From 6ed1b618ece621c9212e05bbb5fe2b8aa81ae2d7 Mon Sep 17 00:00:00 2001 From: Dhruv Parekh Date: Thu, 3 Sep 2026 15:41:43 +0530 Subject: [PATCH] fix(deps): raise fast-uri override to ^3.1.7 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SNYK-JS-FASTURI-19502739 / SNYK-JS-FASTURI-19502854 (both high). The existing override floor of ^3.1.6 resolves to 3.1.6, which Snyk reports as vulnerable (fixedIn: 2.4.6 / 3.1.7 / 4.1.4). Raising the floor to ^3.1.7 keeps the fix on the 3.x line - no major move - and stays a caret so future patches float in. This is the only dependency gap left on development: it already carries the scoped istanbul-lib-processinfo > uuid ^11.1.1 override, serialize-javascript ^7.1.0 (resolving 7.1.1), and adm-zip ^0.6.0 with file-upload.ts already adapted to writeZipPromise's void return. Validation: fast-uri resolves 3.1.6 -> 3.1.7; snyk high cleared; build green; 137 tests + 8 suites passing. Note: adm-zip@0.6.0 is still reported high by Snyk with fixedIn: [] - the major bump on development did not resolve it and no fixed release exists. Out of scope here; flagged for a human. #claude_code# 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- package-lock.json | 6 +++--- package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index f749122..2d603d2 100644 --- a/package-lock.json +++ b/package-lock.json @@ -6784,9 +6784,9 @@ } }, "node_modules/fast-uri": { - "version": "3.1.6", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz", - "integrity": "sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==", + "version": "3.1.7", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", + "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", "funding": [ { "type": "github", diff --git a/package.json b/package.json index 4e20ba3..9d710d9 100644 --- a/package.json +++ b/package.json @@ -116,7 +116,7 @@ }, "qs": "^6.16.0", "tmp": "^0.2.4", - "fast-uri": "^3.1.6", + "fast-uri": "^3.1.7", "js-yaml": "^4.3.1", "minimatch@10.2.5": { "brace-expansion": "^5.0.9"