From a405bef29c4d40ce816e88a5c1f9da101158dbe8 Mon Sep 17 00:00:00 2001 From: kizy25 Date: Thu, 3 Sep 2026 10:43:39 +0200 Subject: [PATCH] chore(deps): bump fast-uri to 3.1.7 to fix GHSA-fph4-wmhf-6fwf and GHSA-5jgf-p345-68v8 Dependabot alerts #26 and #27 flag fast-uri 3.1.2 (high, dev transitive via webpack > schema-utils > ajv) for SSRF through repeated hostname percent-decoding. Patched in 3.1.6. Pins fast-uri to ^3.1.7 in pnpm.overrides, matching the existing manual vite override. The range is deliberately kept inside 3.x: a plain ">=3.1.6" resolves to 4.1.2, which is itself still vulnerable (4.x needs >=4.1.3), and ajv only declares ^3.0.1. Verified: normalize('http://%256c%256f%2563%2561%256c%2568%256f%2573%2574/') no longer decodes to http://localhost/; 479 tests pass; cjs + esm builds clean. Co-Authored-By: Claude Opus 5 (1M context) --- package.json | 3 ++- pnpm-lock.yaml | 9 +++++---- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index 9dce636..5a6b09d 100644 --- a/package.json +++ b/package.json @@ -157,7 +157,8 @@ "sideEffects": false, "pnpm": { "overrides": { - "vite": ">=8.0.16" + "vite": ">=8.0.16", + "fast-uri": "^3.1.7" } } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index b371853..a352d14 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -6,6 +6,7 @@ settings: overrides: vite: '>=8.0.16' + fast-uri: ^3.1.7 importers: @@ -533,8 +534,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.2: - resolution: {integrity: sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==} + fast-uri@3.1.7: + resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} fdir@6.5.0: resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==} @@ -1416,7 +1417,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.2 + fast-uri: 3.1.7 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -1513,7 +1514,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.2: {} + fast-uri@3.1.7: {} fdir@6.5.0(picomatch@4.0.4): optionalDependencies: