fix(deps): vuln minor upgrades — 12 packages (minor: 8 · patch: 4)

[gh-worker-campaigns-3e9aa4]

Summary: Security update — 12 packages upgraded (MINOR changes included)

Manifests changed:

• . (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
uuid	9.0.0	9.0.1	patch	Transitive	3 MEDIUM
@babel/helpers	7.22.5	7.29.7	minor	Transitive	2 MEDIUM
@babel/runtime	7.22.5	7.29.7	minor	Transitive	2 MEDIUM
@opentelemetry/core	1.14.0	1.30.1	minor	Transitive	2 MEDIUM
ajv	6.12.6	6.15.0	minor	Transitive	2 MEDIUM
morgan	1.10.0	1.11.0	minor	Transitive	2 MEDIUM
qs	6.11.0	6.15.3	minor	Transitive	2 MEDIUM, 2 LOW
yaml	2.3.1	2.9.0	minor	Transitive	2 MEDIUM
@protobufjs/utf8	1.1.0	1.1.2	patch	Transitive	2 MEDIUM
on-headers	1.0.2	1.1.0	minor	Transitive	2 LOW
@babel/core	7.22.5	7.22.20	patch	Transitive	2 LOW
diff	4.0.2	4.0.4	patch	Transitive	2 LOW

---

Security Details

ℹ️ Other Vulnerabilities (27)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
@babel/helpers	CVE-2025-27789	MODERATE	Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups	7.22.5	-	-
@babel/helpers	GHSA-968p-4wvh-cqc8	MODERATE	Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups	7.22.5	7.26.10	-
@babel/runtime	GHSA-968p-4wvh-cqc8	MODERATE	Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups	7.22.5	7.26.10	-
@babel/runtime	CVE-2025-27789	MODERATE	Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups	7.22.5	-	-
@opentelemetry/core	GHSA-8988-4f7v-96qf	MODERATE	OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation	1.14.0	2.8.0	-
@opentelemetry/core	CVE-2026-54285	MODERATE	opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation	1.14.0	-	-
@protobufjs/utf8	CVE-2026-44288	MODERATE	protobufjs: Overlong UTF-8 decoding	1.1.0	-	-
@protobufjs/utf8	GHSA-q6x5-8v7m-xcrf	MODERATE	protobufjs has overlong UTF-8 decoding	1.1.0	1.1.1	-
ajv	GHSA-2g4f-4pwh-qvx6	MODERATE	ajv has ReDoS when using $data option	6.12.6	8.18.0	-
ajv	CVE-2025-69873	MODERATE	-	6.12.6	-	-
morgan	GHSA-4vj7-5mj6-jm8m	MODERATE	morgan vulnerable to Log Forging via unneutralized control characters in :remote-user	1.10.0	1.11.0	-
morgan	CVE-2026-5078	MODERATE	morgan vulnerable to Log Forging via unneutralized control characters in :remote-user	1.10.0	-	-
qs	GHSA-6rw7-vpxm-498p	MODERATE	qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion	6.11.0	6.14.1	-
qs	CVE-2025-15284	MODERATE	arrayLimit bypass in bracket notation allows DoS via memory exhaustion	6.11.0	-	-
uuid	CVE-2026-41988	MODERATE	-	9.0.0	-	-
uuid	GHSA-w5hq-g745-h8pq	MODERATE	uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided	9.0.0	11.1.1	-
uuid	CVE-2026-41907	MODERATE	uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided	9.0.0	-	-
yaml	GHSA-48c2-rrv3-qjmp	MODERATE	yaml is vulnerable to Stack Overflow via deeply nested YAML collections	2.3.1	2.8.3	-
yaml	CVE-2026-33532	MODERATE	yaml is vulnerable to Stack Overflow via deeply nested YAML collections	2.3.1	-	-
@babel/core	GHSA-4x5r-pxfx-6jf8	LOW	@babel/core: Arbitrary File Read via sourceMappingURL Comment	7.22.5	8.0.0-rc.6	-
@babel/core	CVE-2026-49356	LOW	Babel: Arbitrary File Read via sourceMappingURL Comment in @babel/core	7.22.5	-	-
diff	GHSA-73rr-hh4g-fpgx	LOW	jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch	4.0.2	8.0.3	-
diff	CVE-2026-24001	LOW	jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch	4.0.2	-	-
on-headers	CVE-2025-7339	LOW	on-headers vulnerable to http response header manipulation	1.0.2	-	-
on-headers	GHSA-76c9-3jph-rj3q	LOW	on-headers is vulnerable to http response header manipulation	1.0.2	1.1.0	-
qs	CVE-2026-2391	LOW	qs's arrayLimit bypass in comma parsing allows denial of service	6.11.0	-	-
qs	GHSA-w7fw-mjwx-w883	LOW	qs's arrayLimit bypass in comma parsing allows denial of service	6.11.0	6.14.2	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[dd-prapprover-prod-77c48c]

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

• ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-08-24T14:30:11Z
• ⬜ CI tests passed
• ⬜ Approved
• ⬜ Merge Started
• ⬜ Merged

➡️ Current phase: CI tests failed. Please fix the failing tests and rerun the workflow, click Workflow Link -> Workflow Starter Link -> Start Workflow

[gh-worker-campaigns-3e9aa4]

Auto-rebase failed

Lockfile regeneration failed during rebase onto master. Your branch was not updated. You may need to rebase and regenerate lockfiles manually.

Error details

child workflow execution error (type: engraver.Engraver_AllManagersWorkflow, workflowID: 01a032c9-2f55-7ce4-8317-85e882907de3_75, runID: 01a032c9-9f50-7a4f-af7d-809248e53fb2, initiatedEventID: 75, startedEventID: 76): custom action(s) failed and produced no changes: [registry.ddbuild.io/images/engraver-custom-action:update-yarn-lockfile]

---

_{Auto-Rebase · Add no-auto-rebase to opt out}

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with master — rebased onto 959ee65.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}