Skip to content

fix(deps): vuln minor upgrades — 12 packages (minor: 8 · patch: 4) - #293

Draft
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/0-1785769467
Draft

fix(deps): vuln minor upgrades — 12 packages (minor: 8 · patch: 4) #293
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/0-1785769467

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

Summary: Critical-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

  • . (yarn)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
handlebars 4.7.8 4.7.9 patch Transitive 2 CRITICAL, 8 HIGH, 3 MEDIUM, 1 LOW
basic-ftp 5.0.5 5.3.1 minor Transitive 2 CRITICAL, 5 HIGH
undici 6.23.0 6.28.0 minor Transitive 8 HIGH, 6 MEDIUM, 4 LOW
fast-uri 3.0.6 3.1.5 minor Transitive 8 HIGH
minimatch 9.0.5 9.0.9 patch Transitive 6 HIGH
lodash 4.17.21 4.18.1 minor Transitive 4 HIGH, 4 MEDIUM
brace-expansion 5.0.4 5.0.9 patch Transitive 4 HIGH, 4 MEDIUM
brace-expansion 2.0.1 2.1.4 minor Transitive 4 HIGH, 2 MEDIUM, 2 LOW
brace-expansion 1.1.11 1.1.18 patch Transitive 4 HIGH, 2 MEDIUM, 2 LOW
flatted 3.3.3 3.4.4 minor Transitive 4 HIGH
axios 1.16.0 1.19.0 minor Direct 2 HIGH, 18 MEDIUM
fast-xml-parser 5.5.1 5.10.1 minor Transitive 2 HIGH, 4 MEDIUM
js-yaml 3.14.2 3.15.1 minor Transitive 2 HIGH, 2 MEDIUM
picomatch 2.3.1 2.3.2 patch Transitive 2 HIGH, 2 MEDIUM
picomatch 4.0.3 4.0.5 patch Transitive 2 HIGH, 2 MEDIUM

Security Details

🚨 Critical & High Severity (69 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
basic-ftp CVE-2026-27699 CRITICAL Basic FTP has Path Traversal Vulnerability in its downloadToDir() method 5.0.5 - -
basic-ftp GHSA-5rq4-664w-9x2c CRITICAL Basic FTP has Path Traversal Vulnerability in its downloadToDir() method 5.0.5 5.2.0 -
handlebars CVE-2026-33937 CRITICAL Handlebars.js has JavaScript Injection via AST Type Confusion 4.7.8 - -
handlebars GHSA-2w6w-674q-4c4q CRITICAL Handlebars.js has JavaScript Injection via AST Type Confusion 4.7.8 4.7.9 -
axios GHSA-gcfj-64vw-6mp9 HIGH Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning 1.16.0 0.33.0 -
axios CVE-2026-67320 HIGH axios before 0.33.0 Prototype Pollution via Node HTTP adapter 1.16.0 - -
basic-ftp GHSA-rpmf-866q-6p89 HIGH basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering 5.0.5 5.3.1 -
basic-ftp CVE-2026-41324 HIGH basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() 5.0.5 - -
basic-ftp GHSA-rp42-5vxx-qpwr HIGH basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list() 5.0.5 5.3.0 -
basic-ftp GHSA-6v7q-wjvx-w8wg HIGH basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands 5.0.5 5.2.2 -
basic-ftp CVE-2026-44240 HIGH basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering 5.0.5 - -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 2.0.1 5.0.8 -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 5.0.4 5.0.8 -
brace-expansion CVE-2026-13149 HIGH - 2.0.1 - -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 2.0.1 5.0.7 -
brace-expansion CVE-2026-13149 HIGH - 1.1.11 - -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 1.1.11 5.0.7 -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 1.1.11 - -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 1.1.11 5.0.8 -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 5.0.4 - -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 2.0.1 - -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 5.0.4 5.0.7 -
brace-expansion CVE-2026-13149 HIGH - 5.0.4 - -
fast-uri CVE-2026-13676 HIGH fast-uri vulnerable to host confusion via failed IDN canonicalization 3.0.6 - -
fast-uri CVE-2026-6321 HIGH fast-uri vulnerable to path traversal via percent-encoded dot segments 3.0.6 - -
fast-uri CVE-2026-6322 HIGH fast-uri vulnerable to host confusion via percent-encoded authority delimiters 3.0.6 - -
fast-uri GHSA-v39h-62p7-jpjc HIGH fast-uri vulnerable to host confusion via percent-encoded authority delimiters 3.0.6 3.1.2 -
fast-uri GHSA-v2hh-gcrm-f6hx HIGH fast-uri vulnerable to host confusion via literal backslash authority delimiter 3.0.6 2.4.3 -
fast-uri GHSA-4c8g-83qw-93j6 HIGH fast-uri vulnerable to host confusion via failed IDN canonicalization 3.0.6 4.0.1 -
fast-uri CVE-2026-16221 HIGH fast-uri vulnerable to host confusion via literal backslash authority delimiter 3.0.6 - -
fast-uri GHSA-q3j6-qgpj-74h6 HIGH fast-uri vulnerable to path traversal via percent-encoded dot segments 3.0.6 3.1.1 -
fast-xml-parser GHSA-8gc5-j5rx-235r HIGH fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) 5.5.1 5.5.6 -
fast-xml-parser CVE-2026-33036 HIGH fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) 5.5.1 - -
flatted GHSA-25h7-pfq9-p65f HIGH flatted vulnerable to unbounded recursion DoS in parse() revive phase 3.3.3 3.4.0 -
flatted CVE-2026-32141 HIGH flatted: Unbounded recursion DoS in parse() revive phase 3.3.3 - -
flatted CVE-2026-33228 HIGH flatted: Prototype Pollution via parse() 3.3.3 - -
flatted GHSA-rf6f-7fwh-wjgh HIGH Prototype Pollution via parse() in NodeJS flatted 3.3.3 3.4.2 -
handlebars CVE-2026-33941 HIGH Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options 4.7.8 - -
handlebars GHSA-xhpv-hc6g-r9c6 HIGH Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial 4.7.8 4.7.9 -
handlebars CVE-2026-33940 HIGH Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial 4.7.8 - -
handlebars GHSA-xjpj-3mr7-gcpf HIGH Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options 4.7.8 4.7.9 -
handlebars GHSA-3mfm-83xf-c92r HIGH Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block 4.7.8 4.7.9 -
handlebars CVE-2026-33938 HIGH Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block 4.7.8 - -
handlebars GHSA-9cx6-37pm-9jff HIGH Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation 4.7.8 4.7.9 -
handlebars CVE-2026-33939 HIGH Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation 4.7.8 - -
js-yaml GHSA-52cp-r559-cp3m HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 3.14.2 3.15.0 -
js-yaml CVE-2026-59869 HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 3.14.2 - -
lodash CVE-2026-4800 HIGH lodash vulnerable to Code Injection via _.template imports key names 4.17.21 - -
lodash GHSA-r5fr-rjxr-66jc HIGH lodash vulnerable to Code Injection via _.template imports key names 4.17.21 4.18.0 -
lodash GHSA-35jh-r3h4-6jhm HIGH Command Injection in lodash 4.17.21 4.17.21 -
lodash CVE-2021-23337 HIGH - 4.17.21 - -
minimatch CVE-2026-26996 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 9.0.5 - -
minimatch CVE-2026-27903 HIGH minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 9.0.5 - -
minimatch GHSA-7r86-cg39-jmmj HIGH minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments 9.0.5 10.2.3 -
minimatch CVE-2026-27904 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 9.0.5 - -
minimatch GHSA-23c5-xmqv-rm74 HIGH minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions 9.0.5 10.2.3 -
minimatch GHSA-3ppc-4f35-3m26 HIGH minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern 9.0.5 10.2.1 -
picomatch GHSA-c2c7-rcm5-vvqj HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 2.3.1 4.0.4 -
picomatch CVE-2026-33671 HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 2.3.1 - -
picomatch GHSA-c2c7-rcm5-vvqj HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 4.0.3 4.0.4 -
picomatch CVE-2026-33671 HIGH Picomatch has a ReDoS vulnerability via extglob quantifiers 4.0.3 - -
undici CVE-2026-12151 HIGH undici WebSocket client vulnerable to denial of service via fragment count bypass 6.23.0 - -
undici GHSA-v9p9-hfj2-hcw8 HIGH Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation 6.23.0 6.24.0 -
undici CVE-2026-1526 HIGH undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression 6.23.0 - -
undici GHSA-vrm6-8vpv-qv8q HIGH Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression 6.23.0 6.24.0 -
undici GHSA-vxpw-j846-p89q HIGH undici WebSocket client vulnerable to denial of service via fragment count bypass 6.23.0 6.27.0 -
undici CVE-2026-1528 HIGH undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client 6.23.0 - -
undici GHSA-f269-vfmq-vjvj HIGH Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client 6.23.0 6.24.0 -
undici CVE-2026-2229 HIGH undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation 6.23.0 - -
ℹ️ Other Vulnerabilities (58)
Package CVE Severity Summary Unsafe Version Fixed In Case
axios GHSA-mwf2-3pr3-8698 MODERATE Axios: HTTP/2 streamed uploads bypass maxBodyLength 1.16.0 1.18.0 -
axios GHSA-7q8q-rj6j-mhjq MODERATE Axios: Nested axios option objects can consume polluted prototype values 1.16.0 0.33.0 -
axios CVE-2026-67312 MODERATE axios 0.28.0 before 0.33.0 Denial of Service via formToJSON 1.16.0 - -
axios GHSA-jqh4-m9w3-8hp9 MODERATE Axios: Fetch adapter ReadableStream uploads bypass maxBodyLength 1.16.0 1.18.0 -
axios CVE-2026-67317 MODERATE axios 1.7.0 before 1.18.0 maxBodyLength Bypass via ReadableStream 1.16.0 - -
axios GHSA-f4gw-2p7v-4548 MODERATE Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios 1.16.0 1.18.0 -
axios CVE-2026-67315 MODERATE axios 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 NO_PROXY Bypass via 0.0.0.0 1.16.0 - -
axios GHSA-xj6q-8x83-jv6g MODERATE Axios: Prototype pollution auth subfields can inject Basic auth 1.16.0 1.18.0 -
axios CVE-2026-67318 MODERATE axios 1.13.0 before 1.18.0 maxBodyLength Bypass via HTTP/2 1.16.0 - -
axios GHSA-pmv8-rq9r-6j72 MODERATE Axios: Deep formToJSON Key Recursion Can Cause Denial of Service 1.16.0 0.33.0 -
axios CVE-2026-67319 MODERATE axios before 0.33.0 Prototype Pollution via nested option objects 1.16.0 - -
axios CVE-2026-67313 MODERATE axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON 1.16.0 - -
axios GHSA-mmx7-hfxf-jppx MODERATE Axios: Prototype pollution gadgets can alter axios request construction 1.16.0 1.18.0 -
axios CVE-2026-67316 MODERATE axios before 1.18.0 Prototype Pollution via bodyless methods 1.16.0 - -
axios CVE-2026-67321 MODERATE axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass 1.16.0 - -
axios GHSA-hcpx-6fm6-wx23 MODERATE Axios form serializer maxDepth bypass via {} metatoken 1.16.0 0.33.0 -
axios CVE-2026-67314 MODERATE axios before 1.18.0 Prototype Pollution via auth subfields 1.16.0 - -
axios GHSA-42h9-826w-cgv3 MODERATE Axios: Excessive recursion in formDataToJSON can cause denial of service 1.16.0 0.33.0 -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 5.0.4 5.0.5 -
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 5.0.4 - -
brace-expansion GHSA-jxxr-4gwj-5jf2 MODERATE brace-expansion: Large numeric range defeats documented max DoS protection 5.0.4 5.0.6 -
brace-expansion CVE-2026-45149 MODERATE brace-expansion: Large numeric range defeats documented max DoS protection 5.0.4 - -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 2.0.1 5.0.5 -
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 2.0.1 - -
brace-expansion GHSA-f886-m6hf-6m8v MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 1.1.11 5.0.5 -
brace-expansion CVE-2026-33750 MODERATE brace-expansion: Zero-step sequence causes process hang and memory exhaustion 1.1.11 - -
fast-xml-parser GHSA-gh4j-gqv2-49f6 MODERATE fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters 5.5.1 5.7.0 -
fast-xml-parser CVE-2026-33349 MODERATE fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation 5.5.1 - -
fast-xml-parser CVE-2026-41650 MODERATE fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters 5.5.1 - -
fast-xml-parser GHSA-jp2q-39xq-3w4g MODERATE Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser 5.5.1 4.5.5 -
handlebars CVE-2026-33916 MODERATE Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection 4.7.8 - -
handlebars GHSA-7rx3-28cr-v5wh MODERATE Handlebars.js has a Prototype Method Access Control Gap via Missing lookupSetter Blocklist Entry 4.7.8 4.7.9 -
handlebars GHSA-2qvq-rjwj-gvw9 MODERATE Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection 4.7.8 4.7.9 -
js-yaml GHSA-h67p-54hq-rp68 MODERATE JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases 3.14.2 4.2.0 -
js-yaml CVE-2026-53550 MODERATE js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases 3.14.2 - -
lodash GHSA-f23m-r3pf-42rh MODERATE lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit 4.17.21 4.18.0 -
lodash CVE-2025-13465 MODERATE Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions 4.17.21 - -
lodash CVE-2026-2950 MODERATE lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit 4.17.21 - -
lodash GHSA-xxjr-mmjv-4gpg MODERATE Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions 4.17.21 4.17.23 -
picomatch GHSA-3v7f-55p6-f55p MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 2.3.1 4.0.4 -
picomatch CVE-2026-33672 MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 4.0.3 - -
picomatch GHSA-3v7f-55p6-f55p MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 4.0.3 4.0.4 -
picomatch CVE-2026-33672 MODERATE Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching 2.3.1 - -
undici GHSA-2mjp-6q6p-2qxm MODERATE Undici has an HTTP Request/Response Smuggling issue 6.23.0 6.24.0 -
undici CVE-2026-1527 MODERATE undici is vulnerable to CRLF Injection via upgrade option 6.23.0 - -
undici GHSA-4992-7rv2-5pvq MODERATE Undici has CRLF Injection in undici via upgrade option 6.23.0 6.24.0 -
undici CVE-2026-1525 MODERATE undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') 6.23.0 - -
undici GHSA-p88m-4jfj-68fv MODERATE undici vulnerable to HTTP header injection via Set-Cookie percent-decoding 6.23.0 6.27.0 -
undici CVE-2026-9679 MODERATE undici vulnerable to HTTP header injection via Set-Cookie percent-decoding 6.23.0 - -
brace-expansion GHSA-v6h2-p8h4-qcjw LOW brace-expansion Regular Expression Denial of Service vulnerability 2.0.1 2.0.2 -
brace-expansion CVE-2025-5889 LOW juliangruber brace-expansion index.js expand redos 2.0.1 - -
brace-expansion CVE-2025-5889 LOW juliangruber brace-expansion index.js expand redos 1.1.11 - -
brace-expansion GHSA-v6h2-p8h4-qcjw LOW brace-expansion Regular Expression Denial of Service vulnerability 1.1.11 2.0.2 -
handlebars GHSA-442j-39wm-28r2 LOW Handlebars.js has a Property Access Validation Bypass in container.lookup 4.7.8 4.7.9 -
undici CVE-2026-11525 LOW undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching 6.23.0 - -
undici GHSA-g8m3-5g58-fq7m LOW undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching 6.23.0 6.27.0 -
undici GHSA-35p6-xmwp-9g52 LOW undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse 6.23.0 6.27.0 -
undici CVE-2026-6733 LOW undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse 6.23.0 - -

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

adms-critical-severity adms-dependency-update adms-high-severity adms-low-severity adms-medium-severity adms-minor-update adms-mode-all-vulns adms-npm campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants