Skip to content

fix(deps): vuln minor upgrades — 11 packages (minor: 5 · patch: 6) [integration-tests]#1262

Closed
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/integration-tests/1-1781564316
Closed

fix(deps): vuln minor upgrades — 11 packages (minor: 5 · patch: 6) [integration-tests]#1262
gh-worker-campaigns-3e9aa4[bot] wants to merge 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/integration-tests/1-1781564316

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

Summary: Critical-severity security update — 11 packages upgraded (MINOR changes included)

Manifests changed:

  • integration-tests (npm)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
protobufjs 7.5.4 7.6.4 minor Transitive 1 CRITICAL, 5 HIGH, 5 MEDIUM
axios 1.15.0 1.17.0 minor Direct 11 HIGH, 9 MEDIUM, 1 LOW
fast-uri 3.1.0 3.1.2 patch Transitive 2 HIGH
fast-xml-builder 1.1.4 1.1.9 patch Transitive 1 HIGH
form-data 4.0.5 4.0.6 patch Transitive 1 HIGH
@opentelemetry/core 1.29.0 1.30.1 minor Transitive 1 MEDIUM
fast-xml-parser 5.5.8 5.8.0 minor Transitive 1 MEDIUM
follow-redirects 1.15.11 1.16.0 minor Transitive 1 MEDIUM
@protobufjs/utf8 1.1.0 1.1.1 patch Transitive 1 MEDIUM
brace-expansion 5.0.5 5.0.6 patch Transitive 1 MEDIUM
@babel/core 7.29.0 7.29.7 patch Transitive 1 LOW

Security Details

🚨 Critical & High Severity (21 fixed)
Package CVE Severity Summary Unsafe Version Fixed In
protobufjs GHSA-xq3m-2v4x-88gg CRITICAL Arbitrary code execution in protobufjs 7.5.4 8.0.1
axios GHSA-j5f8-grm9-p9fc HIGH Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection 1.15.0 1.16.0
axios GHSA-pjwm-pj3p-43mv HIGH axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) 1.15.0 1.16.0
axios GHSA-6chq-wfr3-2hj9 HIGH Axios: Header Injection via Prototype Pollution 1.15.0 1.15.1
axios GHSA-p92q-9vqr-4j8v HIGH Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter 1.15.0 1.16.0
axios GHSA-777c-7fjr-54vf HIGH Allocation of Resources Without Limits or Throttling in Axios 1.15.0 1.16.0
axios GHSA-3g43-6gmg-66jw HIGH axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge 1.15.0 1.15.2
axios GHSA-hfxv-24rg-xrqf HIGH Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection 1.15.0 1.16.0
axios GHSA-q8qp-cvcw-x6jj HIGH Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking 1.15.0 1.15.2
axios GHSA-pmwg-cvhr-8vh7 HIGH Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 1.15.0 1.15.1
axios GHSA-pf86-5x62-jrwf HIGH Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking 1.15.0 1.15.1
axios GHSA-35jp-ww65-95wh HIGH axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in config.proxy 1.15.0 1.16.0
fast-uri GHSA-v39h-62p7-jpjc HIGH fast-uri vulnerable to host confusion via percent-encoded authority delimiters 3.1.0 3.1.2
fast-uri GHSA-q3j6-qgpj-74h6 HIGH fast-uri vulnerable to path traversal via percent-encoded dot segments 3.1.0 3.1.1
fast-xml-builder GHSA-5wm8-gmm8-39j9 HIGH fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes 1.1.4 1.1.7
form-data GHSA-hmw2-7cc7-3qxx HIGH form-data: CRLF injection in form-data via unescaped multipart field names and filenames 4.0.5 2.5.6
protobufjs GHSA-wcpc-wj8m-hjx6 HIGH protobufjs: Denial of service through unbounded Any expansion during JSON conversion 7.5.4 7.6.1
protobufjs GHSA-685m-2w69-288q HIGH protobuf.js: Denial of service through unbounded protobuf recursion 7.5.4 7.5.6
protobufjs GHSA-jvwf-75h9-cwgg HIGH protobuf.js: Process-wide denial of service through unsafe option paths 7.5.4 7.5.6
protobufjs GHSA-66ff-xgx4-vchm HIGH protobuf.js: Code injection through bytes field defaults in generated toObject code 7.5.4 7.5.6
protobufjs GHSA-75px-5xx7-5xc7 HIGH protobuf.js: Code generation gadget after prototype pollution 7.5.4 7.5.6
ℹ️ Other Vulnerabilities (21)
Package CVE Severity Summary Unsafe Version Fixed In
@opentelemetry/core GHSA-8988-4f7v-96qf MODERATE OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation 1.29.0 2.8.0
@protobufjs/utf8 GHSA-q6x5-8v7m-xcrf MODERATE protobufjs has overlong UTF-8 decoding 1.1.0 1.1.1
axios GHSA-xx6v-rp6x-q39c MODERATE Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in withXSRFToken Boolean Coercion 1.15.0 1.15.1
axios GHSA-vf2m-468p-8v99 MODERATE Axios: HTTP adapter streamed responses bypass maxContentLength 1.15.0 1.15.1
axios GHSA-3w6x-2g7m-8v23 MODERATE Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in parseReviver 1.15.0 1.15.2
axios GHSA-5c9x-8gcm-mpgx MODERATE Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 1.15.0 1.15.1
axios GHSA-62hf-57xw-28j9 MODERATE Axios: unbounded recursion in toFormData causes DoS via deeply nested request data 1.15.0 1.15.1
axios GHSA-898c-q2cr-xwhg MODERATE axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions 1.15.0 1.16.0
axios GHSA-w9j2-pvgh-6h63 MODERATE Axios: Authentication Bypass via Prototype Pollution Gadget in validateStatus Merge Strategy 1.15.0 1.15.1
axios GHSA-445q-vr5w-6q77 MODERATE Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream 1.15.0 1.15.1
axios GHSA-m7pr-hjqh-92cm MODERATE Axios: no_proxy bypass via IP alias allows SSRF 1.15.0 1.15.1
brace-expansion GHSA-jxxr-4gwj-5jf2 MODERATE brace-expansion: Large numeric range defeats documented max DoS protection 5.0.5 5.0.6
fast-xml-parser GHSA-gh4j-gqv2-49f6 MODERATE fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters 5.5.8 5.7.0
follow-redirects GHSA-r4q5-vmmm-2653 MODERATE follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets 1.15.11 1.16.0
protobufjs GHSA-fx83-v9x8-x52w MODERATE protobuf.js: Prototype injection in generated message constructors 7.5.4 7.5.6
protobufjs GHSA-jggg-4jg4-v7c6 MODERATE protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion 7.5.4 7.5.8
protobufjs GHSA-2pr8-phx7-x9h3 MODERATE protobuf.js: Denial of service from crafted field names in generated code 7.5.4 7.5.6
protobufjs GHSA-f38q-mgvj-vph7 MODERATE protobufjs : Schema-derived names can shadow runtime-significant properties 7.5.4 7.6.3
protobufjs GHSA-q6x5-8v7m-xcrf MODERATE protobufjs has overlong UTF-8 decoding 7.5.4 7.5.6
@babel/core GHSA-4x5r-pxfx-6jf8 LOW @babel/core: Arbitrary File Read via sourceMappingURL Comment 7.29.0 8.0.0-rc.6
axios GHSA-xhjh-pmcv-23jw LOW Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams 1.15.0 1.15.1

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

@datadog-official

datadog-official Bot commented Jun 15, 2026 •
edited by datadog-prod-us1-4 Bot
Loading

Copy link
Copy Markdown
Contributor

Pipelines

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 8 Pipeline jobs failed

DataDog/datadog-lambda-extension | bottlecap (amd64)   View in Datadog   GitLab

DataDog/datadog-lambda-extension | bottlecap (amd64, alpine)   View in Datadog   GitLab

DataDog/datadog-lambda-extension | bottlecap (amd64, fips, alpine)   View in Datadog   GitLab

View all 8 failed jobs.

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 00bf251 | Docs | Datadog PR Page | Give us feedback!

This was referenced Jun 16, 2026
Merged
Closed
@duncanista

duncanista commented Jun 16, 2026

Copy link
Copy Markdown
Contributor

Superseded by #1264, which bundles all 6 open vulnerability dep-bump PRs into one mergeable change. axios bump + @opentelemetry/core / fast-xml-parser / fast-xml-builder / fast-uri / brace-expansion overrides merged via merge commit 99440581. Lock regenerated from scratch in 3fa49e6c so the brace-expansion@^5.0.6 and fast-uri@^3.1.2 overrides actually take effect (the lock in this PR still had 5.0.5 / 3.1.0).

@duncanista duncanista closed this Jun 16, 2026
duncanista added a commit that referenced this pull request Jun 17, 2026
@duncanista @gh-worker-campaigns-3e9aa4
fix(deps): bundle vulnerability dep bumps (closes #1258-#1263) (#1264)
33dc03e 
## Overview

Consolidates the 6 open Dependabot/ADMS vulnerability PRs into a single
PR.

| Source PR | Manifest | Notes |
|---|---|---|
| #1258 | `integration-tests/lambda/otlp-java/pom.xml` |
`io.opentelemetry:opentelemetry-api` 1.58.0 → 1.63.0 |
| #1259 | `local_tests/golang/go.{mod,sum}` | `aws-sdk-go`,
`golang.org/x/net`, `golang.org/x/sys` minor bumps |
| #1260 | `integration-tests/lambda/otlp-node/package*.json` |
Superseded by #1263 (lock already has `@grpc/[email protected]`,
`@protobufjs/utf8` override carried over) |
| #1261 | `integration-tests/package*.json` | `uuid` 9 → 14 (ported
manually onto #1262 to avoid lock conflict) |
| #1262 | `integration-tests/package*.json` | `axios` 1.15 → 1.18, plus
overrides for `@opentelemetry/core`, `fast-xml-parser`,
`fast-xml-builder`, `fast-uri`, `brace-expansion` |
| #1263 | `integration-tests/lambda/otlp-node/package*.json` | Major
OTel SDK bump (`@opentelemetry/sdk-node` 0.54 → 0.219, `protobufjs`
7.5.4 → 7.6.4) |

Closes the following Dependabot alerts: #191, #192 (`@grpc/grpc-js`);
#183–#190 + older axios alerts; protobufjs alerts via the major OTel SDK
bump; uuid #180; OpenTelemetry Java #176.

## Testing

GitHub Actions checks (Build All, Test Suite, Clippy, Audit, CodeQL)
passed on each individual source PR. `dd-gitlab/*` checks failed
identically on all 6 — appears to be an unrelated infra/permissions
issue with the bot-authored branches. Re-running CI on this branch
(created from a maintainer account) should clear them.

The vendored deps live entirely under `integration-tests/` and
`local_tests/`, so they have no impact on the shipped extension binary.

---------

Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Awaiting requested review from Copilot Copilot will automatically review once the pull request is marked ready for review

Assignees

No one assigned

Labels

adms-critical-severity adms-dependency-update adms-high-severity adms-low-severity adms-medium-severity adms-minor-update adms-mode-all-vulns adms-npm campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@duncanista