fix(deps): bump fast-uri past 4 HIGH advisories in both lockfiles - #849
Merged
Conversation
`security-pr` fails on `main`, and therefore on every branch merged with it. osv-scanner reports 8 findings across two lockfiles, all `fast-uri@3.1.5` — four distinct HIGH advisories counted once per lockfile: GHSA-5jgf-p345-68v8 host confusion via skipped IDN canonicalization GHSA-jqff-g426-hqxp host confusion via percent-encoded scheme GHSA-f65p-4m7j-42xc SSRF via malformed IPv6 GHSA-fph4-wmhf-6fwf SSRF via repeated host separators `fast-uri` is transitive (via `ajv`) and pins already existed in both places — both at `^3.1.5`, which resolves to exactly the vulnerable version. Bumped to `^3.1.6`; both lockfiles now resolve `3.1.7`. Mirrored deliberately: `integrations/jira-forge-app` is a standalone npm project outside the yarn workspaces, so the root `resolutions` bump does not reach it and its `package-lock.json` has to be re-locked on its own. That is the case `check:transitive-pin-sync` exists for (#712). Lockfile-only — no source change. Verified `mise run security:deps` exits 0 (was 1) and `mise run drift-prevention` reports `check-transitive-pin-sync: OK — 4 shared pin(s) in sync between root resolutions and jira-forge-app`. Closes #848
isadeks
added
dependencies
ayushtr-aws
approved these changes
Sep 2, 2026
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #848.
security-prfails onmain, and therefore on every branch merged with it. osv-scanner reports 8 findings across two lockfiles, allfast-uri@3.1.5— four distinct HIGH advisories, counted once per lockfile:fast-uriis transitive (viaajv) and pins already existed in both places — both at^3.1.5, which resolves to exactly the vulnerable version. Bumped to^3.1.6; both lockfiles now resolve3.1.7.Mirrored deliberately:
integrations/jira-forge-appis a standalone npm project outside the yarn workspaces, so the rootresolutionsbump does not reach it and itspackage-lock.jsonhas to be re-locked separately. That is the casecheck:transitive-pin-syncexists for (#712).Lockfile-only — no source change. Four files: two pins, two lockfiles.
Verified locally:
mise run security:deps→ exit 0 (was 1)mise run drift-prevention→check-transitive-pin-sync: OK — 4 shared pin(s) in sync between root resolutions and jira-forge-appSame shape as #637/#636. Filed separately rather than folded into #705, which this currently blocks but did not cause.