fix(deps): vuln minor upgrades — 15 packages (minor: 7 · patch: 8) [website]

[gh-worker-campaigns-3e9aa4]

Summary: Critical-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

• website (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
webpack	5.75.0	5.107.2	minor	Transitive	2 CRITICAL, 2 MEDIUM, 4 LOW
@babel/traverse	7.20.13	7.29.7	minor	Transitive	2 CRITICAL
shell-quote	1.8.0	1.8.4	patch	Transitive	1 CRITICAL
node-forge	1.3.1	1.4.0	minor	Transitive	12 HIGH, 2 MEDIUM
minimatch	3.1.2	3.1.5	patch	Transitive	6 HIGH
path-to-regexp	0.1.7	0.1.13	patch	Transitive	5 HIGH
ws	8.12.0	8.21.0	minor	Transitive	3 HIGH, 1 MEDIUM
lodash.template	4.5.0	4.18.1	minor	Direct	3 HIGH
http-proxy-middleware	2.0.6	2.0.9	patch	Transitive	2 HIGH, 4 MEDIUM
picomatch	2.3.1	2.3.2	patch	Transitive	2 HIGH, 2 MEDIUM
body-parser	1.20.2	1.20.5	patch	Transitive	2 HIGH
cross-spawn	7.0.3	7.0.6	patch	Transitive	2 HIGH
svgo	2.8.0	2.8.2	patch	Transitive	2 HIGH
lodash	4.17.21	4.18.1	minor	Transitive	1 HIGH, 3 MEDIUM
webpack-dev-server	4.11.1	4.15.2	minor	Transitive	5 MEDIUM

---

Security Details

🚨 Critical & High Severity (45 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
@babel/traverse	GHSA-67hx-6x53-jw92	CRITICAL	Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code	7.20.13	7.23.2
@babel/traverse	CVE-2023-45133	CRITICAL	Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code	7.20.13	-
shell-quote	GHSA-w7jw-789q-3m8p	CRITICAL	shell-quote quote() does not escape newlines in object .op values	1.8.0	1.8.4
webpack	CVE-2023-28154	CRITICAL	-	5.75.0	-
webpack	GHSA-hc6q-2mpp-qw7j	CRITICAL	Cross-realm object access in Webpack 5	5.75.0	5.76.0
body-parser	GHSA-qwcr-r2fm-qrc7	HIGH	body-parser vulnerable to denial of service when url encoding is enabled	1.20.2	1.20.3
body-parser	CVE-2024-45590	HIGH	body-parser vulnerable to denial of service when url encoding is enabled	1.20.2	-
cross-spawn	CVE-2024-21538	HIGH	-	7.0.3	-
cross-spawn	GHSA-3xgq-45jj-v275	HIGH	Regular Expression Denial of Service (ReDoS) in cross-spawn	7.0.3	7.0.5
http-proxy-middleware	GHSA-c7qv-q95q-8v27	HIGH	Denial of service in http-proxy-middleware	2.0.6	2.0.7
http-proxy-middleware	CVE-2024-21536	HIGH	-	2.0.6	-
lodash	GHSA-r5fr-rjxr-66jc	HIGH	lodash vulnerable to Code Injection via _.template imports key names	4.17.21	4.18.0
lodash.template	CVE-2021-23337	HIGH	-	4.5.0	-
lodash.template	GHSA-35jh-r3h4-6jhm	HIGH	Command Injection in lodash	4.5.0	-
lodash.template	GHSA-r5fr-rjxr-66jc	HIGH	lodash vulnerable to Code Injection via _.template imports key names	4.5.0	4.18.0
minimatch	GHSA-3ppc-4f35-3m26	HIGH	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	3.1.2	10.2.1
minimatch	GHSA-23c5-xmqv-rm74	HIGH	minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	3.1.2	10.2.3
minimatch	CVE-2026-27904	HIGH	minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	3.1.2	-
minimatch	GHSA-7r86-cg39-jmmj	HIGH	minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	3.1.2	10.2.3
minimatch	CVE-2026-27903	HIGH	minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	3.1.2	-
minimatch	CVE-2026-26996	HIGH	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	3.1.2	-
node-forge	GHSA-554w-wpv2-vw27	HIGH	node-forge has ASN.1 Unbounded Recursion	1.3.1	1.3.2
node-forge	GHSA-5m6q-g25r-mvwx	HIGH	Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input	1.3.1	1.4.0
node-forge	GHSA-2328-f5f3-gj25	HIGH	Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)	1.3.1	1.4.0
node-forge	CVE-2026-33896	HIGH	Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)	1.3.1	-
node-forge	GHSA-q67f-28xg-22rw	HIGH	Forge has signature forgery in Ed25519 due to missing S > L check	1.3.1	1.4.0
node-forge	CVE-2026-33891	HIGH	Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input	1.3.1	-
node-forge	CVE-2026-33895	HIGH	Forge has signature forgery in Ed25519 due to missing S > L check	1.3.1	-
node-forge	CVE-2025-66031	HIGH	node-forge ASN.1 Unbounded Recursion	1.3.1	-
node-forge	CVE-2025-12816	HIGH	-	1.3.1	-
node-forge	GHSA-5gfm-wpxj-wjgq	HIGH	node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization	1.3.1	1.3.2
node-forge	CVE-2026-33894	HIGH	Forge has signature forgery in RSA-PKCS due to ASN.1 extra field	1.3.1	-
node-forge	GHSA-ppp5-5v6c-4jwp	HIGH	Forge has signature forgery in RSA-PKCS due to ASN.1 extra field	1.3.1	1.4.0
path-to-regexp	CVE-2024-52798	HIGH	path-to-regexp Unpatched path-to-regexp ReDoS in 0.1.x	0.1.7	-
path-to-regexp	GHSA-9wv6-86v2-598j	HIGH	path-to-regexp outputs backtracking regular expressions	0.1.7	1.9.0
path-to-regexp	CVE-2024-45296	HIGH	path-to-regexp outputs backtracking regular expressions	0.1.7	-
path-to-regexp	GHSA-rhx6-c78j-4q9w	HIGH	path-to-regexp contains a ReDoS	0.1.7	0.1.12
path-to-regexp	GHSA-37ch-88jc-xwx2	HIGH	path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters	0.1.7	0.1.13
picomatch	GHSA-c2c7-rcm5-vvqj	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	2.3.1	4.0.4
picomatch	CVE-2026-33671	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	2.3.1	-
svgo	CVE-2026-29074	HIGH	SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)	2.8.0	-
svgo	GHSA-xpqw-6gx7-v673	HIGH	SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)	2.8.0	2.8.1
ws	GHSA-96hv-2xvq-fx4p	HIGH	ws: Memory exhaustion DoS from tiny fragments and data chunks	8.12.0	5.2.5
ws	CVE-2024-37890	HIGH	Denial of service when handling a request with many HTTP headers in ws	8.12.0	-
ws	GHSA-3h5v-q93c-6h6q	HIGH	ws affected by a DoS when handling a request with many HTTP headers	8.12.0	5.2.4

ℹ️ Other Vulnerabilities (23)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
http-proxy-middleware	CVE-2025-32997	MODERATE	-	2.0.6	-
http-proxy-middleware	GHSA-4www-5p9h-95mh	MODERATE	http-proxy-middleware can call writeBody twice because "else if" is not used	2.0.6	2.0.8
http-proxy-middleware	CVE-2025-32996	MODERATE	-	2.0.6	-
http-proxy-middleware	GHSA-9gqv-wp59-fq42	MODERATE	http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed	2.0.6	2.0.9
lodash	GHSA-xxjr-mmjv-4gpg	MODERATE	Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions	4.17.21	4.17.23
lodash	CVE-2025-13465	MODERATE	-	4.17.21	-
lodash	GHSA-f23m-r3pf-42rh	MODERATE	lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit	4.17.21	4.18.0
node-forge	GHSA-65ch-62r8-g69g	MODERATE	node-forge is vulnerable to ASN.1 OID Integer Truncation	1.3.1	1.3.2
node-forge	CVE-2025-66030	MODERATE	node-forge ASN.1 OID Integer Truncation	1.3.1	-
picomatch	CVE-2026-33672	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	2.3.1	-
picomatch	GHSA-3v7f-55p6-f55p	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	2.3.1	4.0.4
webpack	CVE-2024-43788	MODERATE	DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)	5.75.0	-
webpack	GHSA-4vvj-4cpr-p986	MODERATE	Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS	5.75.0	5.94.0
webpack-dev-server	GHSA-79cf-xcqc-c78w	MODERATE	webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins	4.11.1	5.2.4
webpack-dev-server	CVE-2025-30359	MODERATE	webpack-dev-server users' source code may be stolen when they access a malicious web site	4.11.1	-
webpack-dev-server	GHSA-4v9v-hfq4-rm2v	MODERATE	webpack-dev-server users' source code may be stolen when they access a malicious web site	4.11.1	5.2.1
webpack-dev-server	GHSA-9jgg-88mc-972h	MODERATE	webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser	4.11.1	5.2.1
webpack-dev-server	CVE-2025-30360	MODERATE	webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser	4.11.1	-
ws	GHSA-58qx-3vcg-4xpx	MODERATE	ws: Uninitialized memory disclosure	8.12.0	8.20.1
webpack	CVE-2025-68458	LOW	webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior	5.75.0	-
webpack	GHSA-8fgc-7cc6-rx7x	LOW	webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior	5.75.0	5.104.1
webpack	CVE-2025-68157	LOW	webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects	5.75.0	-
webpack	GHSA-38r7-794h-5758	LOW	webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence	5.75.0	5.104.0

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[datadog-datadog-prod-us1-2]

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 2 Pipeline jobs failed

Linux tests | Build: JDK 11 (ubuntu-latest)     

Windows tests | Build (17)     

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 7da90f3 | Docs | Datadog PR Page | Give us feedback!}