From d8dc64c25f25eb943b8e7ea933c3882235198ed9 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 3 Sep 2026 01:11:20 +0000 Subject: [PATCH] fix(deps): lift fast-uri override to ^3.1.6 for four new OSV advisories Four NEW fast-uri advisories (GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp; 7.5 high each, fixed in 3.1.6) keep `Validate Package Dependencies` red after #14639/#14736 clear the xmldom/qs batch. Lift the existing #5032 override's target from ^3.1.5 to ^3.1.6 (selector stays at the 4.0.0 boundary) and extend its comment with the four new GHSAs. ajv@8.20.0 declares ^3.0.1, which already admits 3.1.6, so this is a dedupe onto the patched line. pnpm-lock.yaml regenerated with `pnpm install --lockfile-only` only. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV --- pnpm-lock.yaml | 10 +++++----- pnpm-workspace.yaml | 7 ++++++- 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 02e6642fe5..3ffe91fa2a 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -31,7 +31,7 @@ overrides: react-router@<8.3.0: ^8.3.0 '@sveltejs/kit@<2.69.1': ^2.69.1 '@hono/node-server@<3.0.0': ^2.0.10 - fast-uri@<4.0.0: ^3.1.5 + fast-uri@<4.0.0: ^3.1.6 hono@<5.0.0: ^4.12.34 dompurify@<4.0.0: ^3.4.13 nanoid@<4.0.0: ^3.3.17 @@ -6499,8 +6499,8 @@ packages: fast-string-width@3.0.2: resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==} - fast-uri@3.1.5: - resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==} + fast-uri@3.1.7: + resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} fast-wrap-ansi@0.2.2: resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==} @@ -11760,7 +11760,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.5 + fast-uri: 3.1.7 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -12818,7 +12818,7 @@ snapshots: dependencies: fast-string-truncated-width: 3.0.3 - fast-uri@3.1.5: {} + fast-uri@3.1.7: {} fast-wrap-ansi@0.2.2: dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 64f295ebb0..db75bcf0ba 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -239,6 +239,11 @@ overrides: # fast-uri GHSA-7p8r-x3mc-p8w7 (7.5 high) — transitive-only via ajv@8.20.0 # (declares ^3.0.1), which reaches @modelcontextprotocol/sdk, objectql, # secretlint and table. Nothing declares fast-uri directly. + # 2026-09-03 (#14732): four MORE fast-uri advisories, GHSA-5jgf-p345-68v8, + # GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf and GHSA-jqff-g426-hqxp (7.5 + # high each), fixed in 3.1.6 — target lifted from ^3.1.5, selector stays + # at the 4.0.0 boundary. ajv@8.20.0's ^3.0.1 already admits 3.1.6, so + # this is a dedupe onto the patched line, not a forced upgrade. # hono GHSA-8j4g-w8fx-2239 (5.3) — the one entry here that is NOT # transitive-only: two versions resolved, 4.12.32 from our own packages # and 4.12.33 pulled by @modelcontextprotocol/sdk. The override moves the @@ -250,7 +255,7 @@ overrides: # peer states what host hono we work against, and a host that pins an old # hono owns that copy; narrowing it fixes nothing here and only breaks # compatibility. check-override-consistency.mjs covers both forms. - 'fast-uri@<4.0.0': '^3.1.5' + 'fast-uri@<4.0.0': '^3.1.6' 'hono@<5.0.0': '^4.12.34' # OSV 2026-08-07 (#6407) — transitive-only, and the same "it has a fix, so # take the fix" disposition as the batch above: