VULN UPGRADE: minor: chai, mocha, rollup [node_modules/is-plain-object]

[campaigner-prod]

Summary: High-severity security update — 3 packages upgraded (MINOR changes included)

Manifests changed:

• node_modules/is-plain-object (npm)

Updates

Package	From	To	Type	Vulnerabilities Fixed
rollup	2.22.1	2.80.0	minor	4 HIGH
chai	4.2.0	4.5.0	minor	-
mocha	6.1.4	6.2.3	minor	-

Packages marked with "-" are updated due to dependency constraints.

---

Security Details

🚨 Critical & High Severity (4 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In
rollup	GHSA-gcx4-mw62-g8wm	HIGH	DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS	2.22.1	3.29.5
rollup	CVE-2024-47068	HIGH	DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS	2.22.1	-
rollup	GHSA-mw96-cpmx-2vgc	HIGH	Rollup 4 has Arbitrary File Write via Path Traversal	2.22.1	2.80.0
rollup	CVE-2026-27606	HIGH	Rollup 4 has Arbitrary File Write via Path Traversal	2.22.1	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI

---

Update Mode: Vulnerability Remediation (High)

🤖 Generated by DataDog Automated Dependency Management System