Skip to content

build(deps): Bump fast-uri from 3.1.8 to 3.1.9 - #430

Merged
flex-development[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/fast-uri-3.1.9
Oct 26, 2026
Merged

flex-development[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/fast-uri-3.1.9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026 •

Copy link
Copy Markdown
Contributor

Bumps fast-uri from 3.1.8 to 3.1.9.

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

  • Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
  • Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
  • Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
  • Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

Commits
  • 0def703 Bumped v3.1.9
  • a1d0da2 test: generate only relative path references
  • 9eb8759 fix: preserve relative paths in suffix and relative resolution
  • 54c30f7 docs: note suffix-reference authority ambiguity
  • 39e6493 fix: escape a first-segment colon in suffix references
  • 745183c test: cover first-segment colon in suffix references
  • ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
  • d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
  • eb483b5 test: cover colon-first relative references in normalization
  • b110a35 fix(SEC-02): preserve meaning of relative references during normalization
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.


@dependabot dependabot Bot added scope:dependencies dependency updates type:build changes to the build system or external dependencies labels Oct 26, 2026
@flex-development
flex-development Bot enabled auto-merge (squash) October 26, 2026 08:42
@github-project-automation github-project-automation Bot moved this to 🆕 New in docmark Oct 26, 2026
@codecov

codecov Bot commented Oct 26, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (df42f0a) to head (95d0d82).
⚠️ Report is 5 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@            Coverage Diff            @@
##              main      #430   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           41        41           
  Lines         1221      1221           
  Branches       249       249           
=========================================
  Hits          1221      1221           
Flag Coverage Δ
bun-canary 100.00% <ø> (ø)
bun-latest 100.00% <ø> (ø)
node22 100.00% <ø> (ø)
node24 100.00% <ø> (ø)
node25 100.00% <ø> (ø)
node26 100.00% <ø> (ø)
Components Coverage Δ
docmark 100.00% <ø> (ø)
docmark-factory-block 100.00% <ø> (ø)
docmark-factory-identifier 100.00% <ø> (ø)
docmark-factory-line 100.00% <ø> (ø)
docmark-factory-markers 100.00% <ø> (ø)
docmark-factory-space 100.00% <ø> (ø)
docmark-grammar 100.00% <ø> (ø)
docmark-util-combine-extensions 100.00% <ø> (ø)
docmark-util-subtokenize 100.00% <ø> (ø)
docmark-util-symbol 100.00% <ø> (ø)

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f82b66e...95d0d82. Read the comment docs.

@codecov

codecov Bot commented Oct 26, 2026

Copy link
Copy Markdown

Bundle Report

Bundle size has no change ✅

@flex-development flex-development Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm 👍🏾

@github-project-automation github-project-automation Bot moved this from 🆕 New to 🤩 Approved in docmark Oct 26, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/fast-uri-3.1.9 branch from bb87942 to 5cfe528 Compare October 26, 2026 08:48

@flex-development flex-development Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm 👍🏾

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/fast-uri-3.1.9 branch from 5cfe528 to cb100ad Compare October 26, 2026 08:54

@flex-development flex-development Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm 👍🏾

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.8 to 3.1.9.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.8...v3.1.9)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/fast-uri-3.1.9 branch from cb100ad to 95d0d82 Compare October 26, 2026 09:00

@flex-development flex-development Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm 👍🏾

@flex-development
flex-development Bot merged commit ba50913 into main Oct 26, 2026
49 checks passed
@flex-development
flex-development Bot deleted the dependabot/npm_and_yarn/fast-uri-3.1.9 branch October 26, 2026 09:04
@github-project-automation github-project-automation Bot moved this from 🤩 Approved to ✅ Done in docmark Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

scope:dependencies dependency updates type:build changes to the build system or external dependencies

Projects

Status: ✅ Done

Development

Successfully merging this pull request may close these issues.

0 participants