[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
fast-uri	4.2.1 → 4.2.3

---

Release Notes

fastify/fast-uri (fast-uri)

v4.2.3

Compare Source

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 4.x. Applications that process untrusted URI input should upgrade to v4.2.3.

• Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
• Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
• Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
• Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@4.2.3

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

• ci: allow prerelease bump types in the release workflow by @​mcollina in #​230

Full Changelog: fastify/fast-uri@v4.2.2...v4.2.3

v4.2.2

Compare Source

What's Changed

• fix: reject invalid URI reference edges by @​mcollina in #​221
• fix: encode invalid host characters by @​mcollina in #​223
• fix: preserve dot segments in URN namespace strings by @​mcollina in #​222
• ci: enable trusted publishing releases by @​Puppo in #​225
• chore: bump playwright-test from 14.1.15 to 15.0.1 by @​dependabot[bot] in #​226

Full Changelog: fastify/fast-uri@v4.2.1...v4.2.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.