fix(deps): vuln minor: qs · patch: body-parser [test/crashtracker/package.json]

[gh-worker-campaigns-3e9aa4]

Summary: Security update — 2 packages upgraded (MINOR changes included)

Manifests changed:

• test/crashtracker/package.json (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
qs	6.14.2	6.15.3	minor	Transitive	2 MEDIUM
body-parser	1.20.4	1.20.6	patch	Direct	2 LOW

---

Security Details

ℹ️ Other Vulnerabilities (4)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
qs	GHSA-q8mj-m7cp-5q26	MODERATE	qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set	6.14.2	6.15.2	-
qs	CVE-2026-8723	MODERATE	qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly	6.14.2	-	-
body-parser	GHSA-v422-hmwv-36x6	LOW	body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement	1.20.4	1.20.6	-
body-parser	CVE-2026-12590	LOW	body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement	1.20.4	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[github-actions]

Overall package size

Self size: 31.67 MB
Deduped: 31.67 MB
No deduping: 31.67 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------|

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with main — rebased onto a66b96e.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}

[dd-prapprover-prod-77c48c]

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

• ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-08-31T20:42:44Z
• ✅ CI tests passed - 2026-08-31T20:42:48Z
• ✅ Approved (commit: 81cc953) - 2026-08-31T20:42:50Z
• ✅ Merge Started
• ✅ Merged - 2026-08-31T20:43:09Z

➡️ Current phase: PR merged successfully! ✅

[dd-prapprover-prod-77c48c]

This PR has been automatically approved by the DD PR Approver bot.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 81cc953b2f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Update the npm lockfile with the manifest

The checked GitHub Build workflow currently uses Yarn, but this fixture also commits test/crashtracker/package-lock.json, whose root still declares body-parser as ^1.20.3 and resolves vulnerable versions body-parser@1.20.4 and qs@6.14.2. Consequently, npm-based reproducible installs do not receive this security update; moreover, the installed npm ci documentation states, “If dependencies in the package lock do not match those in package.json, npm ci will exit with an error.” Regenerate and commit the npm lockfile alongside yarn.lock.

Useful? React with 👍 / 👎.