Skip to content

Patch development URI resolution and complete security release notes - #248

Merged
officialsuyogdixit merged 2 commits into
mainfrom
dependabot/npm_and_yarn/fast-uri-3.1.9
Nov 2, 2026
Merged

officialsuyogdixit merged 2 commits into
mainfrom
dependabot/npm_and_yarn/fast-uri-3.1.9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026 •

Copy link
Copy Markdown
Contributor

Update the development SDK/Ajv URI resolver from fast-uri 3.1.8 to 3.1.9, covering encoded scheme, host confusion, relative-path and suffix-reference fixes. Integrate the merged security-clearing main from PR #249 so its body-parser, Zod, MCP/Hono and release metadata remain intact. Document the complete 0.3.3 dependency update and distinguish this development package from URI code embedded inside upstream SDK bundles.

Validation:

  • All four focused URI checks pass: encoded scheme rejection, colon-first relative-path preservation, legitimate HTTPS resolution and relative schema references. Both adversarial checks fail with the former root 3.1.8 package.
  • Clean npm ci, typecheck and harness/shared operation catalog pass. npm audit reports zero vulnerabilities in the installed graph.
  • The integrated main already passed all six PR Patch HTTP parsing and compatible security dependencies #249 CI jobs and the complete local check (637 passed, 57 conditional skips, zero failures). Fresh exact-head CI remains the merge gate for this PR.

No runtime operation, migration, permission, new dependency or distributed extension change. Release 0.3.3 publication, immutable image acceptance, deployment and authenticated live readback follow final merged-main CI; this PR alone does not establish deployment.

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.8 to 3.1.9.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.8...v3.1.9)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026
@officialsuyogdixit officialsuyogdixit changed the title Bump fast-uri from 3.1.8 to 3.1.9 Patch development URI resolution and complete security release notes Nov 2, 2026
@officialsuyogdixit
officialsuyogdixit merged commit 82b425d into main Nov 2, 2026
6 checks passed
@officialsuyogdixit
officialsuyogdixit deleted the dependabot/npm_and_yarn/fast-uri-3.1.9 branch November 2, 2026 04:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant