fix(deps): vuln minor upgrades — 8 packages (minor: 2 · patch: 6) [CTFd/themes]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 8 packages upgraded (MINOR changes included)

Manifests changed:

• CTFd/themes (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
minimatch	3.1.2	3.1.5	patch	Transitive	6 HIGH
rollup	2.77.2	2.80.0	minor	Transitive	4 HIGH
picomatch	2.3.1	2.3.2	patch	Transitive	2 HIGH, 2 MEDIUM
immutable	4.0.0	4.3.8	minor	Transitive	2 HIGH
braces	3.0.2	3.0.3	patch	Transitive	2 HIGH
brace-expansion	1.1.11	1.1.15	patch	Transitive	2 MEDIUM, 2 LOW
micromatch	4.0.5	4.0.8	patch	Transitive	2 MEDIUM
nanoid	3.3.2	3.3.12	patch	Transitive	2 MEDIUM

---

Security Details

🚨 Critical & High Severity (16 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
braces	GHSA-grv7-fg5c-xmjg	HIGH	Uncontrolled resource consumption in braces	3.0.2	3.0.3
braces	CVE-2024-4068	HIGH	-	3.0.2	-
immutable	CVE-2026-29063	HIGH	Immutable.js: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable	4.0.0	-
immutable	GHSA-wf6x-7x77-mvgw	HIGH	Immutable is vulnerable to Prototype Pollution	4.0.0	4.3.8
minimatch	CVE-2026-27904	HIGH	minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	3.1.2	-
minimatch	GHSA-23c5-xmqv-rm74	HIGH	minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions	3.1.2	10.2.3
minimatch	CVE-2026-27903	HIGH	minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	3.1.2	-
minimatch	GHSA-3ppc-4f35-3m26	HIGH	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	3.1.2	10.2.1
minimatch	GHSA-7r86-cg39-jmmj	HIGH	minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments	3.1.2	10.2.3
minimatch	CVE-2026-26996	HIGH	minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern	3.1.2	-
picomatch	GHSA-c2c7-rcm5-vvqj	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	2.3.1	4.0.4
picomatch	CVE-2026-33671	HIGH	Picomatch has a ReDoS vulnerability via extglob quantifiers	2.3.1	-
rollup	CVE-2026-27606	HIGH	Rollup 4 has Arbitrary File Write via Path Traversal	2.77.2	-
rollup	GHSA-mw96-cpmx-2vgc	HIGH	Rollup 4 has Arbitrary File Write via Path Traversal	2.77.2	2.80.0
rollup	CVE-2024-47068	HIGH	DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS	2.77.2	-
rollup	GHSA-gcx4-mw62-g8wm	HIGH	DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS	2.77.2	3.29.5

ℹ️ Other Vulnerabilities (10)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
brace-expansion	GHSA-f886-m6hf-6m8v	MODERATE	brace-expansion: Zero-step sequence causes process hang and memory exhaustion	1.1.11	5.0.5
brace-expansion	CVE-2026-33750	MODERATE	brace-expansion: Zero-step sequence causes process hang and memory exhaustion	1.1.11	-
micromatch	CVE-2024-4067	MODERATE	-	4.0.5	-
micromatch	GHSA-952p-6rrq-rcjv	MODERATE	Regular Expression Denial of Service (ReDoS) in micromatch	4.0.5	4.0.8
nanoid	GHSA-mwcw-c2x4-8c55	MODERATE	Predictable results in nanoid generation when given non-integer values	3.3.2	5.0.9
nanoid	CVE-2024-55565	MODERATE	-	3.3.2	-
picomatch	GHSA-3v7f-55p6-f55p	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	2.3.1	4.0.4
picomatch	CVE-2026-33672	MODERATE	Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching	2.3.1	-
brace-expansion	CVE-2025-5889	LOW	-	1.1.11	-
brace-expansion	GHSA-v6h2-p8h4-qcjw	LOW	brace-expansion Regular Expression Denial of Service vulnerability	1.1.11	2.0.2

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[dd-prapprover-prod-77c48c]

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

• ✅ PR is eligible for auto-approval by rule shotclock-auto-merge - 2026-09-15T15:48:57Z
• ✅ CI tests passed - 2026-09-15T15:49:01Z
• ✅ Approved (commit: 16def89) - 2026-09-15T15:49:04Z
• ✅ Merge Started
• ✅ Merged - 2026-09-15T15:49:15Z

➡️ Current phase: PR merged successfully! ✅

[dd-prapprover-prod-77c48c]

This PR has been automatically approved by the DD PR Approver bot.