From 7c32152761110a1e4b90284958f183dfcb71f6ac Mon Sep 17 00:00:00 2001 From: Graeme Foster <80714+GraemeF@users.noreply.github.com> Date: Mon, 24 Aug 2026 12:41:16 +0100 Subject: [PATCH] fast-uri's override already admits the fix, so only the lock pin moves MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Clears five HIGH advisories by moving `fast-uri` 4.1.1 -> 4.1.3 in `bun.lock`. One line, no manifest change. - GHSA-7p8r-x3mc-p8w7 — fixed in 4.1.2 - GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalisation - GHSA-f65p-4m7j-42xc — SSRF via malformed authority - GHSA-fph4-wmhf-6fwf — SSRF via repeated components - GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme The last four were published 2026-09-02 and are all fixed in 4.1.3, so the same one-line move that this branch already carried for the first one clears all five once the pin lands on 4.1.3 rather than 4.1.2. ## Why it's a lockfile-only change `fast-uri` is transitive. It arrives through `ajv`, which declares `fast-uri: ^3.0.1`, and `package.json`'s `overrides` block already raises that to `^4.1.1`. 4.1.3 satisfies the override, so the lock pin was the only thing holding the tree on the vulnerable version. The override also collapses `ajv` onto the single 4.x resolution, so `bun.lock` holds exactly one `fast-uri` entry and one pin move covers the tree — there is no 3.x copy left behind, and the 3.x line is vulnerable to all five. ## Why the entry is edited rather than re-resolved `bun update fast-uri` does not fix this. It reports `installed fast-uri@4.1.1`, leaves the lock entry unmoved, and adds `fast-uri` to the root `package.json` as a direct dependency pinned exactly — because `bunfig.toml` sets `exact = true`. The manifest changes and the vulnerable copy stays. PR #216 recorded the same behaviour for `ip-address`. Editing the single lock line keeps the diff to what the advisories require. `bun install --frozen-lockfile` accepts the result against a wiped `node_modules` — which is also what verifies the hand-written integrity hash, since bun checks the tarball against it — and the only copy in the tree is `node_modules/.bun/fast-uri@4.1.3`. ## Supply-chain gate `bunfig.toml` sets `minimumReleaseAge = 604800`. 4.1.3 published 2026-08-23, so it clears the seven-day window by 11 days. The gate was not lowered or bypassed. `fast-uri` 4.1.4 published 2026-09-02 and is inside the window until 2026-09-09. The override's caret admits it, so the gate is what holds this resolution at 4.1.3. No advisory here names 4.1.4. ## Not in this PR - **GHSA-v2hh-gcrm-f6hx** is fixed in `fast-uri` 4.1.1 and `main` is already there. No work. - **A release.** commy carries 27 commits unreleased since `commy-v0.22.0`, tracked as `comms-ngz0`. This merge fixes `main`, not the published npm bundle. Raised by nixos-config from osv-scanner findings; tracked as `comms-k9f9`. --- bun.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bun.lock b/bun.lock index 091b51c..1b01c63 100644 --- a/bun.lock +++ b/bun.lock @@ -257,7 +257,7 @@ "fast-deep-equal": ["fast-deep-equal@3.1.3", "", {}, "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="], - "fast-uri": ["fast-uri@4.1.1", "", {}, "sha512-YPOs1zD5TG2+EZt+r88LwF6mclA7TPkpwMP7ZN3TO2HiHS8TXvq7QA/17iJsV9dubcLo/f8eEYqMBruyQV21hQ=="], + "fast-uri": ["fast-uri@4.1.3", "", {}, "sha512-7+72G6vLt7jjNas8SmSATx2qeyRIjxeqO3i4IkmDTxlqYZRKANhOe1bnovcp4WZmvsYrp60WyqPyHqgRiX0yXw=="], "finalhandler": ["finalhandler@2.1.1", "", { "dependencies": { "debug": "^4.4.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "on-finished": "^2.4.1", "parseurl": "^1.3.3", "statuses": "^2.0.1" } }, "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA=="],