fix(FFESUPPORT-889): remediate July 2026 dependabot vulnerabilities

[aarsilv]

🤖 Generated from Claude

Remediates the 22 open Dependabot alerts in sdk-test-data — all in the test-relay harness apps + root dev tooling (this repo ships no production runtime). Jira: https://datadoghq.atlassian.net/browse/FFESUPPORT-889

Advisories closed (by lockfile)

Lockfile	Package: before → after
root yarn.lock	js-yaml 3.14.2 → 3.15.0 · @babel/core 7.29.0 → 7.29.7
sdk-test-runner/yarn.lock	form-data 4.0.5 → 4.0.6
react-native-sdk-relay/yarn.lock	shell-quote (critical) 1.8.3 → 1.10.0 · undici 6.25.0 → 6.27.0 · form-data 3.0.4 → 3.0.5 & 4.0.5 → 4.0.6 · js-yaml 3.14.2 → 3.15.0 & 4.1.1 → 4.3.0 · tar 7.5.15 → 7.5.20 · @babel/core 7.29.0 → 7.29.7
node-sdk-relay/yarn.lock	form-data 4.0.5 → 4.0.6 · js-yaml 3.14.2 → 3.15.0 & 4.1.1 → 4.3.0 · @babel/core 7.29.0 → 7.29.7 · multer 2.1.1 → 2.2.0
ruby-sdk-relay/Gemfile.lock	puma 6.5.0 → 7.2.1

Approach (dev/test infra — upgraded aggressively)

• yarn lockfiles: re-resolved the vulnerable transitives to patched in-range versions. The only package.json change is bumping the rn-relay tar resolution floor ^7.5.15 → ^7.5.16.
• multer: fixed via the upstream bump @nestjs/platform-express 11.1.24 → 11.1.28 (which now depends on multer 2.2.0) rather than a forced resolution.
• puma: the advisory has no 6.x fix, so bumped the Gemfile constraint ~> 6.5 → ~> 7.2 (resolving puma 6.5.0 → 7.2.1). The relay is Sinatra-hosted with no custom puma config, so the 6→7 major bump is transparent.

How the tests/CI protect this change

• yarn install --frozen-lockfile ✓ in all 4 yarn projects; bundle lock consistent for the Ruby relay.
• nest build ✓ for node-sdk-relay (confirms the nest bump introduces no version skew).
• CI (test-sdks.yml / test-sdk-packages.yml) rebuilds and runs each relay against the conformance suite.

Deferred advisories

None — all 22 alerts addressed; none left dismissed/auto-dismissed.

[Copilot]

Pull request overview

This PR updates dependency lockfiles (and a small RN relay resolution) to remediate Dependabot security alerts across the repo’s test/relay harness applications and root dev tooling.

Changes:

• Bumps vulnerable JS dependencies to patched versions via re-resolved Yarn v1 lockfiles (e.g., js-yaml, form-data, undici, shell-quote, Babel toolchain packages).
• Updates the React Native relay’s tar resolution floor (^7.5.15 → ^7.5.16) to pick up patched tar.
• Upgrades the Ruby relay’s Puma major version (~> 6.5 → ~> 7.2, locked to 7.2.1) to address an advisory with no 6.x fix.

Reviewed changes

Copilot reviewed 2 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
yarn.lock	Re-resolves root dev tooling dependencies to patched Babel / js-yaml versions.
package-testing/sdk-test-runner/yarn.lock	Updates form-data and related transitives to patched versions.
package-testing/react-native-sdk-relay/yarn.lock	Updates multiple vulnerable transitives (shell-quote, undici, form-data, js-yaml, tar, Babel packages).
package-testing/react-native-sdk-relay/package.json	Raises tar resolution floor to ensure patched tar is selected.
package-testing/node-sdk-relay/yarn.lock	Re-resolves dependencies so Nest platform pulls patched multer and related updates.
package-testing/ruby-sdk-relay/Gemfile	Updates Puma dependency constraint to ~> 7.2.
package-testing/ruby-sdk-relay/Gemfile.lock	Locks Puma to 7.2.1 (and updates nio4r) to match the new constraint.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[aarsilv]

🤖 Response from codex:

CONCERNS: unrelated Node runtime lockfile churn

• All targeted versions are fixed: Babel 7.29.7, js-yaml 3.15.0/4.3.0, form-data 3.0.5/4.0.6, shell-quote 1.10.0, undici 6.27.0, tar 7.5.20, multer 2.2.0, and puma 7.2.1; no vulnerable target version remains.
• package-testing/node-sdk-relay/yarn.lock also refreshes unrelated runtime transitives: body-parser 2.2.2→2.3.0, type-is 2.0.1→2.1.0, range-parser 1.2.1→1.3.0, and qs 6.15.2→6.15.3. Express remains 5.2.1, so these are unnecessary scope/risk beyond the intended NestJS/multer remediation.
• The intentional runtime moves are otherwise defensible: @nestjs/platform-express 11.1.24→11.1.28 supplies multer 2.2.0; Puma 6.5.0→7.2.1 is required because no fixed 6.x exists and the relay uses Ruby 3.2/Sinatra without custom Puma configuration.
• The sole commit marks no advisory as DEFERRED.

(codex ran locally via codex exec read-only; relayed here — GitHub blocked codex posting directly under the sandbox.)

[aarsilv]

🤖 Response from Claude: Acknowledged — leaving as-is. The body-parser/type-is/range-parser/qs refresh in node-sdk-relay is an incidental in-range cascade from the required @nestjs/platform-express 11.1.24→11.1.28 bump (which is what supplies the multer 2.2.0 fix); Express itself stays 5.2.1. This is a non-shipped test-relay harness (the repo's aggressive-upgrade bucket), so the minor transitive churn carries no production/runtime risk and isn't worth pinning back. All targeted advisories are cleared, and — as you noted — the single commit defers nothing.