Bump fast-uri from 3.1.5 to 3.1.7

[dependabot]

Bumps fast-uri from 3.1.5 to 3.1.7.

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

• GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()
• GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

• GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding
• GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization
• GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

Commits

• 412e40a Bumped v3.1.7
• 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
• 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
• 6f970b2 Bumped v3.1.6
• d941579 fix: never run IDN canonicalization on bracketed IP literals
• c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
• 37f3417 Merge commit from fork
• 607bfbe Merge commit from fork
• ae92a4c Merge commit from fork
• 444ecda Merge commit from fork
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Patch-level transitive dev dependency with security fixes and no direct app code changes; low runtime risk, positive security posture.

Overview
Upgrades the locked fast-uri dependency from 3.1.5 to 3.1.7 in package-lock.json (transitive via ajv as a dev dependency).

This is a security patch release addressing high-severity URI handling issues (authority injection via unvalidated ports in serialize(), host confusion from malformed IP-literal brackets, and related fixes from 3.1.6 such as SSRF/host-confusion paths). No application source changes.

The diff also includes lockfile-only reordering of optional native packages’ libc metadata (e.g. @rollup/*, @napi-rs/lzma-linux-x64-gnu); versions and resolved tarballs for those entries are unchanged aside from the fast-uri bump.

^{Reviewed by Cursor Bugbot for commit 12b4a14. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🤖 Cursor Dependency Analysis

Supply-Chain Malware Review

I'll review the fast-uri 3.1.5 → 3.1.7 update against the malware checklist, starting with upstream diffs, lockfile integrity, and the scanner findings.The local checkout is on a newer major; I’ll inspect the v3.1.5–v3.1.7 range, lockfile integrity, and lifecycle scripts next.Verdict: benign

This is a patch-level Fastify security backport (3.1.5 → 3.1.7) of a dependency-free URI parser. Git tags match the published commits (v3.1.5 = 5e179cbb…, v3.1.7 = 412e40ab…). The lockfile points at the official npm tarball with a normal sha512 integrity field. There are no new runtime dependencies, no preinstall/install/postinstall scripts, no .github workflow changes, and no eval/Function/child_process/network-exfil paths in library code.

Scanner status is warn (warn-only). Interpretation disagrees that those hits are malware: they are expected URI-parser/test patterns.

Scanner hit	Interpretation
charCodeAt in lib/utils.js / lib/schemes.js	Percent-encoding and IDN/scheme character tables
decodeURIComponent	Percent-decoding
http://127.0.0.1, 169.254.169.254 in test/security.test.js	SSRF/host-confusion fixtures for the GHSA patches
xn-- punycode in tests	IDN canonicalization tests
token=SECRET in test/equal.test.js	Query-string equality fixture
maintainer_drift 3.1.5->3.1.7	Version bump heuristic, not a publisher change

No Unicode/IOC/confusable findings. In this repo fast-uri is a dev transitive of ajv only. The update is a legitimate GHSA fix (authority injection, host confusion, SSRF); merge is appropriate from a supply-chain standpoint.

Compatibility Analysis

I'll review how fast-uri is used in this repo and compare that against the 3.1.5→3.1.7 upstream changes.Next I’ll map the lockfile parent (ajv) and check whether this repo calls fast-uri APIs that the security patches changed.Recommendation: merge

fast-uri is not used by this repo’s application code. This is a patch-only security backport (3.1.5 → 3.1.7) that stays on the same ^3.0.1 range Ajv already declared. No public API rename/removal, no new runtime dependencies.

Where it is used

• Not a direct dependency. No require/import of fast-uri in packages/*.
• Lockfile parent: ajv@8.18.0 (fast-uri: ^3.0.1). Ajv is a devDependency of the root workspace and @chia-network/gui.
• Transitive build path: schema-utils@4.3.3 (webpack loaders) → Ajv 8 → fast-uri.
• Not on the ESLint path. Nested eslint / @eslint/eslintrc Ajv is 6.15.0 and uses uri-js, not fast-uri.
• Lockfile marks fast-uri dev: true. It is not in GUI production dependencies and is not imported from GUI/electron source, so it should not ship in the Electron app bundle.

Ajv’s URI resolver calls parse, serialize, and resolve on JSON Schema $id / $ref (see Ajv lib/compile/resolve.ts). That is the only realistic call site.

Intersection with the 3.1.5–3.1.7 changes

Upstream v3.1.6/v3.1.7 only tighten malformed URI handling (serialize() port injection, IP-literal brackets, IDN on scheme-relative refs, repeated percent-decoding, IPv6 normalization, percent-encoded schemes). package.json still exports the same CJS index.js toolbox; version is the only metadata change.

Those APIs are the ones Ajv uses, but webpack/schema-utils and any unused direct Ajv pin here operate on well-formed schema IDs, not attacker-controlled http:// hosts. There is no first-party URI parse/serialize/normalize of user URLs through this package.

Risks / unknowns

• Stricter failures: Hostile or broken $ref/$id strings that previously parsed may now throw. That would show up as a webpack/Ajv compile error, not a GUI runtime SSRF change.
• Not exercised by product tests: No first-party coverage of fast-uri or Ajv URI resolution.
• Local .upstream-dependency checkout is v4.x HEAD, not the v3.1.7 tag; the GitHub v3.1.5...v3.1.7 compare is the range that matches this PR.

No hold reason for this consumer. Merge the Dependabot bump.

---

Malware Scan Summary

• Status: warn
• Warn only mode: true
• Changed upstream files scanned: 19
• Resolution strategy: tag_range
• Changed node/vendor paths: 0
• Changed lockfiles: 0
• Resolved upstream range: 5e179cbb4636d5f773ed21126e5bd3068e87e94e..412e40abd4eb8beabfb952d80abf949a2baf27a3
• Resolved refs: from=5e179cbb4636d5f773ed21126e5bd3068e87e94e to=412e40abd4eb8beabfb952d80abf949a2baf27a3
• Unicode findings (post-allowlist): 0
• Confusable findings (post-allowlist): 0
• IOC findings (post-allowlist): 0
• Heuristic findings (post-allowlist): 29

Top findings

• test/reserved-path-normalization.test.js:9 codepoint_decoder :: const hex = character.charCodeAt(0).toString(16).padStart(2, '0')
• lib/schemes.js:278 codepoint_decoder :: table[chars.charCodeAt(i)] = 1
• lib/schemes.js:321 codepoint_decoder :: const code = input.charCodeAt(i)
• lib/schemes.js:323 codepoint_decoder :: const low = input.charCodeAt(i + 1)
• lib/schemes.js:356 codepoint_decoder :: const code = input.charCodeAt(i)
• lib/schemes.js:376 codepoint_decoder :: const low = input.charCodeAt(i + 1)
• lib/utils.js:37 codepoint_decoder :: code = input[i].charCodeAt(0)
• lib/utils.js:49 codepoint_decoder :: code = input[i].charCodeAt(0)
• lib/utils.js:490 codepoint_decoder :: const code = input.charCodeAt(i)
• lib/utils.js:496 codepoint_decoder :: const low = input.charCodeAt(i + 1)
• lib/utils.js:544 codepoint_decoder :: const code = input.charCodeAt(i)
• lib/utils.js:550 codepoint_decoder :: const low = input.charCodeAt(i + 1)
• lib/utils.js:601 codepoint_decoder :: const code = input.charCodeAt(i)
• lib/utils.js:607 codepoint_decoder :: const low = input.charCodeAt(i + 1)
• lib/utils.js:648 codepoint_decoder :: const code = input.charCodeAt(i)
• lib/utils.js:654 codepoint_decoder :: const low = input.charCodeAt(i + 1)
• lib/utils.js:722 codepoint_decoder :: const code = input.charCodeAt(i)
• lib/utils.js:728 codepoint_decoder :: const low = input.charCodeAt(i + 1)
• test/security.test.js:170 network_c2_indicator :: expected: 'http://127.0.0.1/private',
• test/security.test.js:242 network_c2_indicator :: 'https://169.254.169.254\\@trusted.example.com',