fix(deps): vuln minor upgrades — 13 packages (minor: 9 · patch: 4) [package.json]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 13 packages upgraded (MINOR changes included)

Manifests changed:

• package.json (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
browserslist	4.21.9	4.28.9	minor	Transitive	4 HIGH
qs	6.11.0	6.16.0	minor	Transitive	4 MEDIUM, 2 LOW
uuid	9.0.0	9.0.1	patch	Transitive	3 MEDIUM
@babel/helpers	7.22.5	7.29.7	minor	Transitive	2 MEDIUM
@babel/runtime	7.22.5	7.29.7	minor	Transitive	2 MEDIUM
@opentelemetry/core	1.14.0	1.30.1	minor	Transitive	2 MEDIUM
ajv	6.12.6	6.15.0	minor	Transitive	2 MEDIUM
morgan	1.10.0	1.12.0	minor	Transitive	2 MEDIUM
yaml	2.3.1	2.9.0	minor	Transitive	2 MEDIUM
@protobufjs/utf8	1.1.0	1.1.2	patch	Transitive	2 MEDIUM
on-headers	1.0.2	1.1.0	minor	Transitive	2 LOW
@babel/core	7.22.5	7.22.20	patch	Transitive	2 LOW
diff	4.0.2	4.0.4	patch	Transitive	2 LOW

---

Security Details

🚨 Critical & High Severity (4 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
browserslist	GHSA-c83g-rgw3-j3cx	HIGH	Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM	4.21.9	4.28.7	-
browserslist	CVE-2026-73088	HIGH	Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)	4.21.9	-	-
browserslist	GHSA-73wf-gq98-2v4g	HIGH	Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)	4.21.9	4.28.7	-
browserslist	CVE-2026-73089	HIGH	Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM	4.21.9	-	-

ℹ️ Other Vulnerabilities (29)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
@babel/helpers	CVE-2025-27789	MODERATE	Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups	7.22.5	-	-
@babel/helpers	GHSA-968p-4wvh-cqc8	MODERATE	Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups	7.22.5	7.26.10	-
@babel/runtime	CVE-2025-27789	MODERATE	Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups	7.22.5	-	-
@babel/runtime	GHSA-968p-4wvh-cqc8	MODERATE	Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups	7.22.5	7.26.10	-
@opentelemetry/core	CVE-2026-54285	MODERATE	opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation	1.14.0	-	-
@opentelemetry/core	GHSA-8988-4f7v-96qf	MODERATE	OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation	1.14.0	2.8.0	-
@protobufjs/utf8	CVE-2026-44288	MODERATE	protobufjs: Overlong UTF-8 decoding	1.1.0	-	-
@protobufjs/utf8	GHSA-q6x5-8v7m-xcrf	MODERATE	protobufjs has overlong UTF-8 decoding	1.1.0	1.1.1	-
ajv	CVE-2025-69873	MODERATE	-	6.12.6	-	-
ajv	GHSA-2g4f-4pwh-qvx6	MODERATE	ajv has ReDoS when using $data option	6.12.6	8.18.0	-
morgan	GHSA-4vj7-5mj6-jm8m	MODERATE	morgan vulnerable to Log Forging via unneutralized control characters in :remote-user	1.10.0	1.11.0	-
morgan	CVE-2026-5078	MODERATE	morgan vulnerable to Log Forging via unneutralized control characters in :remote-user	1.10.0	-	-
qs	GHSA-6rw7-vpxm-498p	MODERATE	qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion	6.11.0	6.14.1	-
qs	CVE-2025-15284	MODERATE	arrayLimit bypass in bracket notation allows DoS via memory exhaustion	6.11.0	-	-
qs	GHSA-4mjr-xmp4-gh2g	MODERATE	qs: Denial of Service via Attacker Controlled isBuffer	6.11.0	6.16.0	-
qs	CVE-2026-82417	MODERATE	qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property	6.11.0	-	-
uuid	CVE-2026-41988	MODERATE	-	9.0.0	-	-
uuid	GHSA-w5hq-g745-h8pq	MODERATE	uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided	9.0.0	11.1.1	-
uuid	CVE-2026-41907	MODERATE	uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided	9.0.0	-	-
yaml	GHSA-48c2-rrv3-qjmp	MODERATE	yaml is vulnerable to Stack Overflow via deeply nested YAML collections	2.3.1	2.8.3	-
yaml	CVE-2026-33532	MODERATE	yaml is vulnerable to Stack Overflow via deeply nested YAML collections	2.3.1	-	-
@babel/core	GHSA-4x5r-pxfx-6jf8	LOW	@babel/core: Arbitrary File Read via sourceMappingURL Comment	7.22.5	8.0.0-rc.6	-
@babel/core	CVE-2026-49356	LOW	Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/core	7.22.5	-	-
diff	GHSA-73rr-hh4g-fpgx	LOW	jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch	4.0.2	8.0.3	-
diff	CVE-2026-24001	LOW	jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch	4.0.2	-	-
on-headers	CVE-2025-7339	LOW	on-headers vulnerable to http response header manipulation	1.0.2	-	-
on-headers	GHSA-76c9-3jph-rj3q	LOW	on-headers is vulnerable to http response header manipulation	1.0.2	1.1.0	-
qs	CVE-2026-2391	LOW	qs's arrayLimit bypass in comma parsing allows denial of service	6.11.0	-	-
qs	GHSA-w7fw-mjwx-w883	LOW	qs's arrayLimit bypass in comma parsing allows denial of service	6.11.0	6.14.2	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[dd-prapprover-prod-77c48c]

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

• ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-09-08T18:58:15Z
• ⬜ CI tests passed
• ⬜ Approved
• ⬜ Merge Started
• ⬜ Merged

➡️ Current phase: CI tests failed. Please fix the failing tests and rerun the workflow, click Workflow Link -> Workflow Starter Link -> Start Workflow

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with master — rebased onto 4d60dc1.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}