[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 3 packages upgraded (MINOR changes included)

Manifests changed:

• e2e/package.json (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
vite	8.2.1	8.3.5	minor	Transitive	2 HIGH, 8 MEDIUM, 2 LOW
undici	8.11.2	8.12.3	minor	Transitive	2 HIGH, 4 MEDIUM
@vitest/mocker	4.1.11	4.1.12	patch	Transitive	4 MEDIUM

---

Security Details

🚨 Critical & High Severity (4 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
undici	GHSA-xjj6-f33q-929c	HIGH	undici vulnerable to Denial of Service via unhandled error on excessive content-encodings	8.11.2	6.29.1	-
undici	CVE-2026-109869	HIGH	undici vulnerable to Denial of Service via unhandled error on excessive content-encodings	8.11.2	-	-
vite	CVE-2026-112942	HIGH	launch-editor: fs.existsSync() existence check can be bypassed on Windows	8.2.1	-	-
vite	GHSA-587h-7wmj-h5pm	HIGH	launch-editor: fs.existsSync() existence check can be bypassed on Windows	8.2.1	8.3.3	-

ℹ️ Other Vulnerabilities (18)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
@vitest/mocker	CVE-2026-112949	MODERATE	Vitest: Code injection via unauthenticated manual mock registration	4.1.11	-	-
@vitest/mocker	GHSA-qxg6-89mg-rqv8	MODERATE	Vitest: Code injection via unauthenticated manual mock registration	4.1.11	4.1.12	-
@vitest/mocker	CVE-2026-112950	MODERATE	Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix	4.1.11	-	-
@vitest/mocker	GHSA-xp26-3454-mjgp	MODERATE	Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix	4.1.11	4.1.12	-
undici	GHSA-4qv8-2p9j-2685	MODERATE	undici vulnerable to Denial of Service via unbounded memory in the EventSource parser	8.11.2	6.29.1	-
undici	CVE-2026-109841	MODERATE	undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens	8.11.2	-	-
undici	CVE-2026-109924	MODERATE	undici vulnerable to Denial of Service via unbounded memory in the EventSource parser	8.11.2	-	-
undici	GHSA-f72v-6w45-q472	MODERATE	undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens	8.11.2	7.30.1	-
vite	CVE-2026-112947	MODERATE	Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance	8.2.1	-	-
vite	CVE-2026-112946	MODERATE	Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine	8.2.1	-	-
vite	GHSA-r825-w8mm-5pxw	MODERATE	launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors	8.2.1	8.3.3	-
vite	CVE-2026-112944	MODERATE	launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors	8.2.1	-	-
vite	GHSA-rq7h-c2jc-7f22	MODERATE	Vite: Files outside server.fs.allow could be served when project paths match system paths on non-Windows machine	8.2.1	8.3.3	-
vite	CVE-2026-112943	MODERATE	launch-editor: escapeCmdArgs() omits % escaping on Windows	8.2.1	-	-
vite	GHSA-698v-4r3x-3vcv	MODERATE	launch-editor: escapeCmdArgs() omits % escaping on Windows	8.2.1	8.3.3	-
vite	GHSA-vfpm-58rq-9qcg	MODERATE	Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance	8.2.1	8.3.3	-
vite	CVE-2026-112945	LOW	Vite: Cross origin script execution through Vite custom middleware	8.2.1	-	-
vite	GHSA-9jrq-w75r-8gcw	LOW	Vite: Cross origin script execution through Vite custom middleware	8.2.1	8.3.3	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[dd-prapprover-prod-77c48c]

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

• ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-10-27T13:55:52Z
• ✅ CI tests passed - 2026-10-27T14:02:04Z
• ✅ Approved (commit: 9528d8d) - 2026-10-27T14:02:07Z
• ✅ Merge Started
• ⬜ Merged

➡️ Current phase: merge in progress...

[dd-prapprover-prod-77c48c]

This PR has been automatically approved by the DD PR Approver bot.

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with main — rebased onto 4937012.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}

new commit added, dismiss all previous approvals

[dd-prapprover-prod-77c48c]

This PR has been automatically approved by the DD PR Approver bot.