fix(deps): vuln minor upgrades — 12 packages (minor: 4 · patch: 8) [rum-react-navigation-codepush]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

• rum-react-navigation-codepush (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
nanoid	3.3.4	3.3.18	patch	Transitive	4 HIGH, 2 MEDIUM
picomatch	2.3.1	2.3.2	patch	Transitive	2 HIGH, 2 MEDIUM
@babel/plugin-transform-modules-systemjs	7.20.11	7.29.8	minor	Transitive	2 HIGH
semver	7.3.8	7.8.5	minor	Transitive	2 HIGH
braces	3.0.2	3.0.3	patch	Transitive	2 HIGH
cross-spawn	7.0.3	7.0.6	patch	Transitive	2 HIGH
cross-spawn	6.0.5	6.0.6	patch	Transitive	2 HIGH
semver	5.7.1	5.7.2	patch	Transitive	2 HIGH
semver	6.3.0	6.3.1	patch	Transitive	2 HIGH
follow-redirects	1.15.2	1.16.0	minor	Transitive	6 MEDIUM
uuid	8.0.0	8.3.2	minor	Transitive	3 MEDIUM
qs	6.11.0	6.15.3	minor	Transitive	2 MEDIUM, 2 LOW
joi	17.7.0	17.7.1	patch	Transitive	2 MEDIUM
micromatch	4.0.5	4.0.8	patch	Transitive	2 MEDIUM
yaml	1.10.2	1.10.3	patch	Transitive	2 MEDIUM

---

Security Details

🚨 Critical & High Severity (20 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
@babel/plugin-transform-modules-systemjs	CVE-2026-44728	HIGH	Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs	7.20.11	-	-
@babel/plugin-transform-modules-systemjs	GHSA-fv7c-fp4j-7gwp	HIGH	@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input	7.20.11	7.29.4	-
braces	GHSA-grv7-fg5c-xmjg	HIGH	Uncontrolled resource consumption in braces	3.0.2	3.0.3	-
braces	CVE-2024-4068	HIGH	Memory Exhaustion in braces	3.0.2	-	-
cross-spawn	CVE-2024-21538	HIGH	-	6.0.5	-	-
cross-spawn	GHSA-3xgq-45jj-v275	HIGH	Regular Expression Denial of Service (ReDoS) in cross-spawn	6.0.5	7.0.5	-
cross-spawn	CVE-2024-21538	HIGH	-	7.0.3	-	-
cross-spawn	GHSA-3xgq-45jj-v275	HIGH	Regular Expression Denial of Service (ReDoS) in cross-spawn	7.0.3	7.0.5	-
nanoid	CVE-2026-67214	HIGH	nanoid before 5.1.16 Infinite Loop via Negative Size in non-secure module	3.3.4	-	-
nanoid	GHSA-2v37-7h3g-55p8	HIGH	nanoid: custom generators can loop indefinitely when size is zero	3.3.4	3.3.17	-
nanoid	GHSA-28wg-ghj8-5hjv	HIGH	nanoid: non-secure generators can loop indefinitely with negative size	3.3.4	3.3.16	-
nanoid	CVE-2026-67213	HIGH	nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom	3.3.4	-	-
picomatch	CVE-2026-33671	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	2.3.1	-	-
picomatch	GHSA-c2c7-rcm5-vvqj	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	2.3.1	4.0.4	-
semver	CVE-2022-25883	HIGH	-	6.3.0	-	-
semver	GHSA-c2qf-rxjj-qqgw	HIGH	semver vulnerable to Regular Expression Denial of Service	6.3.0	7.5.2	-
semver	GHSA-c2qf-rxjj-qqgw	HIGH	semver vulnerable to Regular Expression Denial of Service	7.3.8	7.5.2	-
semver	CVE-2022-25883	HIGH	-	7.3.8	-	-
semver	CVE-2022-25883	HIGH	-	5.7.1	-	-
semver	GHSA-c2qf-rxjj-qqgw	HIGH	semver vulnerable to Regular Expression Denial of Service	5.7.1	7.5.2	-

ℹ️ Other Vulnerabilities (23)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
follow-redirects	GHSA-jchw-25xp-jwwc	MODERATE	Follow Redirects improperly handles URLs in the url.parse() function	1.15.2	1.15.4	-
follow-redirects	GHSA-r4q5-vmmm-2653	MODERATE	follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets	1.15.2	1.16.0	-
follow-redirects	CVE-2024-28849	MODERATE	Proxy-Authorization header kept across hosts in follow-redirects	1.15.2	-	-
follow-redirects	CVE-2026-40895	MODERATE	follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets	1.15.2	-	-
follow-redirects	CVE-2023-26159	MODERATE	-	1.15.2	-	-
follow-redirects	GHSA-cxjh-pqwp-8mfp	MODERATE	follow-redirects' Proxy-Authorization header kept across hosts	1.15.2	1.15.6	-
joi	GHSA-q7cg-457f-vx79	MODERATE	joi has an uncaught RangeError on deeply nested input through recursive link() schemas	17.7.0	18.2.1	-
joi	CVE-2026-48038	MODERATE	joi: Uncaught RangeError on deeply nested input through recursive link() schemas	17.7.0	-	-
micromatch	GHSA-952p-6rrq-rcjv	MODERATE	Regular Expression Denial of Service (ReDoS) in micromatch	4.0.5	4.0.8	-
micromatch	CVE-2024-4067	MODERATE	Regular Expression Denial of Service in micromatch	4.0.5	-	-
nanoid	CVE-2024-55565	MODERATE	-	3.3.4	-	-
nanoid	GHSA-mwcw-c2x4-8c55	MODERATE	Predictable results in nanoid generation when given non-integer values	3.3.4	5.0.9	-
picomatch	GHSA-3v7f-55p6-f55p	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	2.3.1	4.0.4	-
picomatch	CVE-2026-33672	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	2.3.1	-	-
qs	CVE-2025-15284	MODERATE	arrayLimit bypass in bracket notation allows DoS via memory exhaustion	6.11.0	-	-
qs	GHSA-6rw7-vpxm-498p	MODERATE	qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion	6.11.0	6.14.1	-
uuid	CVE-2026-41988	MODERATE	-	8.0.0	-	-
uuid	CVE-2026-41907	MODERATE	uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided	8.0.0	-	-
uuid	GHSA-w5hq-g745-h8pq	MODERATE	uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided	8.0.0	11.1.1	-
yaml	GHSA-48c2-rrv3-qjmp	MODERATE	yaml is vulnerable to Stack Overflow via deeply nested YAML collections	1.10.2	2.8.3	-
yaml	CVE-2026-33532	MODERATE	yaml is vulnerable to Stack Overflow via deeply nested YAML collections	1.10.2	-	-
qs	CVE-2026-2391	LOW	qs's arrayLimit bypass in comma parsing allows denial of service	6.11.0	-	-
qs	GHSA-w7fw-mjwx-w883	LOW	qs's arrayLimit bypass in comma parsing allows denial of service	6.11.0	6.14.2	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System