Bump fast-uri 3.1.2 → 3.1.5 (host confusion — GHSA-v2hh-gcrm-f6hx / GHSA-4c8g-83qw-93j6) - #62
Merged
Merged
Conversation
…HSA-4c8g-83qw-93j6) Security patch for the two fast-uri host-confusion advisories (GHSA-v2hh-gcrm-f6hx literal-backslash authority delimiter, and GHSA-4c8g-83qw-93j6 failed IDN canonicalization; issue #61). fast-uri is a transitive dep (range ^3.0.1); re-resolved to the latest 3.x (3.1.5), which clears both. yarn.lock-only — package.json is untouched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
Author
|
@claude Please review? |
jlocke2
approved these changes
Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
High: two fast-uri host-confusion advisories (issue #61, due 2026-08-24 — soonest of the assigned vulns):
Fix
fast-uri is a transitive dependency (range
^3.0.1), so this is a lockfile-only bump — re-resolved to the latest 3.x (3.1.5), clearing both advisories (patched 3.1.3 / 3.1.4). package.json is untouched (fast-uri stays transitive).Closes #61.
🤖 Generated with Claude Code