2026-27903 HIGH minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 9.0.5 - -
minimatch GHSA-3ppc-4f35-3m26 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 9.0.5 10.2.1 -
minimatch CVE-2026-26996 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 9.0.5 - -
minimatch GHSA-23c5-xmqv-rm74 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 9.0.5 10.2.3 -
minimatch CVE-2026-27904 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 9.0.5 - -
picomatch CVE-2026-33671 HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 4.0.3 - -
picomatch GHSA-c2c7-rcm5-vvqj HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 2.3.1 4.0.4 -
picomatch CVE-2026-33671 HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 2.3.1 - -
picomatch GHSA-c2c7-rcm5-vvqj HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 4.0.3 4.0.4 -
undici GHSA-rfgv-xxqx-mfg5 HIGH undici vulnerable to Denial of Service via unrequested WebSocket subprotocol 6.28.0 6.28.1 -
undici CVE-2026-19534 HIGH undici vulnerable to Denial of Service via unrequested WebSocket subprotocol 6.28.0 - -
ℹ️ Other Vulnerabilities (37)
Package CVE Severity Summary Unsafe Version Fixed In Case
@humanfs/node GHSA-p498-v437-472g MODERATE humanfs: Recursive copy follows symlinked files and copies data from outside the source tree 0.16.7 0.16.8 -
ajv CVE-2025-69873 MODERATE - 8.17.1 - -
ajv GHSA-2g4f-4pwh-qvx6 MODERATE ajv has ReDoS when using $data option 8.17.1 8.18.0 -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 1.1.11 5.0.5 -
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 1.1.11 - -
brace-expansion GHSA-q2hr-2g5m-vwhr MODERATE brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service 2.0.1 5.0.12 -
brace-expansion GHSA-q2hr-2g5m-vwhr MODERATE brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service 5.0.4 5.0.12 -
brace-expansion CVE-2026-102277 MODERATE brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service 5.0.4 - -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 2.0.1 5.0.5 -
brace-expansion GHSA-jxxr-4gwj-5jf2 MODERATE brace-expansion: Large numeric range defeats documented max DoS protection 5.0.4 5.0.6 -
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 2.0.1 - -
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 5.0.4 - -
brace-expansion CVE-2026-102277 MODERATE brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service 2.0.1 - -
brace-expansion GHSA-q2hr-2g5m-vwhr MODERATE brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service 1.1.11 5.0.12 -
brace-expansion CVE-2026-102277 MODERATE brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service 1.1.11 - -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 5.0.4 5.0.5 -
brace-expansion CVE-2026-45149 MODERATE brace-expansion: Large numeric range defeats documented max DoS protection 5.0.4 - -
fast-uri CVE-2026-86472 MODERATE fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets 3.1.6 - -
fast-uri GHSA-hrr3-gc8f-f4qj MODERATE fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets 3.1.6 2.4.7 -
js-yaml CVE-2026-53550 MODERATE js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases 4.1.1 - -
js-yaml CVE-2026-53550 MODERATE js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases 3.14.2 - -
js-yaml GHSA-h67p-54hq-rp68 MODERATE JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases 3.14.2 4.2.0 -
js-yaml GHSA-h67p-54hq-rp68 MODERATE JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases 4.1.1 4.2.0 -
picomatch GHSA-3v7f-55p6-f55p MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 2.3.1 4.0.4 -
picomatch CVE-2026-33672 MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 2.3.1 - -
picomatch GHSA-3v7f-55p6-f55p MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 4.0.3 4.0.4 -
picomatch CVE-2026-33672 MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 4.0.3 - -
undici GHSA-3wwx-pv8p-q78v MODERATE undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression 6.28.0 6.28.1 -
undici CVE-2026-85024 MODERATE undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression 6.28.0 - -
@babel/core GHSA-4x5r-pxfx-6jf8 LOW @babel/core: Arbitrary File Read via sourceMappingURL Comment 7.28.3 8.0.0-rc.6 -
@babel/core CVE-2026-49356 LOW Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/core 7.28.3 - -
brace-expansion GHSA-v6h2-p8h4-qcjw LOW brace-expansion Regular Expression Denial of Service vulnerability 2.0.1 2.0.2 -
brace-expansion GHSA-v6h2-p8h4-qcjw LOW brace-expansion Regular Expression Denial of Service vulnerability 1.1.11 2.0.2 -
brace-expansion CVE-2025-5889 LOW juliangruber brace-expansion index.js expand redos 2.0.1 - -
brace-expansion CVE-2025-5889 LOW juliangruber brace-expansion index.js expand redos 1.1.11 - -
undici CVE-2026-18540 LOW undici vulnerable to downstream response splitting via retry interceptor 6.28.0 - -
undici GHSA-r53p-7pc4-xj5r LOW undici vulnerable to downstream response splitting via retry interceptor 6.28.0 6.28.1 -

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

@gh-worker-campaigns-3e9aa4

Copy link
Copy Markdown
Contributor Author

Auto-rebase failed

Lockfile regeneration failed during rebase onto main. Your branch was not updated. You may need to rebase and regenerate lockfiles manually.

Error details

child workflow execution error (type: engraver.Engraver_AllManagersWorkflow, workflowID: 01a1305d-5e10-728b-9d6d-03b2ee677df8_75, runID: 01a1305d-8c20-7a8f-9220-436d0170cd1a, initiatedEventID: 75, startedEventID: 76): custom action(s) failed and produced no changes: [registry.ddbuild.io/images/engraver-custom-action:update-yarn-lockfile]


Auto-Rebase · Add no-auto-rebase to opt out

@simaoseica-dd
simaoseica-dd force-pushed the engraver-auto-version-upgrade/minorpatch/npm/0-1791183296 branch from 68f305e to 49f2495 Compare October 12, 2026 19:14
@simaoseica-dd
simaoseica-dd marked this pull request as ready for review October 12, 2026 19:14
@simaoseica-dd
simaoseica-dd requested a review from a team as a code owner October 12, 2026 19:14
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 12, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-12T20:29:30.798531Z d812b5c New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 49f24957c5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread package.json
Comment thread package.json Outdated
@simaoseica-dd
simaoseica-dd force-pushed the engraver-auto-version-upgrade/minorpatch/npm/0-1791183296 branch from 49f2495 to 63dd9fa Compare October 12, 2026 19:23
simaoseica-dd
simaoseica-dd previously approved these changes Oct 12, 2026

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 63dd9fae60

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread package.json Outdated
Comment thread package.json Outdated
- Refresh affected transitive dependencies and remove sprintf-js
- Bundle glob separately to use patched dependencies
- Keep humanfs within ESLint's supported 0.16.x range
- Regenerate the lockfile and distributable bundles
@simaoseica-dd
simaoseica-dd merged commit 94769d0 into main Oct 13, 2026
6 checks passed
@simaoseica-dd
simaoseica-dd deleted the engraver-auto-version-upgrade/minorpatch/npm/0-1791183296 branch October 13, 2026 08:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants