fix(deps): vuln minor upgrades — 4 packages (minor: 3 · patch: 1) [samples/openapi3] by gh-worker-campaigns-3e9aa4[bot] · Pull Request #53 · DataDog/max-openapi-generator

gh-worker-campaigns-3e9aa4 · 2026-06-16T07:20:47Z

Summary: Critical-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

samples/openapi3 (npm)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
pbkdf2	3.0.17	3.1.6	minor	Transitive	4 CRITICAL
loader-utils	1.1.0	1.4.2	minor	Transitive	2 CRITICAL, 4 HIGH
loader-utils	1.1.0	1.4.2	minor	Transitive	2 CRITICAL, 4 HIGH
loader-utils	1.2.3	1.4.2	minor	Transitive	2 CRITICAL, 4 HIGH
loader-utils	1.4.0	1.4.2	patch	Transitive	2 CRITICAL, 4 HIGH
koa	2.13.4	2.16.4	minor	Transitive	2 CRITICAL, 2 HIGH, 2 MEDIUM, 2 LOW
url-parse	1.4.3	1.5.10	minor	Transitive	2 CRITICAL, 12 MEDIUM
url-parse	1.4.3	1.5.10	minor	Transitive	2 CRITICAL, 12 MEDIUM
url-parse	1.4.3	1.5.10	minor	Direct	2 CRITICAL, 12 MEDIUM
url-parse	1.4.3	1.5.10	minor	Direct	2 CRITICAL, 12 MEDIUM
url-parse	1.4.7	1.5.10	minor	Direct	2 CRITICAL, 10 MEDIUM
url-parse	1.4.7	1.5.10	minor	Direct	2 CRITICAL, 10 MEDIUM
url-parse	1.4.7	1.5.10	minor	Direct	2 CRITICAL, 10 MEDIUM
url-parse	1.4.7	1.5.10	minor	Transitive	2 CRITICAL, 10 MEDIUM
url-parse	1.4.7	1.5.10	minor	Transitive	2 CRITICAL, 10 MEDIUM

Security Details

🚨 Critical & High Severity (50 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
koa	GHSA-593f-38f6-jp5m	CRITICAL	Inefficient Regular Expression Complexity in koa	2.13.4	2.15.4
koa	CVE-2025-25200	CRITICAL	Koa has Inefficient Regular Expression Complexity	2.13.4	-
loader-utils	GHSA-76p3-8jx3-jpfq	CRITICAL	Prototype pollution in webpack loader-utils	1.1.0	2.0.3
loader-utils	CVE-2022-37601	CRITICAL	-	1.1.0	-
loader-utils	GHSA-76p3-8jx3-jpfq	CRITICAL	Prototype pollution in webpack loader-utils	1.4.0	2.0.3
loader-utils	CVE-2022-37601	CRITICAL	-	1.4.0	-
loader-utils	CVE-2022-37601	CRITICAL	-	1.2.3	-
loader-utils	GHSA-76p3-8jx3-jpfq	CRITICAL	Prototype pollution in webpack loader-utils	1.2.3	2.0.3
loader-utils	CVE-2022-37601	CRITICAL	-	1.1.0	-
loader-utils	GHSA-76p3-8jx3-jpfq	CRITICAL	Prototype pollution in webpack loader-utils	1.1.0	2.0.3
pbkdf2	GHSA-h7cp-r72f-jxh6	CRITICAL	pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos	3.0.17	3.1.3
pbkdf2	GHSA-v62p-rq8g-8h59	CRITICAL	pbkdf2 silently disregards Uint8Array input, returning static keys	3.0.17	3.1.3
pbkdf2	CVE-2025-6547	CRITICAL	-	3.0.17	-
pbkdf2	CVE-2025-6545	CRITICAL	-	3.0.17	-
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.3	1.5.8
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.3	1.5.8
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.7	1.5.8
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.7	1.5.8
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.7	1.5.8
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.3	1.5.8
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.3	1.5.8
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.7	1.5.8
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.7	1.5.8
koa	CVE-2026-27959	HIGH	Koa has Host Header Injection via `ctx.hostname`	2.13.4	-
koa	GHSA-7gcc-r8m5-44qm	HIGH	Koa has Host Header Injection via ctx.hostname	2.13.4	3.1.2
loader-utils	GHSA-3rfm-jhwj-7488	HIGH	loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable	1.1.0	1.4.2
loader-utils	CVE-2022-37603	HIGH	-	1.1.0	-
loader-utils	GHSA-hhq3-ff78-jv3g	HIGH	loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)	1.1.0	1.4.2
loader-utils	CVE-2022-37599	HIGH	-	1.1.0	-
loader-utils	CVE-2022-37599	HIGH	-	1.4.0	-
loader-utils	CVE-2022-37603	HIGH	-	1.4.0	-
loader-utils	GHSA-3rfm-jhwj-7488	HIGH	loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable	1.4.0	1.4.2
loader-utils	GHSA-hhq3-ff78-jv3g	HIGH	loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)	1.4.0	1.4.2
loader-utils	GHSA-hhq3-ff78-jv3g	HIGH	loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)	1.2.3	1.4.2
loader-utils	CVE-2022-37599	HIGH	-	1.2.3	-
loader-utils	GHSA-3rfm-jhwj-7488	HIGH	loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable	1.2.3	1.4.2
loader-utils	CVE-2022-37603	HIGH	-	1.2.3	-
loader-utils	GHSA-hhq3-ff78-jv3g	HIGH	loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS)	1.1.0	1.4.2
loader-utils	CVE-2022-37599	HIGH	-	1.1.0	-
loader-utils	GHSA-3rfm-jhwj-7488	HIGH	loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable	1.1.0	1.4.2
loader-utils	CVE-2022-37603	HIGH	-	1.1.0	-

ℹ️ Other Vulnerabilities (102)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
koa	CVE-2025-32379	MODERATE	XSS at ctx.redirect() function in Koajs	2.13.4	-
koa	GHSA-x2rg-q646-7m2v	MODERATE	Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function	2.13.4	2.16.1
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.3	1.5.0
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.3	1.5.2
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	CVE-2020-8124	MODERATE	-	1.4.3	-
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.3	1.5.6
url-parse	CVE-2021-3664	MODERATE	-	1.4.3	-
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.3	1.5.7
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-46c4-8wrp-j99v	MODERATE	Improper Validation and Sanitization in url-parse	1.4.3	1.4.5
url-parse	CVE-2021-27515	MODERATE	-	1.4.3	-
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.3	1.5.9
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	CVE-2020-8124	MODERATE	-	1.4.3	-
url-parse	CVE-2021-27515	MODERATE	-	1.4.3	-
url-parse	GHSA-46c4-8wrp-j99v	MODERATE	Improper Validation and Sanitization in url-parse	1.4.3	1.4.5
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.3	1.5.0
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.3	1.5.6
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.3	1.5.9
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.3	1.5.7
url-parse	CVE-2021-3664	MODERATE	-	1.4.3	-
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.3	1.5.2
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.7	1.5.6
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.7	1.5.7
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.7	1.5.2
url-parse	CVE-2021-3664	MODERATE	-	1.4.7	-
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	CVE-2021-27515	MODERATE	-	1.4.7	-
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.7	1.5.0
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.7	1.5.9
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.7	1.5.0
url-parse	CVE-2021-27515	MODERATE	-	1.4.7	-
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.7	1.5.7
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.7	1.5.6
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.7	1.5.9
url-parse	CVE-2021-3664	MODERATE	-	1.4.7	-
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.7	1.5.2
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	CVE-2021-27515	MODERATE	-	1.4.7	-
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.7	1.5.9
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.7	1.5.2
url-parse	CVE-2021-3664	MODERATE	-	1.4.7	-
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.7	1.5.6
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.7	1.5.7
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.7	1.5.0
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.3	1.5.7
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.3	1.5.6
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.3	1.5.9
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.3	1.5.2
url-parse	CVE-2021-3664	MODERATE	-	1.4.3	-
url-parse	CVE-2020-8124	MODERATE	-	1.4.3	-
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.3	1.5.0
url-parse	CVE-2021-27515	MODERATE	-	1.4.3	-
url-parse	GHSA-46c4-8wrp-j99v	MODERATE	Improper Validation and Sanitization in url-parse	1.4.3	1.4.5
url-parse	CVE-2021-3664	MODERATE	-	1.4.3	-
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.3	1.5.7
url-parse	GHSA-46c4-8wrp-j99v	MODERATE	Improper Validation and Sanitization in url-parse	1.4.3	1.4.5
url-parse	CVE-2021-27515	MODERATE	-	1.4.3	-
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.3	1.5.6
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.3	1.5.0
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.3	1.5.9
url-parse	CVE-2020-8124	MODERATE	-	1.4.3	-
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.3	-
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.3	1.5.2
url-parse	CVE-2021-3664	MODERATE	-	1.4.7	-
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.7	1.5.0
url-parse	CVE-2021-27515	MODERATE	-	1.4.7	-
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.7	1.5.7
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.7	1.5.6
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.7	1.5.2
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.7	1.5.9
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.7	1.5.9
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.7	1.5.2
url-parse	CVE-2021-3664	MODERATE	-	1.4.7	-
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.7	1.5.6
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.7	1.5.7
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.7	1.5.0
url-parse	CVE-2021-27515	MODERATE	-	1.4.7	-
koa	CVE-2025-8129	LOW	-	2.13.4	-
koa	GHSA-jgmv-j7ww-jx2x	LOW	Koa Open Redirect via Referrer Header (User-Controlled)	2.13.4	2.16.2

Review Checklist

Standard review:

Review changes for compatibility with your code
Check for breaking changes in release notes
Run tests locally or wait for CI
Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

…/openapi3]

datadog-prod-us1-3 · 2026-06-16T07:21:28Z

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 3 Pipeline jobs failed

OpenAPI Generator | Samples up-to-date

Linux tests | Build: JDK 17 (ubuntu-latest)

Windows tests | Build (11)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 7b3cfdc | Docs | Datadog PR Page | Give us feedback!}

ADMS: vuln minor upgrades — 4 packages (minor: 3 · patch: 1) [samples…

7b3cfdc

…/openapi3]

gh-worker-campaigns-3e9aa4 Bot added the campaigner-automated-change label Jun 16, 2026

gh-worker-campaigns-3e9aa4 Bot closed this Aug 16, 2026

gh-worker-campaigns-3e9aa4 Bot deleted the engraver-auto-version-upgrade/minorpatch/npm/openapi3/1-1781594209 branch August 16, 2026 14:40

Navigation Menu

Uh oh!

fix(deps): vuln minor upgrades — 4 packages (minor: 3 · patch: 1) [samples/openapi3] - #53

fix(deps): vuln minor upgrades — 4 packages (minor: 3 · patch: 1) [samples/openapi3]#53
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
masterfrom
engraver-auto-version-upgrade/minorpatch/npm/openapi3/1-1781594209

gh-worker-campaigns-3e9aa4 Bot commented Jun 16, 2026

Uh oh!

datadog-prod-us1-3 Bot commented Jun 16, 2026 •

edited by datadog-official Bot

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

gh-worker-campaigns-3e9aa4 Bot commented Jun 16, 2026

Updates

Security Details

Review Checklist

Uh oh!

datadog-prod-us1-3 Bot commented Jun 16, 2026 • edited by datadog-official Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

datadog-prod-us1-3 Bot commented Jun 16, 2026 •

edited by datadog-official Bot

Loading