fix(deps): vuln minor upgrades — 15 packages (minor: 7 · patch: 8) [single-page-app/ui]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

• single-page-app/ui (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
minimatch	3.1.2	3.1.5	patch	Transitive	6 HIGH
flatted	3.2.9	3.4.2	minor	Transitive	4 HIGH
rollup	4.13.1	4.62.0	minor	Transitive	4 HIGH
picomatch	2.3.1	2.3.2	patch	Transitive	2 HIGH, 2 MEDIUM
@remix-run/router	1.19.0	1.23.3	minor	Transitive	2 HIGH
cross-spawn	7.0.3	7.0.6	patch	Transitive	2 HIGH
js-yaml	4.1.0	4.2.0	minor	Transitive	3 MEDIUM
react-router	6.26.0	6.26.2	patch	Transitive	3 MEDIUM
@babel/helpers	7.24.5	7.29.7	minor	Transitive	2 MEDIUM
@babel/runtime	7.23.8	7.29.7	minor	Transitive	2 MEDIUM
ajv	6.12.6	6.15.0	minor	Transitive	2 MEDIUM
brace-expansion	2.0.1	2.0.3	patch	Transitive	2 MEDIUM, 2 LOW
micromatch	4.0.5	4.0.8	patch	Transitive	2 MEDIUM
nanoid	3.3.7	3.3.12	patch	Transitive	2 MEDIUM
yaml	1.10.2	1.10.3	patch	Transitive	2 MEDIUM

---

Security Details

🚨 Critical & High Severity (20 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
@remix-run/router	GHSA-2w69-qvjg-hvjx	HIGH	React Router vulnerable to XSS via Open Redirects	1.19.0	1.23.2
@remix-run/router	CVE-2026-22029	HIGH	React Router vulnerable to XSS via Open Redirects	1.19.0	-
cross-spawn	CVE-2024-21538	HIGH	-	7.0.3	-
cross-spawn	GHSA-3xgq-45jj-v275	HIGH	Regular Expression Denial of Service (ReDoS) in cross-spawn	7.0.3	7.0.5
flatted	GHSA-rf6f-7fwh-wjgh	HIGH	Prototype Pollution via parse() in NodeJS flatted	3.2.9	3.4.2
flatted	CVE-2026-33228	HIGH	flatted: Prototype Pollution via parse()	3.2.9	-
flatted	GHSA-25h7-pfq9-p65f	HIGH	flatted vulnerable to unbounded recursion DoS in parse() revive phase	3.2.9	3.4.0
flatted	CVE-2026-32141	HIGH	flatted: Unbounded recursion DoS in parse() revive phase	3.2.9	-
minimatch	GHSA-3ppc-4f35-3m26	HIGH	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	3.1.2	10.2.1
minimatch	GHSA-7r86-cg39-jmmj	HIGH	minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	3.1.2	10.2.3
minimatch	CVE-2026-27903	HIGH	minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	3.1.2	-
minimatch	CVE-2026-27904	HIGH	minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	3.1.2	-
minimatch	GHSA-23c5-xmqv-rm74	HIGH	minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	3.1.2	10.2.3
minimatch	CVE-2026-26996	HIGH	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	3.1.2	-
picomatch	CVE-2026-33671	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	2.3.1	-
picomatch	GHSA-c2c7-rcm5-vvqj	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	2.3.1	4.0.4
rollup	GHSA-mw96-cpmx-2vgc	HIGH	Rollup 4 has Arbitrary File Write via Path Traversal	4.13.1	2.80.0
rollup	GHSA-gcx4-mw62-g8wm	HIGH	DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS	4.13.1	3.29.5
rollup	CVE-2024-47068	HIGH	DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS	4.13.1	-
rollup	CVE-2026-27606	HIGH	Rollup 4 has Arbitrary File Write via Path Traversal	4.13.1	-

ℹ️ Other Vulnerabilities (24)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
@babel/helpers	CVE-2025-27789	MODERATE	Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups	7.24.5	-
@babel/helpers	GHSA-968p-4wvh-cqc8	MODERATE	Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups	7.24.5	7.26.10
@babel/runtime	CVE-2025-27789	MODERATE	Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups	7.23.8	-
@babel/runtime	GHSA-968p-4wvh-cqc8	MODERATE	Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups	7.23.8	7.26.10
ajv	CVE-2025-69873	MODERATE	-	6.12.6	-
ajv	GHSA-2g4f-4pwh-qvx6	MODERATE	ajv has ReDoS when using $data option	6.12.6	8.18.0
brace-expansion	GHSA-f886-m6hf-6m8v	MODERATE	brace-expansion: Zero-step sequence causes process hang and memory exhaustion	2.0.1	5.0.5
brace-expansion	CVE-2026-33750	MODERATE	brace-expansion: Zero-step sequence causes process hang and memory exhaustion	2.0.1	-
js-yaml	GHSA-mh29-5h37-fv8m	MODERATE	js-yaml has prototype pollution in merge (<<)	4.1.0	4.1.1
js-yaml	GHSA-h67p-54hq-rp68	MODERATE	JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases	4.1.0	4.2.0
js-yaml	CVE-2025-64718	MODERATE	js-yaml has prototype pollution in merge (<<)	4.1.0	-
micromatch	CVE-2024-4067	MODERATE	-	4.0.5	-
micromatch	GHSA-952p-6rrq-rcjv	MODERATE	Regular Expression Denial of Service (ReDoS) in micromatch	4.0.5	4.0.8
nanoid	GHSA-mwcw-c2x4-8c55	MODERATE	Predictable results in nanoid generation when given non-integer values	3.3.7	5.0.9
nanoid	CVE-2024-55565	MODERATE	-	3.3.7	-
picomatch	GHSA-3v7f-55p6-f55p	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	2.3.1	4.0.4
picomatch	CVE-2026-33672	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	2.3.1	-
react-router	GHSA-9jcx-v3wj-wh4m	MODERATE	React Router has unexpected external redirect via untrusted paths	6.26.0	6.30.2
react-router	CVE-2025-68470	MODERATE	React Router has unexpected external redirect via untrusted paths	6.26.0	-
react-router	GHSA-2j2x-hqr9-3h42	MODERATE	React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation	6.26.0	7.14.1
yaml	GHSA-48c2-rrv3-qjmp	MODERATE	yaml is vulnerable to Stack Overflow via deeply nested YAML collections	1.10.2	2.8.3
yaml	CVE-2026-33532	MODERATE	yaml is vulnerable to Stack Overflow via deeply nested YAML collections	1.10.2	-
brace-expansion	CVE-2025-5889	LOW	-	2.0.1	-
brace-expansion	GHSA-v6h2-p8h4-qcjw	LOW	brace-expansion Regular Expression Denial of Service vulnerability	2.0.1	2.0.2

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[datadog-datadog-prod-us1]

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 2 Pipeline jobs failed

Docs | docs     

Verify | verify     

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: e5aaf4f | Docs | Datadog PR Page | Give us feedback!}