fix(deps): vuln minor upgrades — 15 packages (minor: 3 · patch: 12) [hugo/package.json]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 15 packages upgraded (MINOR changes included)

Manifests changed:

• hugo/package.json (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
brace-expansion	5.0.6	5.0.12	patch	Transitive	10 HIGH, 2 MEDIUM
@babel/plugin-transform-modules-systemjs	7.23.9	7.29.8	minor	Transitive	2 HIGH
glob	10.4.5	10.5.0	minor	Transitive	2 HIGH
rollup	4.34.9	4.64.0	minor	Transitive	2 HIGH
ansi-regex	4.1.0	4.1.1	patch	Transitive	2 HIGH
cross-spawn	6.0.5	6.0.6	patch	Transitive	2 HIGH
ini	1.3.5	1.3.8	patch	Transitive	2 HIGH
jws	4.0.0	4.0.1	patch	Transitive	2 HIGH
semver	5.7.1	5.7.2	patch	Transitive	2 HIGH
tmpl	1.0.4	1.0.5	patch	Transitive	2 HIGH
y18n	4.0.0	4.0.3	patch	Transitive	2 HIGH
markdown-it	14.1.0	14.1.1	patch	Transitive	5 MEDIUM
uuid	11.1.0	11.1.1	patch	Transitive	3 MEDIUM
fflate	0.8.2	0.8.3	patch	Transitive	2 MEDIUM
hosted-git-info	2.8.8	2.8.9	patch	Transitive	2 MEDIUM

---

Security Details

🚨 Critical & High Severity (30 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
@babel/plugin-transform-modules-systemjs	CVE-2026-44728	HIGH	Improper Control of Generation of Code when compiling specifically crafted malicious code with @babel/plugin-transform-modules-systemjs	7.23.9	-	-
@babel/plugin-transform-modules-systemjs	GHSA-fv7c-fp4j-7gwp	HIGH	@babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input	7.23.9	7.29.4	-
ansi-regex	GHSA-93q8-gq69-wqmw	HIGH	Inefficient Regular Expression Complexity in chalk/ansi-regex	4.1.0	6.0.1	-
ansi-regex	CVE-2021-3807	HIGH	-	4.1.0	-	-
brace-expansion	GHSA-6j4f-fj2g-mc7p	HIGH	brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion	5.0.6	5.0.10	-
brace-expansion	GHSA-qhr7-859c-m2p7	HIGH	brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion	5.0.6	5.0.11	-
brace-expansion	CVE-2026-69152	HIGH	brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation	5.0.6	-	-
brace-expansion	GHSA-rgw5-rvv9-x895	HIGH	brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation	5.0.6	1.1.18	-
brace-expansion	GHSA-mh99-v99m-4gvg	HIGH	brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash	5.0.6	5.0.8	-
brace-expansion	CVE-2026-14257	HIGH	brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash	5.0.6	-	-
brace-expansion	CVE-2026-102276	HIGH	brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion	5.0.6	-	-
brace-expansion	CVE-2026-102278	HIGH	brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion	5.0.6	-	-
brace-expansion	GHSA-3jxr-9vmj-r5cp	HIGH	brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups	5.0.6	5.0.7	-
brace-expansion	CVE-2026-13149	HIGH	-	5.0.6	-	-
cross-spawn	GHSA-3xgq-45jj-v275	HIGH	Regular Expression Denial of Service (ReDoS) in cross-spawn	6.0.5	7.0.5	-
cross-spawn	CVE-2024-21538	HIGH	-	6.0.5	-	-
glob	CVE-2025-64756	HIGH	glob CLI: Command injection via -c/--cmd executes matches with shell:true	10.4.5	-	-
glob	GHSA-5j98-mcp5-4vw2	HIGH	glob CLI: Command injection via -c/--cmd executes matches with shell:true	10.4.5	11.1.0	-
ini	GHSA-qqgx-2p2h-9c37	HIGH	ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse	1.3.5	1.3.6	-
ini	CVE-2020-7788	HIGH	-	1.3.5	-	-
jws	GHSA-869p-cjfg-cm3x	HIGH	auth0/node-jws Improperly Verifies HMAC Signature	4.0.0	3.2.3	-
jws	CVE-2025-65945	HIGH	auth0/node-jws improper HMAC signature verification vulnerability	4.0.0	-	-
rollup	GHSA-mw96-cpmx-2vgc	HIGH	Rollup 4 has Arbitrary File Write via Path Traversal	4.34.9	2.80.0	-
rollup	CVE-2026-27606	HIGH	Rollup 4 has Arbitrary File Write via Path Traversal	4.34.9	-	-
semver	CVE-2022-25883	HIGH	-	5.7.1	-	-
semver	GHSA-c2qf-rxjj-qqgw	HIGH	semver vulnerable to Regular Expression Denial of Service	5.7.1	7.5.2	-
tmpl	GHSA-jgrx-mgxx-jf9v	HIGH	tmpl vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion	1.0.4	1.0.5	-
tmpl	CVE-2021-3777	HIGH	-	1.0.4	-	-
y18n	CVE-2020-7774	HIGH	-	4.0.0	-	-
y18n	GHSA-c4w7-xm78-47vh	HIGH	Prototype Pollution in y18n	4.0.0	3.2.2	-

ℹ️ Other Vulnerabilities (14)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
brace-expansion	CVE-2026-102277	MODERATE	brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service	5.0.6	-	-
brace-expansion	GHSA-q2hr-2g5m-vwhr	MODERATE	brace-expansion: Quadratic-time expansion of the {a},b} rewrite causes CPU denial of service	5.0.6	5.0.12	-
fflate	GHSA-px8p-9vwx-vf98	MODERATE	fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives	0.8.2	0.4.9	-
fflate	CVE-2026-45820	MODERATE	-	0.8.2	-	-
hosted-git-info	CVE-2021-23362	MODERATE	-	2.8.8	-	-
hosted-git-info	GHSA-43f8-2h32-f4cj	MODERATE	Regular Expression Denial of Service in hosted-git-info	2.8.8	2.8.9	-
markdown-it	CVE-2026-48988	MODERATE	markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations	14.1.0	-	-
markdown-it	GHSA-253c-mchw-3w2r	MODERATE	markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds	14.1.0	15.0.1	-
markdown-it	GHSA-6v5v-wf23-fmfq	MODERATE	markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations	14.1.0	14.2.0	-
markdown-it	CVE-2026-2327	MODERATE	-	14.1.0	-	-
markdown-it	GHSA-38c4-r59v-3vqw	MODERATE	markdown-it is has a Regular Expression Denial of Service (ReDoS)	14.1.0	14.1.1	-
uuid	GHSA-w5hq-g745-h8pq	MODERATE	uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided	11.1.0	11.1.1	-
uuid	CVE-2026-41907	MODERATE	uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided	11.1.0	-	-
uuid	CVE-2026-41988	MODERATE	-	11.1.0	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with master — rebased onto b0e60b0.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}