fix(deps): vuln minor upgrades — 12 packages (minor: 4 · patch: 8) [web-frontend]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 12 packages upgraded (MINOR changes included)

Manifests changed:

• web-frontend (npm)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
minimatch	3.1.2	3.1.5	patch	Transitive	6 HIGH
react-router	7.13.1	7.17.0	minor	Direct	4 HIGH, 2 MEDIUM
flatted	3.3.3	3.4.2	minor	Transitive	4 HIGH
picomatch	4.0.3	4.0.4	patch	Transitive	2 HIGH, 2 MEDIUM
vite	7.3.1	7.3.5	patch	Direct	2 HIGH, 1 MEDIUM
rollup	4.45.1	4.62.0	minor	Transitive	2 HIGH
ajv	6.12.6	6.15.0	minor	Transitive	2 MEDIUM
brace-expansion	1.1.12	1.1.15	patch	Transitive	2 MEDIUM
js-yaml	4.1.0	4.1.1	patch	Transitive	2 MEDIUM
yaml	1.10.2	1.10.3	patch	Transitive	2 MEDIUM
postcss	8.5.6	8.5.15	patch	Transitive	1 MEDIUM
@eslint/plugin-kit	0.3.3	0.3.5	patch	Transitive	1 LOW

---

Security Details

🚨 Critical & High Severity (20 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
flatted	GHSA-25h7-pfq9-p65f	HIGH	flatted vulnerable to unbounded recursion DoS in parse() revive phase	3.3.3	3.4.0
flatted	CVE-2026-32141	HIGH	flatted: Unbounded recursion DoS in parse() revive phase	3.3.3	-
flatted	GHSA-rf6f-7fwh-wjgh	HIGH	Prototype Pollution via parse() in NodeJS flatted	3.3.3	3.4.2
flatted	CVE-2026-33228	HIGH	flatted: Prototype Pollution via parse()	3.3.3	-
minimatch	GHSA-23c5-xmqv-rm74	HIGH	minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	3.1.2	10.2.3
minimatch	CVE-2026-26996	HIGH	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	3.1.2	-
minimatch	GHSA-3ppc-4f35-3m26	HIGH	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	3.1.2	10.2.1
minimatch	CVE-2026-27903	HIGH	minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	3.1.2	-
minimatch	GHSA-7r86-cg39-jmmj	HIGH	minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	3.1.2	10.2.3
minimatch	CVE-2026-27904	HIGH	minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	3.1.2	-
picomatch	CVE-2026-33671	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	4.0.3	-
picomatch	GHSA-c2c7-rcm5-vvqj	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	4.0.3	4.0.4
react-router	GHSA-49rj-9fvp-4h2h	HIGH	React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE	7.13.1	7.14.2
react-router	GHSA-8646-j5j9-6r62	HIGH	React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets	7.13.1	7.13.2
react-router	GHSA-8x6r-g9mw-2r78	HIGH	React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint	7.13.1	7.15.0
react-router	GHSA-rxv8-25v2-qmq8	HIGH	React Router vulnerable to Denial of Service via reflected user input in single-fetch	7.13.1	7.14.0
rollup	CVE-2026-27606	HIGH	Rollup 4 has Arbitrary File Write via Path Traversal	4.45.1	-
rollup	GHSA-mw96-cpmx-2vgc	HIGH	Rollup 4 has Arbitrary File Write via Path Traversal	4.45.1	2.80.0
vite	GHSA-p9ff-h696-f583	HIGH	Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket	7.3.1	8.0.5
vite	GHSA-v2wj-q39q-566r	HIGH	Vite: server.fs.deny bypassed with queries	7.3.1	8.0.5

ℹ️ Other Vulnerabilities (15)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
ajv	CVE-2025-69873	MODERATE	-	6.12.6	-
ajv	GHSA-2g4f-4pwh-qvx6	MODERATE	ajv has ReDoS when using $data option	6.12.6	8.18.0
brace-expansion	GHSA-f886-m6hf-6m8v	MODERATE	brace-expansion: Zero-step sequence causes process hang and memory exhaustion	1.1.12	5.0.5
brace-expansion	CVE-2026-33750	MODERATE	brace-expansion: Zero-step sequence causes process hang and memory exhaustion	1.1.12	-
js-yaml	CVE-2025-64718	MODERATE	js-yaml has prototype pollution in merge (<<)	4.1.0	-
js-yaml	GHSA-mh29-5h37-fv8m	MODERATE	js-yaml has prototype pollution in merge (<<)	4.1.0	4.1.1
picomatch	GHSA-3v7f-55p6-f55p	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	4.0.3	4.0.4
picomatch	CVE-2026-33672	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	4.0.3	-
postcss	GHSA-qx2v-qp2m-jg93	MODERATE	PostCSS has XSS via Unescaped </style> in its CSS Stringify Output	8.5.6	8.5.10
react-router	GHSA-2j2x-hqr9-3h42	MODERATE	React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation	7.13.1	7.14.1
react-router	GHSA-f22v-gfqf-p8f3	MODERATE	React Router has stored XSS via unescaped Location header in prerendered redirect HTML	7.13.1	7.13.2
vite	GHSA-4w7w-66w2-5vf9	MODERATE	Vite Vulnerable to Path Traversal in Optimized Deps .map Handling	7.3.1	8.0.5
yaml	GHSA-48c2-rrv3-qjmp	MODERATE	yaml is vulnerable to Stack Overflow via deeply nested YAML collections	1.10.2	2.8.3
yaml	CVE-2026-33532	MODERATE	yaml is vulnerable to Stack Overflow via deeply nested YAML collections	1.10.2	-
@eslint/plugin-kit	GHSA-xffm-g5w8-qvg7	LOW	@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser	0.3.3	0.3.4

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[datadog-prod-us1-4]

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 1 Pipeline job failed

Claude Code Review | claude-review     

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: aa67432 | Docs | Datadog PR Page | Give us feedback!}