chore: upgrade fast-uri to ^3.1.6 to address CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172 - #1626
Open
claude[bot] wants to merge 2 commits into
Open
chore: upgrade fast-uri to ^3.1.6 to address CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172#1626claude[bot] wants to merge 2 commits into
claude[bot] wants to merge 2 commits into
Conversation
…-75931, CVE-2026-75975, CVE-2026-76172 Raises the existing qualified `fast-uri` resolution floor from ^3.1.2 to ^3.1.6 so the resolved version (3.1.7) is no longer affected by the SSRF, host-confusion, and URI-parsing advisories. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
License Audit❌ Audit failed to produce results. Check the workflow logs for details. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes SOU-2123
Fixes SOU-2124
Fixes SOU-2125
Fixes SOU-2126
Summary
fast-uriresolved to3.1.5, which is affected by four advisories. The repo already carries a qualified resolution (fast-uri@npm:^3.0.1), but its floor of^3.1.2still admitted the vulnerable version. This raises the floor to^3.1.6; the lockfile now resolvesfast-urito3.1.7.Advisories addressed
All are fixed in
3.1.6.Verification
yarn why fast-urireports a single instance:ajv@npm:8.18.0 -> fast-uri@npm:3.1.7 (via npm:^3.1.6). No affected version remains in the graph.yarn install --immutablesucceeds.yarn build:depssucceeds.yarn testpasses (2153 tests across queryLanguage, shared, backend, and web).🤖 Generated with Claude Code
Note
Low Risk
Dependency-only security patch with no runtime logic changes; risk is limited to URI parsing behavior in the upgraded library.
Overview
Raises the Yarn resolution floor for
fast-urifrom^3.1.2to^3.1.6, so the lockfile no longer pins the vulnerable3.1.5release and instead resolves3.1.7. This is a transitive dependency (e.g. viaajv) with no application code changes.Documents the upgrade under Unreleased → Fixed in
CHANGELOG.md.Reviewed by Cursor Bugbot for commit 2daba5e. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by cubic
Raises the
fast-uriresolution floor from^3.1.2to^3.1.6, fixing four CVEs (SSRF, host confusion, and URI parsing) by resolving to3.1.7instead of the vulnerable3.1.5. Fixes SOU-2123, SOU-2124, SOU-2125, and SOU-2126.Written for commit ec88781. Summary will update on new commits.