From 338df185014a03a381597db64a2cd804b91d06c5 Mon Sep 17 00:00:00 2001 From: Danny Holloran Date: Mon, 7 Sep 2026 01:11:55 -0700 Subject: [PATCH 1/2] Bump fast-uri override to ^3.1.6 to clear HIGH audit advisories Four fast-uri advisories (GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp) all affect versions <3.1.6. The existing override pinned fast-uri to ^3.1.5, which is itself in the vulnerable range. Bump to ^3.1.6 (resolves to 3.1.7), staying within ajv@8.18.0's declared ^3.0.1 requirement. --- package-lock.json | 6 +++--- package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index f32148d..1db8325 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2095,9 +2095,9 @@ } }, "node_modules/fast-uri": { - "version": "3.1.5", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", - "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", + "version": "3.1.7", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", + "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", "funding": [ { "type": "github", diff --git a/package.json b/package.json index d98d564..3b3df9b 100644 --- a/package.json +++ b/package.json @@ -47,7 +47,7 @@ }, "overrides": { "brace-expansion": "^5.0.9", - "fast-uri": "^3.1.5", + "fast-uri": "^3.1.6", "nanoid@^3": "^3.3.17" } } From 128835f393e8de4328702cf8f46fe1990e702901 Mon Sep 17 00:00:00 2001 From: Danny Holloran Date: Mon, 7 Sep 2026 01:12:55 -0700 Subject: [PATCH 2/2] Track verified fast-uri version in override floor Bump floor from ^3.1.6 to ^3.1.7 to match the version actually installed and audited, per code review feedback. Both ranges resolve to 3.1.7 in this lockfile, but pinning the floor to the untested 3.1.6 left a gap: a future install landing exactly on 3.1.6 would never have been verified against the advisories. --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 3b3df9b..9205055 100644 --- a/package.json +++ b/package.json @@ -47,7 +47,7 @@ }, "overrides": { "brace-expansion": "^5.0.9", - "fast-uri": "^3.1.6", + "fast-uri": "^3.1.7", "nanoid@^3": "^3.3.17" } }