[dependabot]

Bumps fast-uri from 4.1.2 to 4.2.3.

Release notes

Sourced from fast-uri's releases.

v4.2.3

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 4.x. Applications that process untrusted URI input should upgrade to v4.2.3.

• Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
• Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
• Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
• Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@4.2.3

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

• ci: allow prerelease bump types in the release workflow by @​mcollina in fastify/fast-uri#230

Full Changelog: fastify/fast-uri@v4.2.2...v4.2.3

v4.2.2

What's Changed

• fix: reject invalid URI reference edges by @​mcollina in fastify/fast-uri#221
• fix: encode invalid host characters by @​mcollina in fastify/fast-uri#223
• fix: preserve dot segments in URN namespace strings by @​mcollina in fastify/fast-uri#222
• ci: enable trusted publishing releases by @​Puppo in fastify/fast-uri#225
• chore: bump playwright-test from 14.1.15 to 15.0.1 by @​dependabot[bot] in fastify/fast-uri#226

Full Changelog: fastify/fast-uri@v4.2.1...v4.2.2

v4.2.1

What's Changed

• fix: make mailto normalization idempotent for authority recipients by @​mcollina in fastify/fast-uri#219

Full Changelog: fastify/fast-uri@v4.2.0...v4.2.1

v4.2.0

What's Changed

• docs: clarify security vulnerability scope by @​mcollina in fastify/fast-uri#220
• fix: keep IPv6 zone identifiers stable across parse/normalize/serialize/equal by @​mcollina in fastify/fast-uri#218

Full Changelog: fastify/fast-uri@v4.1.5...v4.2.0

... (truncated)

Commits

• 00f4140 Bumped v4.2.3
• 6d1dc6f test: generate only relative path references
• 52774a5 fix: preserve relative paths in suffix and relative resolution
• b6a75ea docs: note suffix-reference authority ambiguity
• a9b8d67 fix: escape a first-segment colon in suffix references
• bfeefaf test: cover first-segment colon in suffix references
• f6d46df fix(SEC-03): reject non reg-name characters in domain hosts
• f7fc8cc fix: keep a colon-first segment behind "./" in relative normalization
• b6dda15 test: cover colon-first relative references in normalization
• acc5c5d fix(SEC-02): preserve meaning of relative references during normalization
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.