fix(deps): vuln minor upgrades — 5 packages (minor: 3 · patch: 2)

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 5 packages upgraded (MINOR changes included)

Manifests changed:

• . (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
underscore	1.13.3	1.13.8	patch	Direct	2 HIGH
webpack-dev-server	5.0.4	5.2.3	minor	Direct	4 MODERATE
postcss	8.4.39	8.5.14	minor	Direct	1 MODERATE
webpack	5.94.0	5.106.2	minor	Direct	4 LOW
diff	3.5.0	3.5.1	patch	Direct	2 LOW

---

Security Details

🚨 Critical & High Severity (2 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
underscore	CVE-2026-27601	HIGH	Underscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack	1.13.3	-
underscore	GHSA-qpx9-hpmf-5gmw	HIGH	Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack	1.13.3	1.13.8

ℹ️ Other Vulnerabilities (11)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
postcss	GHSA-qx2v-qp2m-jg93	MODERATE	PostCSS has XSS via Unescaped </style> in its CSS Stringify Output	8.4.39	8.5.10
webpack-dev-server	GHSA-9jgg-88mc-972h	MODERATE	webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser	5.0.4	5.2.1
webpack-dev-server	CVE-2025-30360	MODERATE	webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser	5.0.4	-
webpack-dev-server	GHSA-4v9v-hfq4-rm2v	MODERATE	webpack-dev-server users' source code may be stolen when they access a malicious web site	5.0.4	5.2.1
webpack-dev-server	CVE-2025-30359	MODERATE	webpack-dev-server users' source code may be stolen when they access a malicious web site	5.0.4	-
diff	GHSA-73rr-hh4g-fpgx	LOW	jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch	3.5.0	8.0.3
diff	CVE-2026-24001	LOW	jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch	3.5.0	-
webpack	CVE-2025-68458	LOW	webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior	5.94.0	-
webpack	GHSA-8fgc-7cc6-rx7x	LOW	webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior	5.94.0	5.104.1
webpack	CVE-2025-68157	LOW	webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects	5.94.0	-
webpack	GHSA-38r7-794h-5758	LOW	webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence	5.94.0	5.104.0

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: Vulnerability Remediation (High)

🤖 Generated by DataDog Automated Dependency Management System