fix(deps): vuln minor upgrades — 12 packages (minor: 8 · patch: 4) [package.json]

[gh-worker-campaigns-3e9aa4]

Summary: Critical-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

• package.json (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
handlebars	4.7.8	4.7.9	patch	Transitive	2 CRITICAL, 8 HIGH, 3 MEDIUM, 1 LOW
basic-ftp	5.0.5	5.3.1	minor	Transitive	2 CRITICAL, 5 HIGH
fast-uri	3.0.6	3.1.6	minor	Transitive	10 HIGH
undici	6.23.0	6.28.0	minor	Transitive	8 HIGH, 12 MEDIUM, 4 LOW
brace-expansion	5.0.4	5.0.9	patch	Transitive	6 HIGH, 4 MEDIUM
brace-expansion	2.0.1	2.1.4	minor	Transitive	6 HIGH, 2 MEDIUM, 2 LOW
brace-expansion	1.1.11	1.1.18	patch	Transitive	6 HIGH, 2 MEDIUM, 2 LOW
minimatch	9.0.5	9.0.9	patch	Transitive	6 HIGH
lodash	4.17.21	4.18.1	minor	Transitive	4 HIGH, 4 MEDIUM
flatted	3.3.3	3.4.4	minor	Transitive	4 HIGH
js-yaml	3.14.2	3.15.2	minor	Transitive	3 HIGH, 2 MEDIUM
axios	1.16.0	1.20.0	minor	Direct	2 HIGH, 18 MEDIUM
fast-xml-parser	5.5.1	5.11.1	minor	Transitive	2 HIGH, 4 MEDIUM
picomatch	2.3.1	2.3.2	patch	Transitive	2 HIGH, 2 MEDIUM
picomatch	4.0.3	4.0.7	patch	Transitive	2 HIGH, 2 MEDIUM

---

Security Details

🚨 Critical & High Severity (78 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
basic-ftp	CVE-2026-27699	CRITICAL	Basic FTP has Path Traversal Vulnerability in its downloadToDir() method	5.0.5	-	-
basic-ftp	GHSA-5rq4-664w-9x2c	CRITICAL	Basic FTP has Path Traversal Vulnerability in its downloadToDir() method	5.0.5	5.2.0	-
handlebars	GHSA-2w6w-674q-4c4q	CRITICAL	Handlebars.js has JavaScript Injection via AST Type Confusion	4.7.8	4.7.9	-
handlebars	CVE-2026-33937	CRITICAL	Handlebars.js has JavaScript Injection via AST Type Confusion	4.7.8	-	-
axios	GHSA-gcfj-64vw-6mp9	HIGH	Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning	1.16.0	0.33.0	-
axios	CVE-2026-67320	HIGH	axios before 0.33.0 Prototype Pollution via Node HTTP adapter	1.16.0	-	-
basic-ftp	GHSA-6v7q-wjvx-w8wg	HIGH	basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands	5.0.5	5.2.2	-
basic-ftp	CVE-2026-41324	HIGH	basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()	5.0.5	-	-
basic-ftp	GHSA-rp42-5vxx-qpwr	HIGH	basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()	5.0.5	5.3.0	-
basic-ftp	CVE-2026-44240	HIGH	basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering	5.0.5	-	-
basic-ftp	GHSA-rpmf-866q-6p89	HIGH	basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering	5.0.5	5.3.1	-
brace-expansion	GHSA-rgw5-rvv9-x895	HIGH	brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation	2.0.1	1.1.18	-
brace-expansion	GHSA-3jxr-9vmj-r5cp	HIGH	brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups	1.1.11	5.0.7	-
brace-expansion	CVE-2026-13149	HIGH	-	5.0.4	-	-
brace-expansion	CVE-2026-13149	HIGH	-	2.0.1	-	-
brace-expansion	GHSA-3jxr-9vmj-r5cp	HIGH	brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups	5.0.4	5.0.7	-
brace-expansion	CVE-2026-14257	HIGH	brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash	5.0.4	-	-
brace-expansion	GHSA-3jxr-9vmj-r5cp	HIGH	brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups	2.0.1	5.0.7	-
brace-expansion	GHSA-rgw5-rvv9-x895	HIGH	brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation	5.0.4	1.1.18	-
brace-expansion	CVE-2026-14257	HIGH	brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash	2.0.1	-	-
brace-expansion	CVE-2026-69152	HIGH	brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation	5.0.4	-	-
brace-expansion	GHSA-mh99-v99m-4gvg	HIGH	brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash	5.0.4	5.0.8	-
brace-expansion	CVE-2026-14257	HIGH	brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash	1.1.11	-	-
brace-expansion	GHSA-mh99-v99m-4gvg	HIGH	brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash	1.1.11	5.0.8	-
brace-expansion	CVE-2026-69152	HIGH	brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation	1.1.11	-	-
brace-expansion	GHSA-rgw5-rvv9-x895	HIGH	brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation	1.1.11	1.1.18	-
brace-expansion	CVE-2026-13149	HIGH	-	1.1.11	-	-
brace-expansion	GHSA-mh99-v99m-4gvg	HIGH	brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash	2.0.1	5.0.8	-
brace-expansion	CVE-2026-69152	HIGH	brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation	2.0.1	-	-
fast-uri	CVE-2026-16221	HIGH	fast-uri vulnerable to host confusion via literal backslash authority delimiter	3.0.6	-	-
fast-uri	GHSA-7p8r-x3mc-p8w7	HIGH	fast-uri vulnerable to host confusion via backslash authority introducer	3.0.6	2.4.4	-
fast-uri	CVE-2026-6322	HIGH	fast-uri vulnerable to host confusion via percent-encoded authority delimiters	3.0.6	-	-
fast-uri	CVE-2026-18446	HIGH	fast-uri vulnerable to host confusion via backslash authority introducer	3.0.6	-	-
fast-uri	GHSA-v39h-62p7-jpjc	HIGH	fast-uri vulnerable to host confusion via percent-encoded authority delimiters	3.0.6	3.1.2	-
fast-uri	GHSA-v2hh-gcrm-f6hx	HIGH	fast-uri vulnerable to host confusion via literal backslash authority delimiter	3.0.6	2.4.3	-
fast-uri	GHSA-4c8g-83qw-93j6	HIGH	fast-uri vulnerable to host confusion via failed IDN canonicalization	3.0.6	4.0.1	-
fast-uri	CVE-2026-13676	HIGH	fast-uri vulnerable to host confusion via failed IDN canonicalization	3.0.6	-	-
fast-uri	GHSA-q3j6-qgpj-74h6	HIGH	fast-uri vulnerable to path traversal via percent-encoded dot segments	3.0.6	3.1.1	-
fast-uri	CVE-2026-6321	HIGH	fast-uri vulnerable to path traversal via percent-encoded dot segments	3.0.6	-	-
fast-xml-parser	GHSA-8gc5-j5rx-235r	HIGH	fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)	5.5.1	5.5.6	-
fast-xml-parser	CVE-2026-33036	HIGH	fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)	5.5.1	-	-
flatted	CVE-2026-32141	HIGH	flatted: Unbounded recursion DoS in parse() revive phase	3.3.3	-	-
flatted	GHSA-25h7-pfq9-p65f	HIGH	flatted vulnerable to unbounded recursion DoS in parse() revive phase	3.3.3	3.4.0	-
flatted	CVE-2026-33228	HIGH	flatted: Prototype Pollution via parse()	3.3.3	-	-
flatted	GHSA-rf6f-7fwh-wjgh	HIGH	Prototype Pollution via parse() in NodeJS flatted	3.3.3	3.4.2	-
handlebars	CVE-2026-33938	HIGH	Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block	4.7.8	-	-
handlebars	GHSA-xhpv-hc6g-r9c6	HIGH	Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial	4.7.8	4.7.9	-
handlebars	GHSA-9cx6-37pm-9jff	HIGH	Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation	4.7.8	4.7.9	-
handlebars	GHSA-3mfm-83xf-c92r	HIGH	Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block	4.7.8	4.7.9	-
handlebars	CVE-2026-33939	HIGH	Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation	4.7.8	-	-
handlebars	CVE-2026-33940	HIGH	Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial	4.7.8	-	-
handlebars	GHSA-xjpj-3mr7-gcpf	HIGH	Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options	4.7.8	4.7.9	-
handlebars	CVE-2026-33941	HIGH	Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options	4.7.8	-	-
js-yaml	GHSA-52cp-r559-cp3m	HIGH	js-yaml: YAML merge-key chains can force quadratic CPU consumption	3.14.2	3.15.0	-
js-yaml	GHSA-5p4m-2wfm-xmqj	HIGH	JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported	3.14.2	4.3.1	-
js-yaml	CVE-2026-59869	HIGH	js-yaml: YAML merge-key chains can force quadratic CPU consumption	3.14.2	-	-
lodash	GHSA-r5fr-rjxr-66jc	HIGH	lodash vulnerable to Code Injection via _.template imports key names	4.17.21	4.18.0	-
lodash	CVE-2026-4800	HIGH	lodash vulnerable to Code Injection via _.template imports key names	4.17.21	-	-
lodash	GHSA-35jh-r3h4-6jhm	HIGH	Command Injection in lodash	4.17.21	4.17.21	-
lodash	CVE-2021-23337	HIGH	-	4.17.21	-	-
minimatch	GHSA-7r86-cg39-jmmj	HIGH	minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	9.0.5	10.2.3	-
minimatch	CVE-2026-27903	HIGH	minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	9.0.5	-	-
minimatch	CVE-2026-27904	HIGH	minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	9.0.5	-	-
minimatch	GHSA-23c5-xmqv-rm74	HIGH	minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	9.0.5	10.2.3	-
minimatch	CVE-2026-26996	HIGH	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	9.0.5	-	-
minimatch	GHSA-3ppc-4f35-3m26	HIGH	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	9.0.5	10.2.1	-
picomatch	GHSA-c2c7-rcm5-vvqj	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	2.3.1	4.0.4	-
picomatch	CVE-2026-33671	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	2.3.1	-	-
picomatch	GHSA-c2c7-rcm5-vvqj	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	4.0.3	4.0.4	-
picomatch	CVE-2026-33671	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	4.0.3	-	-
undici	GHSA-v9p9-hfj2-hcw8	HIGH	Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation	6.23.0	6.24.0	-
undici	GHSA-f269-vfmq-vjvj	HIGH	Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client	6.23.0	6.24.0	-
undici	CVE-2026-2229	HIGH	undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation	6.23.0	-	-
undici	CVE-2026-1526	HIGH	undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression	6.23.0	-	-
undici	GHSA-vrm6-8vpv-qv8q	HIGH	Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression	6.23.0	6.24.0	-
undici	CVE-2026-1528	HIGH	undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client	6.23.0	-	-
undici	GHSA-vxpw-j846-p89q	HIGH	undici WebSocket client vulnerable to denial of service via fragment count bypass	6.23.0	6.27.0	-
undici	CVE-2026-12151	HIGH	undici WebSocket client vulnerable to denial of service via fragment count bypass	6.23.0	-	-

ℹ️ Other Vulnerabilities (64)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
axios	CVE-2026-67321	MODERATE	axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass	1.16.0	-	-
axios	CVE-2026-67314	MODERATE	axios before 1.18.0 Prototype Pollution via auth subfields	1.16.0	-	-
axios	CVE-2026-67317	MODERATE	axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream	1.16.0	-	-
axios	GHSA-7q8q-rj6j-mhjq	MODERATE	Axios: Nested axios option objects can consume polluted prototype values	1.16.0	0.33.0	-
axios	CVE-2026-67313	MODERATE	axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON	1.16.0	-	-
axios	GHSA-hcpx-6fm6-wx23	MODERATE	Axios form serializer maxDepth bypass via {} metatoken	1.16.0	0.33.0	-
axios	GHSA-42h9-826w-cgv3	MODERATE	Axios: Excessive recursion in formDataToJSON can cause denial of service	1.16.0	0.33.0	-
axios	GHSA-jqh4-m9w3-8hp9	MODERATE	Axios: Fetch adapter ReadableStream uploads bypass maxBodyLength	1.16.0	1.18.0	-
axios	CVE-2026-67319	MODERATE	axios before 0.33.0 Prototype Pollution via nested option objects	1.16.0	-	-
axios	GHSA-f4gw-2p7v-4548	MODERATE	Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios	1.16.0	1.18.0	-
axios	CVE-2026-67315	MODERATE	axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0	1.16.0	-	-
axios	GHSA-pmv8-rq9r-6j72	MODERATE	Axios: Deep formToJSON Key Recursion Can Cause Denial of Service	1.16.0	0.33.0	-
axios	CVE-2026-67312	MODERATE	axios 0.28.0 before 0.33.0 Denial of Service via formToJSON	1.16.0	-	-
axios	GHSA-mwf2-3pr3-8698	MODERATE	Axios: HTTP/2 streamed uploads bypass maxBodyLength	1.16.0	1.18.0	-
axios	CVE-2026-67318	MODERATE	axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2	1.16.0	-	-
axios	GHSA-mmx7-hfxf-jppx	MODERATE	Axios: Prototype pollution gadgets can alter axios request construction	1.16.0	1.18.0	-
axios	CVE-2026-67316	MODERATE	axios before 1.18.0 Prototype Pollution via bodyless methods	1.16.0	-	-
axios	GHSA-xj6q-8x83-jv6g	MODERATE	Axios: Prototype pollution auth subfields can inject Basic auth	1.16.0	1.18.0	-
brace-expansion	GHSA-jxxr-4gwj-5jf2	MODERATE	brace-expansion: Large numeric range defeats documented max DoS protection	5.0.4	5.0.6	-
brace-expansion	CVE-2026-33750	MODERATE	brace-expansion: Zero-step sequence causes process hang and memory exhaustion	1.1.11	-	-
brace-expansion	GHSA-f886-m6hf-6m8v	MODERATE	brace-expansion: Zero-step sequence causes process hang and memory exhaustion	5.0.4	5.0.5	-
brace-expansion	CVE-2026-33750	MODERATE	brace-expansion: Zero-step sequence causes process hang and memory exhaustion	2.0.1	-	-
brace-expansion	CVE-2026-33750	MODERATE	brace-expansion: Zero-step sequence causes process hang and memory exhaustion	5.0.4	-	-
brace-expansion	GHSA-f886-m6hf-6m8v	MODERATE	brace-expansion: Zero-step sequence causes process hang and memory exhaustion	2.0.1	5.0.5	-
brace-expansion	GHSA-f886-m6hf-6m8v	MODERATE	brace-expansion: Zero-step sequence causes process hang and memory exhaustion	1.1.11	5.0.5	-
brace-expansion	CVE-2026-45149	MODERATE	brace-expansion: Large numeric range defeats documented max DoS protection	5.0.4	-	-
fast-xml-parser	GHSA-jp2q-39xq-3w4g	MODERATE	Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser	5.5.1	4.5.5	-
fast-xml-parser	CVE-2026-41650	MODERATE	fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters	5.5.1	-	-
fast-xml-parser	GHSA-gh4j-gqv2-49f6	MODERATE	fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters	5.5.1	5.7.0	-
fast-xml-parser	CVE-2026-33349	MODERATE	fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation	5.5.1	-	-
handlebars	GHSA-2qvq-rjwj-gvw9	MODERATE	Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection	4.7.8	4.7.9	-
handlebars	GHSA-7rx3-28cr-v5wh	MODERATE	Handlebars.js has a Prototype Method Access Control Gap via Missing lookupSetter Blocklist Entry	4.7.8	4.7.9	-
handlebars	CVE-2026-33916	MODERATE	Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection	4.7.8	-	-
js-yaml	CVE-2026-53550	MODERATE	js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases	3.14.2	-	-
js-yaml	GHSA-h67p-54hq-rp68	MODERATE	JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases	3.14.2	4.2.0	-
lodash	GHSA-f23m-r3pf-42rh	MODERATE	lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit	4.17.21	4.18.0	-
lodash	CVE-2025-13465	MODERATE	Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions	4.17.21	-	-
lodash	CVE-2026-2950	MODERATE	lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit	4.17.21	-	-
lodash	GHSA-xxjr-mmjv-4gpg	MODERATE	Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions	4.17.21	4.17.23	-
picomatch	GHSA-3v7f-55p6-f55p	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	4.0.3	4.0.4	-
picomatch	CVE-2026-33672	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	2.3.1	-	-
picomatch	CVE-2026-33672	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	4.0.3	-	-
picomatch	GHSA-3v7f-55p6-f55p	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	2.3.1	4.0.4	-
undici	CVE-2026-16729	MODERATE	undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields	6.23.0	-	-
undici	GHSA-8xcm-r25x-g524	MODERATE	undici vulnerable to downstream response desynchronization via retry interceptor	6.23.0	6.28.0	-
undici	GHSA-2mjp-6q6p-2qxm	MODERATE	Undici has an HTTP Request/Response Smuggling issue	6.23.0	6.24.0	-
undici	CVE-2026-1525	MODERATE	undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')	6.23.0	-	-
undici	GHSA-4992-7rv2-5pvq	MODERATE	Undici has CRLF Injection in undici via upgrade option	6.23.0	6.24.0	-
undici	CVE-2026-1527	MODERATE	undici is vulnerable to CRLF Injection via upgrade option	6.23.0	-	-
undici	GHSA-p88m-4jfj-68fv	MODERATE	undici vulnerable to HTTP header injection via Set-Cookie percent-decoding	6.23.0	6.27.0	-
undici	CVE-2026-15157	MODERATE	undici vulnerable to CRLF Injection via blob-like body 'type' property	6.23.0	-	-
undici	GHSA-m8rv-5g2x-5cg5	MODERATE	undici vulnerable to CRLF Injection via blob-like body 'type' property	6.23.0	6.28.0	-
undici	CVE-2026-16728	MODERATE	undici vulnerable to downstream response desynchronization via retry interceptor	6.23.0	-	-
undici	GHSA-v3r7-h72x-cjcm	MODERATE	undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields	6.23.0	6.28.0	-
undici	CVE-2026-9679	MODERATE	undici vulnerable to HTTP header injection via Set-Cookie percent-decoding	6.23.0	-	-
brace-expansion	GHSA-v6h2-p8h4-qcjw	LOW	brace-expansion Regular Expression Denial of Service vulnerability	1.1.11	2.0.2	-
brace-expansion	CVE-2025-5889	LOW	juliangruber brace-expansion index.js expand redos	1.1.11	-	-
brace-expansion	CVE-2025-5889	LOW	juliangruber brace-expansion index.js expand redos	2.0.1	-	-
brace-expansion	GHSA-v6h2-p8h4-qcjw	LOW	brace-expansion Regular Expression Denial of Service vulnerability	2.0.1	2.0.2	-
handlebars	GHSA-442j-39wm-28r2	LOW	Handlebars.js has a Property Access Validation Bypass in container.lookup	4.7.8	4.7.9	-
undici	GHSA-g8m3-5g58-fq7m	LOW	undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching	6.23.0	6.27.0	-
undici	CVE-2026-6733	LOW	undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse	6.23.0	-	-
undici	GHSA-35p6-xmwp-9g52	LOW	undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse	6.23.0	6.27.0	-
undici	CVE-2026-11525	LOW	undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching	6.23.0	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[dd-prapprover-prod-77c48c]

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

• ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-08-31T19:25:04Z
• ✅ CI tests passed - 2026-08-31T19:25:07Z
• ✅ Approved (commit: d156be2) - 2026-08-31T19:25:10Z
• ✅ Merge Started
• ✅ Merged - 2026-08-31T19:25:28Z

➡️ Current phase: PR merged successfully! ✅

[dd-prapprover-prod-77c48c]

This PR has been automatically approved by the DD PR Approver bot.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d156be2fa1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Upgrade the Axios copy that the action bundles

This raises only the unused top-level Axios descriptor: yarn.lock still resolves the axios@^1.13.5 dependency imported by the Datadog packages to 1.16.0, and the regenerated dist/index.js likewise contains VERSION = "1.16.0" with no 1.20.0 implementation. Consequently, when the action performs Datadog upload requests, it continues running the vulnerable Axios version this security commit intends to replace while adding an unused second copy; update/override the transitive descriptor so the bundled implementation is actually 1.20.0.

Useful? React with 👍 / 👎.