fix(deps): vuln minor upgrades — 4 packages (minor: 3 · patch: 1) - #1364
fix(deps): vuln minor upgrades — 4 packages (minor: 3 · patch: 1) #1364gh-worker-campaigns-3e9aa4[bot] wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates dependency lockstate and package constraints to bring the Datadog tracing stack and related transitive dependencies up to newer versions (including security/bugfix updates) and refresh Yarn resolutions.
Changes:
- Bump
dd-tracefrom^5.28.0to^5.121.0and updateyarn.lockaccordingly. - Update the
nanoidoverride and add new Yarn resolution entries for@sigstore/coreandajv.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| yarn.lock | Regenerated lockfile reflecting updated dd-trace and transitive dependency graph. |
| package.json | Updates dd-trace version and adjusts/adds Yarn resolution overrides (nanoid, @sigstore/core, ajv). |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| "minimatch@^10.1.1": "10.2.3", | ||
| "lodash": "4.18.0", | ||
| "nanoid": "3.3.8", | ||
| "nanoid": "^3.3.18", |
| "@babel/core": "7.29.6", | ||
| "@sigstore/core@npm:^3.0.0": "npm:^3.2.1", | ||
| "ajv@npm:^6.10.0": "npm:^6.15.0", | ||
| "ajv@npm:^6.12.4": "npm:^6.15.0" |
Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>
Co-authored-by: gh-worker-campaigns-3e9aa4[bot] <244854796+gh-worker-campaigns-3e9aa4[bot]@users.noreply.github.com>
Auto-rebase completeBranch is up to date with Auto-Rebase · Add |
38f4677 to
b819195
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.
Suppressed comments (2)
package.json:107
- Using a caret range inside a forced override/resolution makes future lockfile regenerations non-deterministic (a new minor of nanoid could be selected without an intentional PR). If the goal is a controlled security/compatibility override, prefer pinning an exact version (e.g.,
3.3.18) and bump deliberately when needed.
"nanoid": "^3.3.18",
package.json:136
- These resolutions are duplicative and still allow drift because the values are ranges (
npm:^...). If the intent is to force a specific patched version across all dependents, pin exact versions (e.g.,npm:3.2.1,npm:6.15.0) and consider consolidating the AJV rules into a single broader selector where possible to reduce ongoing maintenance.
"@sigstore/core@npm:^3.0.0": "npm:^3.2.1",
"ajv@npm:^6.10.0": "npm:^6.15.0",
"ajv@npm:^6.12.4": "npm:^6.15.0"
Summary: High-severity security update — 4 packages upgraded (MINOR changes included)
Manifests changed:
.(yarn)✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.
Updates
Security Details
🚨 Critical & High Severity (6 fixed)
ℹ️ Other Vulnerabilities (4)
$dataoptionReview Checklist
Standard review:
Update Mode: all_vulns
🤖 Generated by DataDog Automated Dependency Management System