fix(deps): vuln minor upgrades — 10 packages (minor: 4 · patch: 6) [rum-expo-react-navigation]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

• rum-expo-react-navigation (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
ws	8.17.0	8.21.3	minor	Transitive	4 HIGH, 2 MEDIUM
@grpc/grpc-js	1.10.8	1.10.12	patch	Transitive	4 HIGH, 2 MEDIUM
nanoid	3.3.7	3.3.18	patch	Transitive	4 HIGH, 2 MEDIUM
ws	7.4.6	7.5.13	minor	Transitive	4 HIGH
ws	6.2.2	6.2.6	patch	Transitive	4 HIGH
js-yaml	4.1.0	4.3.1	minor	Transitive	3 HIGH, 4 MEDIUM
js-yaml	3.13.1	3.15.1	minor	Transitive	3 HIGH, 4 MEDIUM
postcss	8.4.38	8.5.26	minor	Transitive	3 HIGH, 4 MEDIUM
picomatch	3.0.1	3.0.2	patch	Transitive	2 HIGH, 2 MEDIUM
picomatch	2.3.1	2.3.2	patch	Transitive	2 HIGH, 2 MEDIUM
glob	10.4.1	10.5.0	minor	Transitive	2 HIGH
braces	3.0.2	3.0.3	patch	Transitive	2 HIGH
cross-spawn	6.0.5	6.0.6	patch	Transitive	2 HIGH
cross-spawn	7.0.3	7.0.6	patch	Transitive	2 HIGH
jws	4.0.0	4.0.1	patch	Transitive	2 HIGH

---

Security Details

🚨 Critical & High Severity (43 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
@grpc/grpc-js	GHSA-99f4-grh7-6pcq	HIGH	@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash	1.10.8	1.9.16	-
@grpc/grpc-js	CVE-2026-48069	HIGH	@grpc/grps-js: An incoming malformed compressed message can cause a client or server crash	1.10.8	-	-
@grpc/grpc-js	GHSA-5375-pq7m-f5r2	HIGH	@grpc/grpc-js: A malformed request can cause a server crash	1.10.8	1.9.16	-
@grpc/grpc-js	CVE-2026-48068	HIGH	@grpc/grps-js: A malformed request can cause a server crash	1.10.8	-	-
braces	GHSA-grv7-fg5c-xmjg	HIGH	Uncontrolled resource consumption in braces	3.0.2	3.0.3	-
braces	CVE-2024-4068	HIGH	Memory Exhaustion in braces	3.0.2	-	-
cross-spawn	GHSA-3xgq-45jj-v275	HIGH	Regular Expression Denial of Service (ReDoS) in cross-spawn	6.0.5	7.0.5	-
cross-spawn	CVE-2024-21538	HIGH	-	6.0.5	-	-
cross-spawn	GHSA-3xgq-45jj-v275	HIGH	Regular Expression Denial of Service (ReDoS) in cross-spawn	7.0.3	7.0.5	-
cross-spawn	CVE-2024-21538	HIGH	-	7.0.3	-	-
glob	GHSA-5j98-mcp5-4vw2	HIGH	glob CLI: Command injection via -c/--cmd executes matches with shell:true	10.4.1	11.1.0	-
glob	CVE-2025-64756	HIGH	glob CLI: Command injection via -c/--cmd executes matches with shell:true	10.4.1	-	-
js-yaml	CVE-2026-59869	HIGH	js-yaml: YAML merge-key chains can force quadratic CPU consumption	4.1.0	-	-
js-yaml	GHSA-52cp-r559-cp3m	HIGH	js-yaml: YAML merge-key chains can force quadratic CPU consumption	3.13.1	3.15.0	-
js-yaml	CVE-2026-59869	HIGH	js-yaml: YAML merge-key chains can force quadratic CPU consumption	3.13.1	-	-
js-yaml	GHSA-5p4m-2wfm-xmqj	HIGH	JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported	3.13.1	4.3.1	-
js-yaml	GHSA-5p4m-2wfm-xmqj	HIGH	JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported	4.1.0	4.3.1	-
js-yaml	GHSA-52cp-r559-cp3m	HIGH	js-yaml: YAML merge-key chains can force quadratic CPU consumption	4.1.0	3.15.0	-
jws	GHSA-869p-cjfg-cm3x	HIGH	auth0/node-jws Improperly Verifies HMAC Signature	4.0.0	3.2.3	-
jws	CVE-2025-65945	HIGH	auth0/node-jws improper HMAC signature verification vulnerability	4.0.0	-	-
nanoid	CVE-2026-67213	HIGH	nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom	3.3.7	-	-
nanoid	GHSA-2v37-7h3g-55p8	HIGH	nanoid: custom generators can loop indefinitely when size is zero	3.3.7	3.3.17	-
nanoid	GHSA-28wg-ghj8-5hjv	HIGH	nanoid: non-secure generators can loop indefinitely with negative size	3.3.7	3.3.16	-
nanoid	CVE-2026-67214	HIGH	nanoid before 5.1.16 Infinite Loop via Negative Size in non-secure module	3.3.7	-	-
picomatch	GHSA-c2c7-rcm5-vvqj	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	2.3.1	4.0.4	-
picomatch	GHSA-c2c7-rcm5-vvqj	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	3.0.1	4.0.4	-
picomatch	CVE-2026-33671	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	3.0.1	-	-
picomatch	CVE-2026-33671	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	2.3.1	-	-
postcss	CVE-2026-45623	HIGH	PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments	8.4.38	-	-
postcss	GHSA-r28c-9q8g-f849	HIGH	PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure	8.4.38	8.5.18	-
postcss	GHSA-6g55-p6wh-862q	HIGH	PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments	8.4.38	8.5.12	-
ws	GHSA-3h5v-q93c-6h6q	HIGH	ws affected by a DoS when handling a request with many HTTP headers	6.2.2	5.2.4	-
ws	CVE-2026-48779	HIGH	ws: Memory exhaustion DoS from tiny fragments and data chunks	6.2.2	-	-
ws	CVE-2024-37890	HIGH	Denial of service when handling a request with many HTTP headers in ws	8.17.0	-	-
ws	GHSA-3h5v-q93c-6h6q	HIGH	ws affected by a DoS when handling a request with many HTTP headers	8.17.0	5.2.4	-
ws	GHSA-96hv-2xvq-fx4p	HIGH	ws: Memory exhaustion DoS from tiny fragments and data chunks	7.4.6	5.2.5	-
ws	CVE-2024-37890	HIGH	Denial of service when handling a request with many HTTP headers in ws	7.4.6	-	-
ws	CVE-2026-48779	HIGH	ws: Memory exhaustion DoS from tiny fragments and data chunks	7.4.6	-	-
ws	GHSA-96hv-2xvq-fx4p	HIGH	ws: Memory exhaustion DoS from tiny fragments and data chunks	8.17.0	5.2.5	-
ws	GHSA-3h5v-q93c-6h6q	HIGH	ws affected by a DoS when handling a request with many HTTP headers	7.4.6	5.2.4	-
ws	CVE-2024-37890	HIGH	Denial of service when handling a request with many HTTP headers in ws	6.2.2	-	-
ws	CVE-2026-48779	HIGH	ws: Memory exhaustion DoS from tiny fragments and data chunks	8.17.0	-	-
ws	GHSA-96hv-2xvq-fx4p	HIGH	ws: Memory exhaustion DoS from tiny fragments and data chunks	6.2.2	5.2.5	-

ℹ️ Other Vulnerabilities (22)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
@grpc/grpc-js	GHSA-7v5v-9h63-cj86	MODERATE	@grpc/grpc-js can allocate memory for incoming messages well above configured limits	1.10.8	1.10.9	-
@grpc/grpc-js	CVE-2024-37168	MODERATE	@grpc/grpc-js can allocate memory for incoming messages well above configured limits	1.10.8	-	-
js-yaml	CVE-2026-53550	MODERATE	js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases	3.13.1	-	-
js-yaml	GHSA-h67p-54hq-rp68	MODERATE	JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases	3.13.1	4.2.0	-
js-yaml	CVE-2025-64718	MODERATE	js-yaml has prototype pollution in merge (<<)	3.13.1	-	-
js-yaml	GHSA-mh29-5h37-fv8m	MODERATE	js-yaml has prototype pollution in merge (<<)	3.13.1	4.1.1	-
js-yaml	CVE-2025-64718	MODERATE	js-yaml has prototype pollution in merge (<<)	4.1.0	-	-
js-yaml	GHSA-mh29-5h37-fv8m	MODERATE	js-yaml has prototype pollution in merge (<<)	4.1.0	4.1.1	-
js-yaml	CVE-2026-53550	MODERATE	js-yaml: Quadratic-complexity DoS in merge key handling via repeated aliases	4.1.0	-	-
js-yaml	GHSA-h67p-54hq-rp68	MODERATE	JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases	4.1.0	4.2.0	-
nanoid	GHSA-mwcw-c2x4-8c55	MODERATE	Predictable results in nanoid generation when given non-integer values	3.3.7	5.0.9	-
nanoid	CVE-2024-55565	MODERATE	-	3.3.7	-	-
picomatch	GHSA-3v7f-55p6-f55p	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	3.0.1	4.0.4	-
picomatch	CVE-2026-33672	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	3.0.1	-	-
picomatch	GHSA-3v7f-55p6-f55p	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	2.3.1	4.0.4	-
picomatch	CVE-2026-33672	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	2.3.1	-	-
postcss	CVE-2026-69153	MODERATE	PostCSS: incomplete fix of CVE-2026-45623 — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset	8.4.38	-	-
postcss	GHSA-fxqj-rqcc-2cmp	MODERATE	PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when from is unset	8.4.38	8.5.23	-
postcss	CVE-2026-41305	MODERATE	PostCSS has XSS via Unescaped </style> in its CSS Stringify Output	8.4.38	-	-
postcss	GHSA-qx2v-qp2m-jg93	MODERATE	PostCSS has XSS via Unescaped </style> in its CSS Stringify Output	8.4.38	8.5.10	-
ws	CVE-2026-45736	MODERATE	ws: Uninitialized memory disclosure	8.17.0	-	-
ws	GHSA-58qx-3vcg-4xpx	MODERATE	ws: Uninitialized memory disclosure	8.17.0	8.20.1	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System