fix(deps): vuln patch: source-map-js, tinypool [package.json]

[gh-worker-campaigns-3e9aa4]

Summary: Critical-severity security update — 2 packages upgraded (patch changes only)

Manifests changed:

• package.json (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
tinypool	2.1.0	2.1.2	patch	Transitive	4 CRITICAL
source-map-js	1.2.1	1.2.2	patch	Transitive	2 HIGH

---

Security Details

🚨 Critical & High Severity (6 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
tinypool	GHSA-85c8-ppgw-ccpr	CRITICAL	Tinypool: Prototype Pollution Gadget to RCE in run() options	2.1.0	2.1.2	-
tinypool	CVE-2026-104849	CRITICAL	Tinypool: Prototype Pollution Gadget to RCE in run() options	2.1.0	-	-
tinypool	GHSA-5gmw-xhrv-c9v3	CRITICAL	Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution	2.1.0	2.1.1	-
tinypool	CVE-2026-104848	CRITICAL	Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution	2.1.0	-	-
source-map-js	GHSA-68fv-2mgg-jv7q	HIGH	source-map-js allows event-loop denial of service through indexed source-map section offsets	1.2.1	1.2.2	-
source-map-js	CVE-2026-93749	HIGH	source-map-js through 1.2.1 Event Loop Denial of Service	1.2.1	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

[gh-worker-campaigns-3e9aa4]

Auto-rebase complete

Branch is up to date with main — rebased onto 4650280.

---

_{Auto-Rebase · Add no-auto-rebase to opt out}