fix(deps): vuln minor upgrades — 15 packages (minor: 3 · patch: 12) [javascript/browser/http/package.json]

[gh-worker-campaigns-3e9aa4]

Summary: Critical-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

• javascript/browser/http/package.json (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
url-parse	1.4.7	1.5.10	minor	Transitive	2 CRITICAL, 10 MEDIUM
websocket-driver	0.7.3	0.7.5	patch	Transitive	2 CRITICAL, 2 MEDIUM
fsevents	1.2.9	1.2.13	patch	Transitive	2 CRITICAL
minimist	1.2.0	1.2.8	patch	Transitive	1 CRITICAL, 1 MEDIUM
minimatch	3.0.4	3.1.5	minor	Transitive	8 HIGH
brace-expansion	1.1.11	1.1.18	patch	Transitive	6 HIGH, 2 MEDIUM, 2 LOW
path-to-regexp	0.1.7	0.1.13	patch	Transitive	6 HIGH
ansi-regex	3.0.0	3.0.1	patch	Transitive	2 HIGH
decode-uri-component	0.2.0	0.2.2	patch	Transitive	2 HIGH
ini	1.3.5	1.3.8	patch	Transitive	2 HIGH
kind-of	6.0.2	6.0.3	patch	Transitive	2 HIGH
semver	5.7.1	5.7.2	patch	Transitive	2 HIGH
websocket-extensions	0.1.3	0.1.4	patch	Transitive	2 HIGH
uuid	3.3.3	3.4.0	minor	Transitive	3 MEDIUM
hosted-git-info	2.8.5	2.8.9	patch	Transitive	2 MEDIUM

---

Security Details

🚨 Critical & High Severity (39 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
fsevents	CVE-2023-45311	CRITICAL	-	1.2.9	-	-
fsevents	GHSA-8r6j-v8pm-fqw3	CRITICAL	Code injection in fsevents	1.2.9	1.2.11	-
minimist	GHSA-xvch-5gv4-984h	CRITICAL	Prototype Pollution in minimist	1.2.0	1.2.6	-
url-parse	CVE-2022-0686	CRITICAL	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-	-
url-parse	GHSA-hgjh-723h-mx2j	CRITICAL	Authorization Bypass Through User-Controlled Key in url-parse	1.4.7	1.5.8	-
websocket-driver	CVE-2026-54466	CRITICAL	websocket-driver: Message corruption via abuse of protocol length headers	0.7.3	-	-
websocket-driver	GHSA-xv26-6w52-cph6	CRITICAL	websocket-driver: Message corruption via abuse of protocol length headers	0.7.3	0.7.5	-
ansi-regex	CVE-2021-3807	HIGH	-	3.0.0	-	-
ansi-regex	GHSA-93q8-gq69-wqmw	HIGH	Inefficient Regular Expression Complexity in chalk/ansi-regex	3.0.0	6.0.1	-
brace-expansion	CVE-2026-69152	HIGH	brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation	1.1.11	-	-
brace-expansion	GHSA-rgw5-rvv9-x895	HIGH	brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation	1.1.11	1.1.18	-
brace-expansion	CVE-2026-14257	HIGH	brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash	1.1.11	-	-
brace-expansion	GHSA-mh99-v99m-4gvg	HIGH	brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash	1.1.11	5.0.8	-
brace-expansion	CVE-2026-13149	HIGH	-	1.1.11	-	-
brace-expansion	GHSA-3jxr-9vmj-r5cp	HIGH	brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups	1.1.11	5.0.7	-
decode-uri-component	CVE-2022-38900	HIGH	-	0.2.0	-	-
decode-uri-component	GHSA-w573-4hg7-7wgq	HIGH	decode-uri-component vulnerable to Denial of Service (DoS)	0.2.0	0.2.1	-
ini	GHSA-qqgx-2p2h-9c37	HIGH	ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse	1.3.5	1.3.6	-
ini	CVE-2020-7788	HIGH	-	1.3.5	-	-
kind-of	CVE-2019-20149	HIGH	-	6.0.2	-	-
kind-of	GHSA-6c8f-qphg-qjgp	HIGH	Validation Bypass in kind-of	6.0.2	6.0.3	-
minimatch	CVE-2022-3517	HIGH	-	3.0.4	-	-
minimatch	GHSA-f8q6-p94x-37v3	HIGH	minimatch ReDoS vulnerability	3.0.4	3.0.5	-
minimatch	CVE-2026-27903	HIGH	minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	3.0.4	-	-
minimatch	GHSA-23c5-xmqv-rm74	HIGH	minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	3.0.4	10.2.3	-
minimatch	GHSA-3ppc-4f35-3m26	HIGH	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	3.0.4	10.2.1	-
minimatch	CVE-2026-26996	HIGH	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	3.0.4	-	-
minimatch	GHSA-7r86-cg39-jmmj	HIGH	minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	3.0.4	10.2.3	-
minimatch	CVE-2026-27904	HIGH	minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	3.0.4	-	-
path-to-regexp	CVE-2026-4867	HIGH	path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters	0.1.7	-	-
path-to-regexp	GHSA-37ch-88jc-xwx2	HIGH	path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters	0.1.7	0.1.13	-
path-to-regexp	CVE-2024-45296	HIGH	path-to-regexp outputs backtracking regular expressions	0.1.7	-	-
path-to-regexp	GHSA-9wv6-86v2-598j	HIGH	path-to-regexp outputs backtracking regular expressions	0.1.7	1.9.0	-
path-to-regexp	GHSA-rhx6-c78j-4q9w	HIGH	path-to-regexp contains a ReDoS	0.1.7	0.1.12	-
path-to-regexp	CVE-2024-52798	HIGH	path-to-regexp Unpatched path-to-regexp ReDoS in 0.1.x	0.1.7	-	-
semver	GHSA-c2qf-rxjj-qqgw	HIGH	semver vulnerable to Regular Expression Denial of Service	5.7.1	7.5.2	-
semver	CVE-2022-25883	HIGH	-	5.7.1	-	-
websocket-extensions	GHSA-g78m-2chm-r7qv	HIGH	Regular Expression Denial of Service in websocket-extensions (NPM package)	0.1.3	0.1.4	-
websocket-extensions	CVE-2020-7662	HIGH	-	0.1.3	-	-

ℹ️ Other Vulnerabilities (22)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
brace-expansion	GHSA-f886-m6hf-6m8v	MODERATE	brace-expansion: Zero-step sequence causes process hang and memory exhaustion	1.1.11	5.0.5	-
brace-expansion	CVE-2026-33750	MODERATE	brace-expansion: Zero-step sequence causes process hang and memory exhaustion	1.1.11	-	-
hosted-git-info	CVE-2021-23362	MODERATE	-	2.8.5	-	-
hosted-git-info	GHSA-43f8-2h32-f4cj	MODERATE	Regular Expression Denial of Service in hosted-git-info	2.8.5	2.8.9	-
minimist	GHSA-vh95-rmgr-6w4m	MODERATE	Prototype Pollution in minimist	1.2.0	0.2.1	-
url-parse	CVE-2022-0512	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-	-
url-parse	GHSA-9m6j-fcg5-2442	MODERATE	Path traversal in url-parse	1.4.7	1.5.0	-
url-parse	CVE-2022-0691	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-	-
url-parse	GHSA-8v38-pw62-9cw2	MODERATE	url-parse Incorrectly parses URLs that include an '@'	1.4.7	1.5.7	-
url-parse	CVE-2022-0639	MODERATE	Authorization Bypass Through User-Controlled Key in unshiftio/url-parse	1.4.7	-	-
url-parse	GHSA-rqff-837h-mm52	MODERATE	Authorization bypass in url-parse	1.4.7	1.5.6	-
url-parse	CVE-2021-3664	MODERATE	-	1.4.7	-	-
url-parse	GHSA-hh27-ffr2-f2jc	MODERATE	Open redirect in url-parse	1.4.7	1.5.2	-
url-parse	CVE-2021-27515	MODERATE	-	1.4.7	-	-
url-parse	GHSA-jf5r-8hm2-f872	MODERATE	url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.	1.4.7	1.5.9	-
uuid	GHSA-w5hq-g745-h8pq	MODERATE	uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided	3.3.3	11.1.1	-
uuid	CVE-2026-41988	MODERATE	-	3.3.3	-	-
uuid	CVE-2026-41907	MODERATE	uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided	3.3.3	-	-
websocket-driver	GHSA-mp7j-qc5w-4988	MODERATE	websocket-driver: Resource limit bypass via message compression	0.7.3	0.7.5	-
websocket-driver	CVE-2026-54490	MODERATE	websocket-driver: Resource limit bypass via message compression	0.7.3	-	-
brace-expansion	GHSA-v6h2-p8h4-qcjw	LOW	brace-expansion Regular Expression Denial of Service vulnerability	1.1.11	2.0.2	-
brace-expansion	CVE-2025-5889	LOW	juliangruber brace-expansion index.js expand redos	1.1.11	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System