fix(deps): vuln minor upgrades — 4 packages (minor: 3 · patch: 1)

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 4 packages upgraded (MINOR changes included)

Manifests changed:

• . (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
nanoid	3.3.8	3.3.18	patch	Transitive	4 HIGH
dd-trace	5.56.0	5.121.0	minor	Direct	2 HIGH
@sigstore/core	3.0.0	3.2.1	minor	Transitive	2 MEDIUM
ajv	6.12.6	6.15.0	minor	Transitive	2 MEDIUM

---

Security Details

🚨 Critical & High Severity (6 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
dd-trace	GHSA-wxqq-gcq8-c443	HIGH	dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS	5.56.0	5.100.0	-
dd-trace	CVE-2026-50272	HIGH	dd-trace: Improper parsing of W3C baggage headers may lead to DoS	5.56.0	-	-
nanoid	GHSA-2v37-7h3g-55p8	HIGH	nanoid: custom generators can loop indefinitely when size is zero	3.3.8	3.3.17	-
nanoid	CVE-2026-67213	HIGH	nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom	3.3.8	-	-
nanoid	GHSA-28wg-ghj8-5hjv	HIGH	nanoid: non-secure generators can loop indefinitely with negative size	3.3.8	3.3.16	-
nanoid	CVE-2026-67214	HIGH	nanoid before 5.1.16 Infinite Loop via Negative Size in non-secure module	3.3.8	-	-

ℹ️ Other Vulnerabilities (4)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
@sigstore/core	GHSA-jfc7-64v2-mr8c	MODERATE	@sigstore/core has DSSE payloadType type-binding failure	3.0.0	3.2.1	-
@sigstore/core	CVE-2026-48758	MODERATE	sigstore-js: DSSE payloadType type-binding failure	3.0.0	-	-
ajv	GHSA-2g4f-4pwh-qvx6	MODERATE	ajv has ReDoS when using $data option	6.12.6	8.18.0	-
ajv	CVE-2025-69873	MODERATE	-	6.12.6	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates dependency lockstate and package constraints to bring the Datadog tracing stack and related transitive dependencies up to newer versions (including security/bugfix updates) and refresh Yarn resolutions.

Changes:

• Bump dd-trace from ^5.28.0 to ^5.121.0 and update yarn.lock accordingly.
• Update the nanoid override and add new Yarn resolution entries for @sigstore/core and ajv.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File	Description
yarn.lock	Regenerated lockfile reflecting updated dd-trace and transitive dependency graph.
package.json	Updates dd-trace version and adjusts/adds Yarn resolution overrides (nanoid, @sigstore/core, ajv).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.