fix(deps): vuln minor upgrades — 4 packages (minor: 3 · patch: 1) [package.json]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 4 packages upgraded (MINOR changes included)

Manifests changed:

• package.json (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
nanoid	3.3.8	3.3.18	patch	Transitive	4 HIGH
dd-trace	5.56.0	5.123.0	minor	Direct	2 HIGH
@sigstore/core	3.0.0	3.2.1	minor	Transitive	2 MEDIUM
ajv	6.12.6	6.15.0	minor	Transitive	2 MEDIUM

---

Security Details

🚨 Critical & High Severity (6 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
dd-trace	GHSA-wxqq-gcq8-c443	HIGH	dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS	5.56.0	5.100.0	-
dd-trace	CVE-2026-50272	HIGH	dd-trace: Improper parsing of W3C baggage headers may lead to DoS	5.56.0	-	-
nanoid	GHSA-28wg-ghj8-5hjv	HIGH	nanoid: non-secure generators can loop indefinitely with negative size	3.3.8	3.3.16	-
nanoid	CVE-2026-67214	HIGH	nanoid Infinite Loop via Negative Size in non-secure module	3.3.8	-	-
nanoid	GHSA-2v37-7h3g-55p8	HIGH	nanoid: custom generators can loop indefinitely when size is zero	3.3.8	3.3.18	-
nanoid	CVE-2026-67213	HIGH	nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom	3.3.8	-	-

ℹ️ Other Vulnerabilities (4)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
@sigstore/core	GHSA-jfc7-64v2-mr8c	MODERATE	@sigstore/core has DSSE payloadType type-binding failure	3.0.0	3.2.1	-
@sigstore/core	CVE-2026-48758	MODERATE	sigstore-js: DSSE payloadType type-binding failure	3.0.0	-	-
ajv	GHSA-2g4f-4pwh-qvx6	MODERATE	ajv has ReDoS when using $data option	6.12.6	8.18.0	-
ajv	CVE-2025-69873	MODERATE	-	6.12.6	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[Copilot]

Pull request overview

This PR aims to remediate reported dependency vulnerabilities by upgrading dd-trace and overriding several transitive dependencies via Yarn resolutions, with corresponding lockfile updates.

Changes:

• Upgraded direct dev dependency dd-trace to ^5.123.0.
• Updated transitive nanoid via resolutions to ^3.3.18.
• Added resolutions intended to bump transitive @sigstore/core and ajv (though the current yarn.lock still resolves older versions for these).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 3 comments.

File	Description
package.json	Bumps dd-trace, adjusts nanoid resolution, and adds resolutions for @sigstore/core and ajv.
yarn.lock	Updates the dependency graph/lockfile for the bumped dependencies (with remaining older @sigstore/core / ajv resolutions present).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with develop — rebased onto df00559.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}

[Copilot]

Pull request overview

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

package.json:134

• The new Yarn resolution for @sigstore/core doesn’t appear to be taking effect: yarn.lock still pins "@sigstore/core@npm:^3.0.0" to version 3.0.0 (see yarn.lock:4949-4952). This means the intended security upgrade to 3.2.1 isn’t actually applied via the lockfile.

    "@sigstore/core@npm:^3.0.0": "npm:^3.2.1",