[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 3 packages upgraded (patch changes only)

Manifests changed:

• package.json (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
follow-redirects	1.16.0	1.16.1	patch	Transitive	4 HIGH
undici	6.29.0	6.29.1	patch	Transitive	2 HIGH, 2 MEDIUM
fast-uri	3.1.8	3.1.9	patch	Transitive	4 MEDIUM, 4 LOW

---

Security Details

🚨 Critical & High Severity (6 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
follow-redirects	GHSA-q3jh-wrc6-jgq8	HIGH	follow-redirects array-form headers bypass cross-origin credential stripping	1.16.0	1.16.1	-
follow-redirects	CVE-2026-111755	HIGH	follow-redirects sensitiveHeaders regex escaping can expose credential headers	1.16.0	-	-
follow-redirects	GHSA-8r9p-f939-6h3c	HIGH	follow-redirects sensitiveHeaders regex escaping can expose credential headers	1.16.0	1.16.1	-
follow-redirects	CVE-2026-111756	HIGH	follow-redirects array-form headers bypass cross-origin credential stripping	1.16.0	-	-
undici	CVE-2026-109869	HIGH	undici vulnerable to Denial of Service via unhandled error on excessive content-encodings	6.29.0	-	-
undici	GHSA-xjj6-f33q-929c	HIGH	undici vulnerable to Denial of Service via unhandled error on excessive content-encodings	6.29.0	6.29.1	-

ℹ️ Other Vulnerabilities (10)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
fast-uri	GHSA-wjr9-j795-jxcr	MODERATE	fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization	3.1.8	2.4.8	-
fast-uri	CVE-2026-110180	MODERATE	fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization	3.1.8	-	-
fast-uri	CVE-2026-110306	MODERATE	fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding	3.1.8	-	-
fast-uri	GHSA-w74x-v6f9-j3xg	MODERATE	fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding	3.1.8	2.4.8	-
undici	GHSA-4qv8-2p9j-2685	MODERATE	undici vulnerable to Denial of Service via unbounded memory in the EventSource parser	6.29.0	6.29.1	-
undici	CVE-2026-109924	MODERATE	undici vulnerable to Denial of Service via unbounded memory in the EventSource parser	6.29.0	-	-
fast-uri	CVE-2026-110725	LOW	fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references	3.1.8	-	-
fast-uri	GHSA-333x-w4r6-6crp	LOW	fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references	3.1.8	2.4.8	-
fast-uri	GHSA-xhq7-xmqj-769h	LOW	fast-uri vulnerable to improper path equivalence in relative reference normalization	3.1.8	2.4.8	-
fast-uri	CVE-2026-110095	LOW	fast-uri vulnerable to improper path equivalence in relative reference normalization	3.1.8	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T19:17:57.964858Z	b1814a7	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[dd-prapprover-prod-77c48c]

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

• ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-10-26T19:16:18Z
• ✅ CI tests passed - 2026-10-26T19:16:22Z
• ✅ Approved (commit: b1814a7) - 2026-10-26T19:16:25Z
• ✅ Merge Started
• ✅ Merged - 2026-10-26T19:16:45Z

➡️ Current phase: PR merged successfully! ✅

[dd-prapprover-prod-77c48c]

This PR has been automatically approved by the DD PR Approver bot.