Skip to content

fix(deps): vuln minor upgrades — 10 packages (minor: 4 · patch: 6) [integration-tests/package.json] - #1459

Open
gh-worker-campaigns-3e9aa4[bot] wants to merge 5 commits into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/integration-tests/0-1793009098
Open

fix(deps): vuln minor upgrades — 10 packages (minor: 4 · patch: 6) [integration-tests/package.json]#1459
gh-worker-campaigns-3e9aa4[bot] wants to merge 5 commits into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/integration-tests/0-1793009098

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

⚠️ One or more lockfile regeneration steps failed. The updates listed below may not all have been applied — verify against the diff before merging. Package counts and totals reflect what was attempted, not what landed. See the engraver logs for details.

Summary: Critical-severity security update — 10 packages upgraded (MINOR changes included)

Manifests changed:

  • integration-tests/package.json (npm)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
handlebars 4.7.9 4.7.10 patch Transitive 4 CRITICAL, 2 MEDIUM
axios 1.18.0 1.20.0 minor Direct 14 HIGH, 10 MEDIUM
fast-uri 3.1.2 3.1.9 patch Transitive 14 HIGH, 4 MEDIUM, 4 LOW
brace-expansion 5.0.6 5.0.12 patch Transitive 10 HIGH, 2 MEDIUM
brace-expansion 1.1.15 1.1.21 patch Transitive 10 HIGH, 2 MEDIUM
js-yaml 3.14.2 3.15.2 minor Transitive 5 HIGH, 2 MEDIUM
browserslist 4.28.2 4.28.9 patch Transitive 4 HIGH
follow-redirects 1.16.0 1.16.1 patch Transitive 4 HIGH
aws-cdk-lib 2.259.0 2.274.0 minor Direct 2 HIGH
baseline-browser-mapping 2.10.37 2.11.32 minor Transitive 2 MEDIUM
protobufjs 7.6.4 7.6.6 patch Transitive 2 MEDIUM

Security Details

🚨 Critical & High Severity (67 fixed)
Package CVE Severity Summary Unsafe Version Fixed In Case
handlebars CVE-2026-106446 CRITICAL Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams) 4.7.9 - -
handlebars GHSA-p8wg-vrv2-v86f CRITICAL Handlebars: JavaScript Injection via Own Property Check Bypass 4.7.9 4.7.10 -
handlebars CVE-2026-106445 CRITICAL Handlebars: JavaScript Injection via Own Property Check Bypass 4.7.9 - -
handlebars GHSA-8r5x-fm3f-whwj CRITICAL Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) 4.7.9 4.7.10 -
aws-cdk-lib CVE-2026-13760 HIGH OS Command Injection in aws-cdk-lib Docker Bundling 2.259.0 - -
aws-cdk-lib GHSA-vcrf-j523-4mrf HIGH aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling 2.259.0 2.260.0 -
axios CVE-2026-101901 HIGH Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization 1.18.0 - -
axios GHSA-c29m-xwm3-cm6r HIGH Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) 1.18.0 1.20.0 -
axios GHSA-3pq3-5fj3-cg6v HIGH Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls 1.18.0 1.20.0 -
axios GHSA-r4gj-5m52-g5wh HIGH Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF 1.18.0 1.20.0 -
axios CVE-2026-101906 HIGH Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location 1.18.0 - -
axios GHSA-542g-h47m-68v8 HIGH Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization 1.18.0 1.20.0 -
axios CVE-2026-101903 HIGH Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) 1.18.0 - -
axios CVE-2026-101907 HIGH Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF 1.18.0 - -
axios CVE-2026-101905 HIGH Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection 1.18.0 - -
axios GHSA-m8m8-qj5v-23w3 HIGH Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection 1.18.0 1.20.0 -
axios CVE-2026-101909 HIGH Axios: Prototype Pollution Gadget in axios toFormData Options 1.18.0 - -
axios GHSA-x97p-jq2g-jp4f HIGH Axios: Prototype Pollution Gadget in axios toFormData Options 1.18.0 0.34.0 -
axios CVE-2026-101898 HIGH Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls 1.18.0 - -
axios GHSA-mghh-pgcx-3jjj HIGH Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location 1.18.0 1.20.0 -
brace-expansion CVE-2026-102278 HIGH brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion 1.1.15 - -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 5.0.6 - -
brace-expansion CVE-2026-69152 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 1.1.15 - -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 1.1.15 1.1.18 -
brace-expansion CVE-2026-13149 HIGH - 1.1.15 - -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 1.1.15 5.0.7 -
brace-expansion CVE-2026-102276 HIGH brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion 1.1.15 - -
brace-expansion GHSA-6j4f-fj2g-mc7p HIGH brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion 1.1.15 5.0.10 -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 1.1.15 - -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 1.1.15 5.0.8 -
brace-expansion GHSA-qhr7-859c-m2p7 HIGH brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion 1.1.15 5.0.11 -
brace-expansion CVE-2026-102276 HIGH brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion 5.0.6 - -
brace-expansion GHSA-6j4f-fj2g-mc7p HIGH brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion 5.0.6 5.0.10 -
brace-expansion CVE-2026-13149 HIGH - 5.0.6 - -
brace-expansion GHSA-3jxr-9vmj-r5cp HIGH brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups 5.0.6 5.0.7 -
brace-expansion GHSA-mh99-v99m-4gvg HIGH brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash 5.0.6 5.0.8 -
brace-expansion CVE-2026-14257 HIGH brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash 5.0.6 - -
brace-expansion GHSA-qhr7-859c-m2p7 HIGH brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion 5.0.6 5.0.11 -
brace-expansion CVE-2026-102278 HIGH brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion 5.0.6 - -
brace-expansion GHSA-rgw5-rvv9-x895 HIGH brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation 5.0.6 1.1.18 -
browserslist GHSA-73wf-gq98-2v4g HIGH Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) 4.28.2 4.28.7 -
browserslist CVE-2026-73088 HIGH Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) 4.28.2 - -
browserslist CVE-2026-73089 HIGH Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM 4.28.2 - -
browserslist GHSA-c83g-rgw3-j3cx HIGH Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM 4.28.2 4.28.7 -
fast-uri CVE-2026-18446 HIGH fast-uri vulnerable to host confusion via backslash authority introducer 3.1.2 - -
fast-uri GHSA-jqff-g426-hqxp HIGH fast-uri vulnerable to host confusion via percent-encoded scheme normalization 3.1.2 2.4.5 -
fast-uri CVE-2026-84292 HIGH fast-uri vulnerable to authority injection via an unvalidated port in serialize 3.1.2 - -
fast-uri GHSA-qw65-cvwx-89v3 HIGH fast-uri vulnerable to authority injection via an unvalidated port in serialize 3.1.2 2.4.6 -
fast-uri GHSA-v2hh-gcrm-f6hx HIGH fast-uri vulnerable to host confusion via literal backslash authority delimiter 3.1.2 2.4.3 -
fast-uri CVE-2026-75975 HIGH fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization 3.1.2 - -
fast-uri GHSA-fph4-wmhf-6fwf HIGH fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding 3.1.2 2.4.5 -
fast-uri GHSA-f65p-4m7j-42xc HIGH fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization 3.1.2 2.4.5 -
fast-uri CVE-2026-75899 HIGH fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding 3.1.2 - -
fast-uri GHSA-7p8r-x3mc-p8w7 HIGH fast-uri vulnerable to host confusion via backslash authority introducer 3.1.2 2.4.4 -
fast-uri CVE-2026-76172 HIGH fast-uri vulnerable to host confusion via percent-encoded scheme normalization 3.1.2 - -
fast-uri CVE-2026-16221 HIGH fast-uri vulnerable to host confusion via literal backslash authority delimiter 3.1.2 - -
fast-uri GHSA-4c8g-83qw-93j6 HIGH fast-uri vulnerable to host confusion via failed IDN canonicalization 3.1.2 4.0.1 -
fast-uri CVE-2026-13676 HIGH fast-uri vulnerable to host confusion via failed IDN canonicalization 3.1.2 - -
follow-redirects CVE-2026-111756 HIGH follow-redirects array-form headers bypass cross-origin credential stripping 1.16.0 - -
follow-redirects GHSA-8r9p-f939-6h3c HIGH follow-redirects sensitiveHeaders regex escaping can expose credential headers 1.16.0 1.16.1 -
follow-redirects GHSA-q3jh-wrc6-jgq8 HIGH follow-redirects array-form headers bypass cross-origin credential stripping 1.16.0 1.16.1 -
follow-redirects CVE-2026-111755 HIGH follow-redirects sensitiveHeaders regex escaping can expose credential headers 1.16.0 - -
js-yaml CVE-2026-59869 HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 3.14.2 - -
js-yaml GHSA-5p4m-2wfm-xmqj HIGH JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported 3.14.2 4.3.1 -
js-yaml GHSA-52cp-r559-cp3m HIGH js-yaml: YAML merge-key chains can force quadratic CPU consumption 3.14.2 3.15.0 -
js-yaml GHSA-2883-xcg3-v3hh HIGH js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources 3.14.2 4.3.2 -
js-yaml CVE-2026-84375 HIGH js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources 3.14.2 - -
ℹ️ Other Vulnerabilities (30)
Package CVE Severity Summary Unsafe Version Fixed In Case
axios GHSA-vh66-26gq-q6x8 MODERATE Axios: Prototype pollution gadget in fetch adapter can alter outbound requests 1.18.0 1.20.0 -
axios GHSA-j8rh-479h-cp32 MODERATE Axios: Header Injection via Inherited headers After Minimal Interceptor 1.18.0 1.20.0 -
axios CVE-2026-101899 MODERATE Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges 1.18.0 - -
axios GHSA-44g4-m2mj-wpvx MODERATE Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges 1.18.0 1.20.0 -
axios CVE-2026-101908 MODERATE Axios: Prototype pollution gadget in fetch adapter can alter outbound requests 1.18.0 - -
axios CVE-2026-101902 MODERATE Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method 1.18.0 - -
axios CVE-2026-101904 MODERATE Axios: Header Injection via Inherited headers After Minimal Interceptor 1.18.0 - -
axios CVE-2026-101900 MODERATE Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders 1.18.0 - -
axios GHSA-9fr6-4gfg-395g MODERATE Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method 1.18.0 0.34.0 -
axios GHSA-4hqw-qxg8-jxx2 MODERATE Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders 1.18.0 1.20.0 -
baseline-browser-mapping GHSA-w5vr-8v7q-w6rv MODERATE baseline-browser-mapping process termination on invalid input causes denial of service 2.10.37 2.11.0 -
baseline-browser-mapping CVE-2026-45819 MODERATE - 2.10.37 - -
brace-expansion GHSA-q2hr-2g5m-vwhr MODERATE brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service 1.1.15 5.0.12 -
brace-expansion CVE-2026-102277 MODERATE brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service 1.1.15 - -
brace-expansion CVE-2026-102277 MODERATE brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service 5.0.6 - -
brace-expansion GHSA-q2hr-2g5m-vwhr MODERATE brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service 5.0.6 5.0.12 -
fast-uri CVE-2026-110306 MODERATE fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding 3.1.2 - -
fast-uri GHSA-hrr3-gc8f-f4qj MODERATE fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets 3.1.2 2.4.7 -
fast-uri CVE-2026-86472 MODERATE fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets 3.1.2 - -
fast-uri GHSA-w74x-v6f9-j3xg MODERATE fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding 3.1.2 2.4.8 -
handlebars GHSA-xw65-4hp5-5hc7 MODERATE Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates 4.7.9 4.7.10 -
handlebars CVE-2026-106444 MODERATE Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates 4.7.9 - -
js-yaml CVE-2026-53550 MODERATE js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases 3.14.2 - -
js-yaml GHSA-h67p-54hq-rp68 MODERATE JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases 3.14.2 4.2.0 -
protobufjs GHSA-j3f2-48v5-ccww MODERATE protobufjs: Denial of Service via infinite loop in .proto option parsing 7.6.4 7.6.5 -
protobufjs CVE-2026-59877 MODERATE protobufjs: Denial of Service via infinite loop in .proto option parsing 7.6.4 - -
fast-uri GHSA-xhq7-xmqj-769h LOW fast-uri vulnerable to improper path equivalence in relative reference normalization 3.1.2 2.4.8 -
fast-uri CVE-2026-110095 LOW fast-uri vulnerable to improper path equivalence in relative reference normalization 3.1.2 - -
fast-uri CVE-2026-110725 LOW fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references 3.1.2 - -
fast-uri GHSA-333x-w4r6-6crp LOW fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references 3.1.2 2.4.8 -

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

@datadog-official

This comment has been minimized.

Sign in to view
@lym953
lym953 marked this pull request as ready for review October 28, 2026 18:44
Copilot AI balanced review requested due to automatic review settings October 28, 2026 18:44
@lym953
lym953 requested a review from a team as a code owner October 28, 2026 18:44
Copilot AI reviewed Oct 28, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The committed lockfile retains versions incompatible with the manifest’s overrides, leaving the YAML remediation unapplied and the dependency graph inconsistent for CI’s npm ci workflow.

1 open issue
1 file not reviewed
  • integration-tests/package-lock.json: Generated file
What changed in this PR

This PR updates dependencies used by the Datadog Lambda Extension’s integration tests to address reported security vulnerabilities.

Changes:

  • Raises Axios and AWS CDK dependency versions.
  • Adds targeted protobufjs and js-yaml overrides and revises existing overrides.
  • Updates locked dependencies, including Handlebars, follow-redirects, and brace-expansion, and removes CDK’s bundled fast-uri dependency.
File Description
integration-tests/​package.json Updates direct dependency ranges and transitive dependency overrides.
integration-tests/​package-lock.json Records dependency upgrades and changes to the resolved dependency tree.

Review effort: Balanced

Comment thread integration-tests/package-lock.json Outdated
}
},
"node_modules/@aws-sdk/xml-builder/node_modules/fast-xml-parser": {
"version": "5.7.3",
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 28, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e631a3f234

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread integration-tests/package.json Outdated
"fast-xml-builder": "^1.1.9"
"fast-xml-parser": "^5.8.0"
},
"jest": {

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Keep the Jest override tree installable with npm 11

With npm 11.4.2, a clean npm ci --ignore-scripts --no-audit --no-fund in integration-tests now exits with Invalid Version while resolving the newly added Jest/ts-jest override graph, so affected development and CI environments cannot install or run these integration tests. The parent manifest gets past dependency resolution, and deleting both new Jest override blocks from this revision does as well; please replace the deeply duplicated override graph with an npm-11-compatible override and regenerate the lockfile.

Useful? React with 👍 / 👎.

Comment thread integration-tests/package-lock.json Outdated
Comment on lines +558 to +560
"node_modules/@aws-sdk/xml-builder/node_modules/fast-xml-parser": {
"version": "5.7.3",
"resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.7.3.tgz",

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve the fast-xml-parser minimum in the lockfile

The manifest still overrides fast-xml-parser to ^5.8.0 beneath all six AWS clients, but this regenerated lockfile replaces the previous hoisted 5.9.0 resolution with 5.7.3 under their shared @aws-sdk/xml-builder. Lockfile-based installs can therefore use a parser below the explicitly retained minimum, undoing that dependency mitigation for AWS XML processing; override the shared XML builder path or retain a compatible resolution at or above 5.8.0.

Useful? React with 👍 / 👎.

Comment thread integration-tests/package.json Outdated
"@jest/transform": {
"babel-plugin-istanbul": {
"@istanbuljs/load-nyc-config": {
"js-yaml": "^3.15.2"

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Actually resolve the requested js-yaml upgrade

All of the newly added Jest/Istanbul paths request js-yaml ^3.15.2, but the regenerated lockfile still contains only node_modules/js-yaml 3.14.2. The integration-test pipeline runs npm ci from this lockfile at .gitlab/templates/pipeline.yaml.tpl:660, so even in the npm 10 environment where installation succeeds, the intended dependency remediation is not present in the installed Jest coverage chain; regenerate the lockfile so its selected js-yaml version satisfies the override.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-29T18:58:57.528139Z d3b89ca New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

dd-octo-sts-4caf68 Bot and others added 5 commits October 29, 2026 18:51
@dd-octo-sts-4caf68 @gh-worker-campaigns-3e9aa4
ADMS: vuln minor upgrades — 10 packages (minor: 4 · patch: 6) [integr…
b8460b4 
…ation-tests/package.json]

Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>
@dd-octo-sts-4caf68 @lym953
Empty commit to restart CI
0c08a49 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-authored-by: lym953 <10097700+lym953@users.noreply.github.com>
@dd-octo-sts-4caf68 @lym953
Regenerate package-lock.json with npm 10
89526dd 
CI installs with npm 10, which rejects the lock file that the bot wrote for the new overrides.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-authored-by: lym953 <10097700+lym953@users.noreply.github.com>
@dd-octo-sts-4caf68 @lym953
Bump aws-cdk to 2.1146.1
af5d407 
aws-cdk-lib 2.274.0 writes cloud assembly schema 55, which aws-cdk 2.1127.0 cannot read, so every cdk deploy failed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-authored-by: lym953 <10097700+lym953@users.noreply.github.com>
@dd-octo-sts-4caf68 @gh-worker-campaigns-3e9aa4
chore: regenerate lockfiles after rebase
d3b89ca 
Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>
@gh-worker-campaigns-3e9aa4

gh-worker-campaigns-3e9aa4 Bot commented Oct 29, 2026

Copy link
Copy Markdown
Contributor Author

Auto-rebase complete

Branch is up to date with main — rebased onto 13ad25e.

Auto-Rebase · Add no-auto-rebase to opt out

@dd-octo-sts-4caf68
dd-octo-sts-4caf68 Bot force-pushed the engraver-auto-version-upgrade/minorpatch/npm/integration-tests/0-1793009098 branch from e631a3f to d3b89ca Compare October 29, 2026 18:51
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 29, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d3b89ca9dd

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread integration-tests/package-lock.json
"version": "3.14.2",
"resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
"integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
"version": "3.15.2",

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Use a js-yaml release that fixes all listed advisories

When Jest coverage loads a crafted YAML nyc configuration, locking js-yaml to 3.15.2 still leaves the advertised GHSA-5p4m-2wfm-xmqj and GHSA-2883-xcg3-v3hh CPU-denial-of-service issues unfixed; the security details identify their fixes as 4.3.1 and 4.3.2 respectively. Upgrade the coverage dependency chain so it can resolve at least 4.3.2 rather than reporting the js-yaml remediation as complete with a vulnerable 3.x release.

AGENTS.md reference: AGENTS.md:L18-L23

Useful? React with 👍 / 👎.

Comment thread integration-tests/package-lock.json
"version": "1.1.15",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
"integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
"version": "1.1.21",

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Resolve the advertised browser-data security upgrades

On every lockfile-based install, this regenerated hunk still leaves the neighboring browserslist and baseline-browser-mapping entries at 4.28.2 and 2.10.37, although the PR summary advertises upgrades to 4.28.9 and 2.11.32 to address their denial-of-service vulnerabilities. Regenerate or override this dependency chain so clean npm ci installs contain the remediated versions rather than reporting upgrades that never landed.

AGENTS.md reference: AGENTS.md:L18-L23

Useful? React with 👍 / 👎.

Comment thread integration-tests/package-lock.json
}
},
"node_modules/@opentelemetry/exporter-trace-otlp-http/node_modules/@opentelemetry/core": {
"version": "1.29.0",

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Honor the OpenTelemetry core override in the lockfile

The manifest retains an @opentelemetry/exporter-trace-otlp-http override requiring @opentelemetry/core ^1.30.1, but this newly added nested node resolves 1.29.0. The resulting virtual dependency tree marks the exporter's overridden core edge invalid, so lockfile-based installs no longer reproducibly enforce the explicit minimum; regenerate the lockfile with 1.30.1 throughout the overridden exporter subtree.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
@litianningdatadog litianningdatadog Awaiting requested review from litianningdatadog litianningdatadog is a code owner automatically assigned from DataDog/serverless-aws

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

adms-critical-severity adms-custom-action-failed adms-dependency-update adms-high-severity adms-low-severity adms-medium-severity adms-minor-update adms-mode-all-vulns adms-npm bot_family:adms-dependency-update campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant