Skip to content

VULN UPGRADE: major upgrades — 6 packages (major: 1 · unstable: 2 · minor: 1 · patch: 2) [packages/dd-trace/test/plugins/versions]#7513

Merged
BridgeAR merged 1 commit into
masterfrom
engraver-auto-version-upgrade/major/npm/versions/1-1770938509
Feb 13, 2026
Merged

VULN UPGRADE: major upgrades — 6 packages (major: 1 · unstable: 2 · minor: 1 · patch: 2) [packages/dd-trace/test/plugins/versions]#7513
BridgeAR merged 1 commit into
masterfrom
engraver-auto-version-upgrade/major/npm/versions/1-1770938509

Conversation

@campaigner-prod

@campaigner-prod campaigner-prod Bot commented Feb 12, 2026

Copy link
Copy Markdown
Contributor

Summary: Security update — 6 packages upgraded (MAJOR changes included)

Manifests changed:

  • packages/dd-trace/test/plugins/versions (npm)

Updates

Package From To Type Vulnerabilities Fixed
hono 4.11.4 4.11.7 patch 8 MODERATE
@anthropic-ai/sdk 0.71.2 0.73.0 major -
@openai/agents-core 0.3.9 0.4.5 major -
cookie 0.7.2 1.1.1 major -
openai 6.16.0 6.18.0 minor -
zod 4.3.5 4.3.6 patch -

Packages marked with "-" are updated due to dependency constraints.

Warning

Major Version Upgrade

This update includes major version changes that may contain breaking changes. Please:

  • Review the changelog/release notes for breaking changes
  • Test thoroughly in a staging environment
  • Update any code that depends on changed APIs
  • Ensure all tests pass before merging

Security Details

ℹ️ Other Vulnerabilities (8)
Package CVE Severity Summary Unsafe Version Fixed In
hono GHSA-9r54-q6cx-xmh5 MODERATE Hono vulnerable to XSS through ErrorBoundary component 4.11.4 4.11.7
hono CVE-2026-24771 MODERATE Hono has a Cross-site Scripting vulnerability 4.11.4 -
hono GHSA-r354-f388-2fhh MODERATE Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing 4.11.4 4.11.7
hono CVE-2026-24398 MODERATE Hono's IPv4 address validation bypass in IP Restriction Middleware allows IP spoofing 4.11.4 -
hono GHSA-6wqw-2p9w-4vw4 MODERATE Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception 4.11.4 4.11.7
hono CVE-2026-24472 MODERATE Hono cache middleware ignores "Cache-Control: private" leading to Web Cache Deception 4.11.4 -
hono GHSA-w332-q679-j88p MODERATE Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) 4.11.4 4.11.7
hono CVE-2026-24473 MODERATE Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter) 4.11.4 -

Review Checklist

Extra review is recommended for this update:

  • Review changes for compatibility with your code
  • Check release notes for breaking changes
  • Run integration tests to verify service behavior
  • Test in staging environment before production
  • Monitor key metrics after deployment

Update Mode: Vulnerability Remediation

🤖 Generated by DataDog Automated Dependency Management System

@campaigner-prod
campaigner-prod Bot requested a review from a team as a code owner February 12, 2026 23:23
@github-actions

github-actions Bot commented Feb 12, 2026

Copy link
Copy Markdown
Contributor

Overall package size

Self size: 4.6 MB
Deduped: 5.44 MB
No deduping: 5.44 MB

Dependency sizes | name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 2.0.6 | 81.92 kB | 813.08 kB | | dc-polyfill | 0.1.10 | 26.73 kB | 26.73 kB |

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@codecov

codecov Bot commented Feb 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.22%. Comparing base (c589ad4) to head (96816b6).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files 
@@            Coverage Diff             @@
##           master    #7513      +/-   ##
==========================================
+ Coverage   80.13%   80.22%   +0.08%     
==========================================
  Files         730      731       +1     
  Lines       31104    31194      +90     
==========================================
+ Hits        24926    25026     +100     
+ Misses       6178     6168      -10
Flag Coverage Δ
aiguard-macos 39.07% <ø> (-0.11%) ⬇️
aiguard-ubuntu 39.19% <ø> (-0.11%) ⬇️
aiguard-windows 38.93% <ø> (-0.11%) ⬇️
apm-capabilities-tracing-macos 48.75% <ø> (-0.05%) ⬇️
apm-capabilities-tracing-ubuntu 48.83% <ø> (ø)
apm-capabilities-tracing-windows 47.81% <ø> (-0.72%) ⬇️
apm-integrations-child-process 38.64% <ø> (-0.11%) ⬇️
apm-integrations-couchbase-18 37.39% <ø> (-0.25%) ⬇️
apm-integrations-couchbase-eol 38.02% <ø> (+0.04%) ⬆️
apm-integrations-oracledb 38.06% <ø> (-0.10%) ⬇️
appsec-express 55.44% <ø> (-0.08%) ⬇️
appsec-fastify 52.05% <ø> (-0.08%) ⬇️
appsec-graphql 52.40% <ø> (-0.07%) ⬇️
appsec-kafka 44.64% <ø> (-0.14%) ⬇️
appsec-ldapjs 44.39% <ø> (-0.09%) ⬇️
appsec-lodash 44.07% <ø> (-0.09%) ⬇️
appsec-macos 58.49% <ø> (-0.08%) ⬇️
appsec-mongodb-core 49.20% <ø> (-0.20%) ⬇️
appsec-mongoose 50.00% <ø> (-0.07%) ⬇️
appsec-mysql 51.39% <ø> (-0.08%) ⬇️
appsec-node-serialize 43.58% <ø> (-0.09%) ⬇️
appsec-passport 48.15% <ø> (-0.09%) ⬇️
appsec-postgres 51.15% <ø> (-0.08%) ⬇️
appsec-sourcing 42.92% <ø> (-0.09%) ⬇️
appsec-template 43.75% <ø> (-0.09%) ⬇️
appsec-ubuntu 58.58% <ø> (-0.07%) ⬇️
appsec-windows 58.36% <ø> (-0.07%) ⬇️
instrumentations-instrumentation-bluebird 32.32% <ø> (-0.11%) ⬇️
instrumentations-instrumentation-body-parser 40.85% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-child_process 37.94% <ø> (-0.11%) ⬇️
instrumentations-instrumentation-cookie-parser 34.55% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-express 34.89% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-express-mongo-sanitize 34.69% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-express-session 40.47% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-fs 31.92% <ø> (-0.11%) ⬇️
instrumentations-instrumentation-generic-pool 30.19% <ø> (ø)
instrumentations-instrumentation-http 39.66% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-knex 32.33% <ø> (-0.11%) ⬇️
instrumentations-instrumentation-mongoose 33.68% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-multer 40.59% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-mysql2 38.44% <ø> (-0.10%) ⬇️
instrumentations-instrumentation-passport 44.46% <ø> (-0.09%) ⬇️
instrumentations-instrumentation-passport-http 44.11% <ø> (-0.09%) ⬇️
instrumentations-instrumentation-passport-local 44.67% <ø> (-0.09%) ⬇️
instrumentations-instrumentation-pg 37.85% <ø> (-0.11%) ⬇️
instrumentations-instrumentation-promise 32.25% <ø> (-0.11%) ⬇️
instrumentations-instrumentation-promise-js 32.26% <ø> (-0.11%) ⬇️
instrumentations-instrumentation-q 32.30% <ø> (-0.11%) ⬇️
instrumentations-instrumentation-url 32.22% <ø> (-0.11%) ⬇️
instrumentations-instrumentation-when 32.27% <ø> (-0.11%) ⬇️
llmobs-ai 41.48% <ø> (-0.10%) ⬇️
llmobs-anthropic 40.67% <ø> (-0.10%) ⬇️
llmobs-bedrock 39.55% <ø> (-0.09%) ⬇️
llmobs-google-genai 40.16% <ø> (-0.09%) ⬇️
llmobs-langchain 39.70% <ø> (-0.08%) ⬇️
llmobs-openai 44.51% <ø> (-0.09%) ⬇️
llmobs-vertex-ai 40.37% <ø> (-0.17%) ⬇️
platform-core 29.71% <ø> (ø)
platform-esbuild 32.89% <ø> (ø)
platform-instrumentations-misc 40.53% <ø> (ø)
platform-shimmer 36.14% <ø> (ø)
platform-unit-guardrails 31.27% <ø> (ø)
plugins-azure-event-hubs 24.02% <ø> (ø)
plugins-azure-service-bus 23.42% <ø> (ø)
plugins-bullmq 43.78% <ø> (-0.10%) ⬇️
plugins-cassandra 38.10% <ø> (-0.24%) ⬇️
plugins-cookie 25.08% <ø> (ø)
plugins-cookie-parser 24.87% <ø> (ø)
plugins-crypto 24.72% <ø> (ø)
plugins-dd-trace-api 38.49% <ø> (-0.11%) ⬇️
plugins-express-mongo-sanitize 25.04% <ø> (ø)
plugins-express-session 24.83% <ø> (ø)
plugins-fastify 42.58% <ø> (-0.10%) ⬇️
plugins-fetch 38.64% <ø> (-0.10%) ⬇️
plugins-fs 38.74% <ø> (-0.11%) ⬇️
plugins-generic-pool 24.06% <ø> (ø)
plugins-google-cloud-pubsub 45.79% <ø> (-0.07%) ⬇️
plugins-grpc 41.32% <ø> (-0.10%) ⬇️
plugins-handlebars 25.08% <ø> (ø)
plugins-hapi 40.49% <ø> (-0.25%) ⬇️
plugins-hono 40.75% <ø> (-0.10%) ⬇️
plugins-ioredis 38.54% <ø> (-0.11%) ⬇️
plugins-knex 24.80% <ø> (ø)
plugins-ldapjs 22.61% <ø> (ø)
plugins-light-my-request 24.48% <ø> (ø)
plugins-limitd-client 32.62% <ø> (-0.11%) ⬇️
plugins-lodash 24.13% <ø> (ø)
plugins-mariadb 39.65% <ø> (?)
plugins-memcached 38.28% <ø> (-0.11%) ⬇️
plugins-microgateway-core 39.51% <ø> (-0.10%) ⬇️
plugins-moleculer 40.88% <ø> (-0.10%) ⬇️
plugins-mongodb 39.52% <ø> (-0.10%) ⬇️
plugins-mongodb-core 39.15% <ø> (-0.10%) ⬇️
plugins-mongoose 39.20% <ø> (-0.10%) ⬇️
plugins-multer 24.83% <ø> (ø)
plugins-mysql 39.26% <ø> (-0.11%) ⬇️
plugins-mysql2 39.39% <ø> (-0.10%) ⬇️
plugins-node-serialize 25.12% <ø> (ø)
plugins-opensearch 37.93% <ø> (-0.24%) ⬇️
plugins-passport-http 24.91% <ø> (ø)
plugins-postgres 35.78% <ø> (-0.09%) ⬇️
plugins-process 24.72% <ø> (ø)
plugins-pug 25.08% <ø> (ø)
plugins-redis 39.01% <ø> (-0.12%) ⬇️
plugins-router 43.36% <ø> (-0.10%) ⬇️
plugins-sequelize 23.66% <ø> (ø)
plugins-test-and-upstream-amqp10 38.46% <ø> (-0.11%) ⬇️
plugins-test-and-upstream-amqplib 43.97% <ø> (-0.10%) ⬇️
plugins-test-and-upstream-apollo 39.34% <ø> (-0.09%) ⬇️
plugins-test-and-upstream-avsc 38.89% <ø> (-0.11%) ⬇️
plugins-test-and-upstream-bunyan 33.94% <ø> (-0.11%) ⬇️
plugins-test-and-upstream-connect 41.17% <ø> (-0.10%) ⬇️
plugins-test-and-upstream-graphql 40.29% <ø> (-0.10%) ⬇️
plugins-test-and-upstream-koa 40.74% <ø> (-0.10%) ⬇️
plugins-test-and-upstream-protobufjs 39.12% <ø> (-0.11%) ⬇️
plugins-test-and-upstream-rhea 44.25% <ø> (-0.07%) ⬇️
plugins-undici 39.43% <ø> (-0.10%) ⬇️
plugins-url 24.72% <ø> (ø)
plugins-valkey 38.20% <ø> (-0.08%) ⬇️
plugins-vm 24.72% <ø> (ø)
plugins-winston 34.31% <ø> (-0.10%) ⬇️
plugins-ws 42.29% <ø> (-0.10%) ⬇️
profiling-macos 40.04% <ø> (-0.10%) ⬇️
profiling-ubuntu 40.17% <ø> (-0.10%) ⬇️
profiling-windows 41.41% <ø> (-0.10%) ⬇️
serverless-azure-functions-client 23.75% <ø> (ø)
serverless-azure-functions-eventhubs 23.75% <ø> (ø)
serverless-azure-functions-servicebus 23.75% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@pr-commenter

pr-commenter Bot commented Feb 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-02-12 23:36:28

Comparing candidate commit c589ad4 in PR branch engraver-auto-version-upgrade/major/npm/versions/1-1770938509 with baseline commit c589ad4 in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 230 metrics, 30 unstable metrics.

@BridgeAR
BridgeAR merged commit 3f922e1 into master Feb 13, 2026
791 of 800 checks passed
@BridgeAR
BridgeAR deleted the engraver-auto-version-upgrade/major/npm/versions/1-1770938509 branch February 13, 2026 00:35
dd-octo-sts Bot pushed a commit that referenced this pull request Feb 13, 2026
@campaigner-prod @rochdev
chore: update supported instrumented libraries (#7513)
3f3ddfd 
Co-authored-by: campaigner-prod[bot] <87874424+campaigner-prod[bot]@users.noreply.github.com>
@dd-octo-sts dd-octo-sts Bot mentioned this pull request Feb 13, 2026
Merged
juan-fernandez pushed a commit that referenced this pull request Feb 18, 2026
@campaigner-prod @juan-fernandez
chore: update supported instrumented libraries (#7513)
8d625bc 
Co-authored-by: campaigner-prod[bot] <87874424+campaigner-prod[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@BridgeAR BridgeAR BridgeAR approved these changes

Assignees

No one assigned

Labels

adms-dependency-update adms-major-update adms-medium-severity adms-mode-all-updates adms-npm campaigner-automated-change semver-patch

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@BridgeAR