chore(deps): bump transitive fast-uri to 3.1.5 (Dependabot alert #26) - #186
Merged
Conversation
fast-uri 3.1.4 is vulnerable to GHSA-7p8r-x3mc-p8w7 / CVE-2026-18446 ("host confusion via backslash authority introducer", CVSS 7.5). 3.1.5 is the first patched version. Same shape as #148, which fixed alerts #20/#21 on this exact package — and #148's own commit message predicted this follow-up: it could not take 3.1.5 at the time because the version had been published that day and pnpm's minimumReleaseAge quarantine rejected it. It has since aged out, so this is the bump that finishes that job. Scope is dev-only and unchanged: `pnpm why fast-uri --prod` returns nothing. The single instance reaches the tree through ajv@8.20.0 → schema-utils → the Storybook/webpack devDependency chain, where it parses URIs during build-time JSON-schema validation of loader options. Nothing in the shipped app imports it. Lockfile-only, by the same method #148 documented: ajv's `^3.0.1` range already admits 3.1.5, but `pnpm update fast-uri` (with or without `-r` / `--depth Infinity`) will not re-resolve a transitive dependency, so the three lockfile entries are edited directly with the registry integrity hash. Verified: `pnpm install --frozen-lockfile` accepts the edit ("Lockfile passes supply-chain policies", 918 entries) and resolves 3.1.5 on disk; tsc clean (run via the binary, per the pnpm gate trap); 447 unit tests pass; and `pnpm build-storybook` — the chain that actually consumes fast-uri — completes successfully. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fast-uri 3.1.4 is vulnerable to GHSA-7p8r-x3mc-p8w7 / CVE-2026-18446
("host confusion via backslash authority introducer", CVSS 7.5). 3.1.5
is the first patched version.
Same shape as #148, which fixed alerts #20/#21 on this exact package —
and #148's own commit message predicted this follow-up: it could not
take 3.1.5 at the time because the version had been published that day
and pnpm's minimumReleaseAge quarantine rejected it. It has since aged
out, so this is the bump that finishes that job.
Scope is dev-only and unchanged:
pnpm why fast-uri --prodreturnsnothing. The single instance reaches the tree through
ajv@8.20.0 → schema-utils → the Storybook/webpack devDependency chain,
where it parses URIs during build-time JSON-schema validation of loader
options. Nothing in the shipped app imports it.
Lockfile-only, by the same method #148 documented: ajv's
^3.0.1rangealready admits 3.1.5, but
pnpm update fast-uri(with or without-r/--depth Infinity) will not re-resolve a transitive dependency,so the three lockfile entries are edited directly with the registry
integrity hash.
Verified:
pnpm install --frozen-lockfileaccepts the edit ("Lockfilepasses supply-chain policies", 918 entries) and resolves 3.1.5 on disk;
tsc clean (run via the binary, per the pnpm gate trap); 447 unit tests
pass; and
pnpm build-storybook— the chain that actually consumesfast-uri — completes successfully.
Co-Authored-By: Claude Fable 5 noreply@anthropic.com
🤖 Generated with Claude Code