fix(deps): vuln minor upgrades — 4 packages (minor: 3 · patch: 1) [package.json]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 4 packages upgraded (MINOR changes included)

Manifests changed:

• package.json (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
nanoid	3.3.8	3.3.18	patch	Transitive	4 HIGH
dd-trace	5.56.0	5.123.0	minor	Direct	2 HIGH
@sigstore/core	3.0.0	3.2.1	minor	Transitive	2 MEDIUM
ajv	6.12.6	6.15.0	minor	Transitive	2 MEDIUM

---

Security Details

🚨 Critical & High Severity (6 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
dd-trace	GHSA-wxqq-gcq8-c443	HIGH	dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS	5.56.0	5.100.0	-
dd-trace	CVE-2026-50272	HIGH	dd-trace: Improper parsing of W3C baggage headers may lead to DoS	5.56.0	-	-
nanoid	GHSA-28wg-ghj8-5hjv	HIGH	nanoid: non-secure generators can loop indefinitely with negative size	3.3.8	3.3.16	-
nanoid	CVE-2026-67214	HIGH	nanoid Infinite Loop via Negative Size in non-secure module	3.3.8	-	-
nanoid	GHSA-2v37-7h3g-55p8	HIGH	nanoid: custom generators can loop indefinitely when size is zero	3.3.8	3.3.18	-
nanoid	CVE-2026-67213	HIGH	nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom	3.3.8	-	-

ℹ️ Other Vulnerabilities (4)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
@sigstore/core	GHSA-jfc7-64v2-mr8c	MODERATE	@sigstore/core has DSSE payloadType type-binding failure	3.0.0	3.2.1	-
@sigstore/core	CVE-2026-48758	MODERATE	sigstore-js: DSSE payloadType type-binding failure	3.0.0	-	-
ajv	GHSA-2g4f-4pwh-qvx6	MODERATE	ajv has ReDoS when using $data option	6.12.6	8.18.0	-
ajv	CVE-2025-69873	MODERATE	-	6.12.6	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[Copilot]

Pull request overview

This PR aims to remediate reported dependency vulnerabilities by upgrading dd-trace and overriding several transitive dependencies via Yarn resolutions, with corresponding lockfile updates.

Changes:

• Upgraded direct dev dependency dd-trace to ^5.123.0.
• Updated transitive nanoid via resolutions to ^3.3.18.
• Added resolutions intended to bump transitive @sigstore/core and ajv (though the current yarn.lock still resolves older versions for these).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.

File	Description
package.json	Bumps dd-trace, adjusts nanoid resolution, and adds resolutions for @sigstore/core and ajv.
yarn.lock	Updates the dependency graph/lockfile for the bumped dependencies (with remaining older @sigstore/core / ajv resolutions present).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with develop — rebased onto 9a5e2a4.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

package.json:134

• The new Yarn resolution for @sigstore/core doesn’t appear to be taking effect: yarn.lock still pins "@sigstore/core@npm:^3.0.0" to version 3.0.0 (see yarn.lock:4949-4952). This means the intended security upgrade to 3.2.1 isn’t actually applied via the lockfile.

    "@sigstore/core@npm:^3.0.0": "npm:^3.2.1",

[cdn34dd]

We should review the dependencies we have in the project, here dd-trace is listed as a dependency, but I don't think it's used anywhere in the project and should probably be removed.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (3)

package.json:136

• The new resolutions entries for @sigstore/core and ajv don't appear to be applied in yarn.lock yet (the lock still pins @sigstore/core@^3.0.0 to 3.0.0 and ajv@^6.x to 6.12.6). As a result, this PR likely does not actually upgrade those transitive packages or remediate the reported vulnerabilities. Please re-run yarn install (or the repo’s standard lockfile update command) and commit the updated yarn.lock, and ensure the PR description reflects the versions that are truly locked.

    "@sigstore/core@npm:^3.0.0": "npm:^3.2.1",
    "ajv@npm:^6.10.0": "npm:^6.15.0",
    "ajv@npm:^6.12.4": "npm:^6.15.0"

package.json:136

• In this repo’s resolutions block, most overrides are pinned to exact versions. Using semver ranges here (npm:^…) makes the override non-deterministic and can allow future unreviewed changes when the lockfile is regenerated.

    "@sigstore/core@npm:^3.0.0": "npm:^3.2.1",
    "ajv@npm:^6.10.0": "npm:^6.15.0",
    "ajv@npm:^6.12.4": "npm:^6.15.0"

package.json:107

• resolutions generally pins exact versions in this file (e.g., lodash, tmp, send). Using a range for nanoid makes the override less deterministic when regenerating the lockfile.

    "nanoid": "^3.3.18",