Skip to content

chore(deps): bump the npm_and_yarn group across 2 directories with 14 updates - #956

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-aff1295ce9
Open

chore(deps): bump the npm_and_yarn group across 2 directories with 14 updates#956
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-aff1295ce9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026 •
edited by pr-codex Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package From To
dd-trace 5.28.0 5.100.0
fastify 4.29.0 5.12.1
undici 6.20.1 6.28.0
body-parser 1.20.3 2.3.0
js-yaml 4.1.0 4.3.2
linkify-it 5.0.0 5.0.2
markdown-it 14.1.0 14.3.1

Bumps the npm_and_yarn group with 2 updates in the /sdk directory: brace-expansion and @babel/core.

Updates dd-trace from 5.28.0 to 5.100.0

Release notes

Sourced from dd-trace's releases.

5.100.0

  • [d46c3485c9] - (SEMVER-PATCH) perf(propagation): rewrite tracestate parser to be linear (Ruben Bridgewater) #8256
  • [ed087ea187] - (SEMVER-PATCH) chore(deps-dev): bump the dev-minor-and-patch-dependencies group across 1 directory with 2 updates (dependabot[bot]) #8258
  • [d0eba220a0] - (SEMVER-PATCH) chore(deps): bump the gh-actions-packages group across 2 directories with 1 update (dependabot[bot]) #8261
  • [33b0dc1e17] - (SEMVER-PATCH) fix(express): use the host's path-to-regexp dialect for route tagging (Ruben Bridgewater) #8224
  • [d064e062cf] - (SEMVER-PATCH) refactor(otel): extract bridge helpers into span-helpers.js (Ruben Bridgewater) #8220
  • [658450e18b] - (SEMVER-PATCH) fix(otel): return a non-recording span when the inner tracer is the noop (Ruben Bridgewater) #8218
  • [fe48fc0c5f] - (SEMVER-PATCH) fix(esm): expose 'tracer' as an ESM named export (Ruben Bridgewater) #8216
  • [90bb04871a] - (SEMVER-PATCH) fix: small correctness issues in mongodb-core and bullmq (Ruben Bridgewater) #8228
  • [20f9e76efe] - (SEMVER-PATCH) fix(config): align inferred service name with agent normalization (Ruben Bridgewater) #8217
  • [00a239a1e2] - (SEMVER-PATCH) fix(propagation): enforce baggageMax* caps on extract (Ruben Bridgewater) #8255
  • [15ce029c26] - (SEMVER-PATCH) ci: deprecate legacy macrobenchmarks in favor of parallel ones (Fayssal DEFAA) #8250
  • [9e6acd8951] - (SEMVER-MINOR) feat(test-optimization): create final_status tag on test event for playwright (Sebastián Kay) #8190
  • [77cc2e065d] - (SEMVER-PATCH) fix(hono): skip publishing when env.incoming is missing (Ruben Bridgewater) #8221
  • [c832bf7a10] - (SEMVER-PATCH) [test optimization] Update extraction of runner diagnostic dir using glob pattern matching (Sebastián Kay) #8115
  • [41789b4087] - (SEMVER-PATCH) refactor(config): drop more internalPropertyName aliases (Ruben Bridgewater) #8237
  • [c97a177432] - (SEMVER-PATCH) fix(encode): write truncated meta keys back to span.meta (Ruben Bridgewater) #8236
  • [e5e3e4d35b] - (SEMVER-PATCH) test: drop keep-alive on the ci-visibility web-app-server (Ruben Bridgewater) #8194
  • [6448470089] - (SEMVER-MINOR) [test-optimization] Honor attempt-to-fix failures (Juan Antonio Fernández de Alba) #8138
  • [925bd0aae7] - (SEMVER-PATCH) chore(deps): bump openai (dependabot[bot]) #8244
  • [b058d8b4af] - (SEMVER-PATCH) ci: remove old bundle-validate workflow (Roch Devost) #8214
  • [e199f82b3e] - (SEMVER-PATCH) ci: update all green script to fail when any retry failed (Roch Devost) #8222
  • [d109d5bf1b] - (SEMVER-PATCH) chore(codeowners): own remaining benchmark dirs and enforce in CI (Ruben Bridgewater) #8204

5.99.1

  • [030413c8b3] - (SEMVER-PATCH) refactor(config): drop low-use internalPropertyName aliases (Ruben Bridgewater) #8211
  • [538b5746da] - (SEMVER-PATCH) ci: update all green to fail when the rate limit is reached (Roch Devost) #8212
  • [e1461827cb] - (SEMVER-PATCH) fix(dogstatsd): stop re-emitting stale gauges (Ruben Bridgewater) #8153
  • [ddfe085c82] - (SEMVER-PATCH) add github workflow to mirror images from flaky registries (Roch Devost) #8165
  • [1709d32f57] - (SEMVER-PATCH) bench(spans): cover tags-and-otel construction shape (Ruben Bridgewater) #8199
  • [a72b441efe] - (SEMVER-PATCH) fix(propagation): improve baggage implementation (Ruben Bridgewater) #8193
  • [f1b085a703] - (SEMVER-PATCH) bench(llmobs): add writer flush benchmark (Ruben Bridgewater) #8200
  • [ce42131535] - (SEMVER-PATCH) bench(aws-sdk): add inject and response-body benchmarks (Ruben Bridgewater) #8201
  • [35425f7a4e] - (SEMVER-PATCH) bench(dsm): add Data Streams Monitoring pathway benchmark (Ruben Bridgewater) #8202
  • [b47fabe6d1] - (SEMVER-PATCH) bench(propagation): add extract and inject benchmarks (Ruben Bridgewater) #8203
  • [6e86edfcda] - (SEMVER-PATCH) bench(encoding): cover native and legacy span-events paths (Ruben Bridgewater) #8205
  • [f6faa2b85f] - (SEMVER-PATCH) ci: fix flakiness workflow falling back to default for empty branch (Roch Devost) #8207
  • [0421807fcf] - (SEMVER-PATCH) fix(llmobs): correlate otel gen_ai spans with sdk llmobs spans (Zachary Groves) #8127
  • [63adfd5ae1] - (SEMVER-PATCH) bench: add plugin-graphql-long sirun benchmark (Crystal Luc-Magloire) #8089
  • [26bee69994] - (SEMVER-PATCH) minimize requests for all green script and retry faster (Roch Devost) #8180
  • [7763af7037] - (SEMVER-PATCH) ci: add days/branch/occurrences option to flakiness report (Roch Devost) #8185
  • [974bbce729] - (SEMVER-PATCH) test: add integration coverage harness (Ruben Bridgewater) #8071
  • [40c512422d] - (SEMVER-PATCH) fix(test): use ALS run() instead of enterWith() in mock agent server.emit (William Conti) #8166
  • [8628c2716a] - (SEMVER-PATCH) fix(appsec): bound detectedSpecificEndpoints cache (Ruben Bridgewater) #8163
  • [fab96f8428] - (SEMVER-PATCH) test: fix mocha retries issue (Ilyas Shabi) #8189
  • [476b6d1269] - (SEMVER-PATCH) test: Improve profiling tests (Ilyas Shabi) #8169

5.99.0

  • [fe44ddbe67] - (SEMVER-PATCH) ci: refresh Node patch versions on cross-window cache restores (Ruben Bridgewater) #8179
  • [5f582369a6] - (SEMVER-PATCH) refactor: use the same symbol to instrument pino across versions (Roch Devost) #8181

... (truncated)

Commits
  • 581910d v5.100.0
  • b24e364 perf(propagation): rewrite tracestate parser to be linear (#8256)
  • 8e59ac7 chore(deps-dev): bump the dev-minor-and-patch-dependencies group across 1 dir...
  • e909c52 chore(deps): bump the gh-actions-packages group across 2 directories with 1 u...
  • 86e35a9 fix(express): use the host's path-to-regexp dialect for route tagging (#8224)
  • 9f302fe refactor(otel): extract bridge helpers into span-helpers.js (#8220)
  • 200d3bd fix(otel): return a non-recording span when the inner tracer is the noop (#8218)
  • b2df728 fix(esm): expose 'tracer' as an ESM named export (#8216)
  • 741482c fix: small correctness issues in mongodb-core and bullmq (#8228)
  • 280f96e fix(config): align inferred service name with agent normalization (#8217)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for dd-trace since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates fastify from 4.29.0 to 5.12.1

Release notes

Sourced from fastify's releases.

v5.12.1

⚠️ Security release

What's Changed

Full Changelog: fastify/fastify@v5.12.0...v5.12.1

v5.12.0

What's Changed

Full Changelog: fastify/fastify@v5.11.3...v5.12.0

v5.11.3

What's Changed

New Contributors

Full Changelog: fastify/fastify@v5.11.2...v5.11.3

v5.11.2

What's Changed

... (truncated)

Commits

Updates undici from 6.20.1 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did

... (truncated)

Commits
  • 01a912e Bumped v6.28.0 (#5591)
  • 481ecfc Use Node 22 and npm 11 to release
  • 740a0b7 fix: validate blob body content type
  • 2698e49 fix: validate coerced header values for CRLF (#5579)
  • 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
  • cba3a52 fix(retry): reject partial content length mismatch
  • af74840 fix: harden cookie domain, path, and unparsed attribute validation
  • 551138c Bumped v6.27.0 (#5431)
  • b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
  • 25efa44 fix(cookies): preserve values and parse SameSite strictly
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.


Updates @vitest/mocker from 2.1.8 to 5.0.0

Release notes

Sourced from @​vitest/mocker's releases.

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vitest/mocker since your current version.


Updates body-parser from 1.20.3 to 2.3.0

Release notes

Sourced from body-parser's releases.

v2.3.0

Important: Security

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@v2.2.2...v2.3.0

v2.2.2

What's Changed

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.3.0 / 2026-06-15

  • Security fix for GHSA-v422-hmwv-36x6
  • fix: use static exports instead of lazy getters to improve ESM compatibility
  • feat: add subpath exports for individual parsers
  • fix: improve...

    Description has been truncated

    PR-Codex overview

    This PR focuses on updating dependencies in the package.json and yarn.lock files to their latest versions, enhancing security and performance.

    Detailed summary

    • Updated dd-trace from 5.23.0 to 5.100.0
    • Updated fastify from 4.28.1 to 5.12.1
    • Updated undici from 6.20.1 to 6.28.0
    • Updated uuid from 9.0.1 to 14.0.2
    • Updated vitest from 2.0.3 to 5.0.0
    • Updated body-parser from 1.20.3 to 2.3.0
    • Updated various other dependencies in yarn.lock to their latest versions.

    The following files were skipped due to too many changes: yarn.lock

    ✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

@dependabot
chore(deps): bump the npm_and_yarn group across 2 directories with 14…
31765b3 
… updates

Bumps the npm_and_yarn group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [dd-trace](https://github.com/DataDog/dd-trace-js) | `5.28.0` | `5.100.0` |
| [fastify](https://github.com/fastify/fastify) | `4.29.0` | `5.12.1` |
| [undici](https://github.com/nodejs/undici) | `6.20.1` | `6.28.0` |
| [body-parser](https://github.com/expressjs/body-parser) | `1.20.3` | `2.3.0` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.2` |
| [linkify-it](https://github.com/markdown-it/linkify-it) | `5.0.0` | `5.0.2` |
| [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.0` | `14.3.1` |

Bumps the npm_and_yarn group with 2 updates in the /sdk directory: [brace-expansion](https://github.com/juliangruber/brace-expansion) and [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core).


Updates `dd-trace` from 5.28.0 to 5.100.0
- [Release notes](https://github.com/DataDog/dd-trace-js/releases)
- [Commits](DataDog/dd-trace-js@v5.28.0...v5.100.0)

Updates `fastify` from 4.29.0 to 5.12.1
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v4.29.0...v5.12.1)

Updates `undici` from 6.20.1 to 6.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.20.1...v6.28.0)

Updates `@vitest/mocker` from 2.1.8 to 5.0.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.0/packages/mocker)

Updates `body-parser` from 1.20.3 to 2.3.0
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.3...v2.3.0)

Updates `fast-uri` from 2.4.0 to 3.0.3
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v2.4.0...v3.0.3)

Updates `find-my-way` from 8.2.2 to 9.9.0
- [Release notes](https://github.com/delvedor/find-my-way/releases)
- [Commits](delvedor/find-my-way@v8.2.2...v9.9.0)

Updates `js-yaml` from 4.1.0 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.3.2)

Updates `linkify-it` from 5.0.0 to 5.0.2
- [Changelog](https://github.com/markdown-it/linkify-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/linkify-it@5.0.0...5.0.2)

Updates `markdown-it` from 14.1.0 to 14.3.1
- [Changelog](https://github.com/markdown-it/markdown-it/blob/14.3.1/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@14.1.0...14.3.1)

Updates `qs` from 6.13.0 to 6.13.1
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.13.0...v6.13.1)

Updates `brace-expansion` from 1.1.11 to 1.1.18
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v1.1.18)

Updates `@babel/core` from 7.23.2 to 7.29.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.29.7/packages/babel-core)

Updates `browserslist` from 4.22.1 to 4.28.9
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](browserslist/browserslist@4.22.1...4.28.9)

---
updated-dependencies:
- dependency-name: dd-trace
  dependency-version: 5.100.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: fastify
  dependency-version: 5.12.1
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@vitest/mocker"
  dependency-version: 5.0.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-uri
  dependency-version: 3.0.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: find-my-way
  dependency-version: 9.9.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: linkify-it
  dependency-version: 5.0.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: markdown-it
  dependency-version: 14.3.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: qs
  dependency-version: 6.13.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.18
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@babel/core"
  dependency-version: 7.29.7
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: browserslist
  dependency-version: 4.28.9
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 9, 2026
@socket-security

socket-security Bot commented Sep 9, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatednpm/​dd-trace@​5.28.0 ⏵ 5.100.066 -10100 +1695 -596 +2100
Updatednpm/​vitest@​2.1.8 ⏵ 5.0.098 +1100 +7579 +199 +2100
Addednpm/​uuid@​14.0.210010010090100
Updatednpm/​undici@​6.20.1 ⏵ 6.28.093100 +40100 +198100
Updatednpm/​fastify@​4.29.0 ⏵ 5.12.198100 +2510099 +5100

View full report

@socket-security

socket-security Bot commented Sep 9, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm dd-trace is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: package.json → npm/dd-trace@5.100.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/dd-trace@5.100.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants