Skip to content

Commit ae44ae4

Browse files
committed
chore(deps): add fast-uri ^3.1.2 override to fix 2 high-severity CVEs
Closes Dependabot alerts: - #128 fast-uri path traversal via percent-encoded dot segments (HIGH) - #129 fast-uri host confusion via percent-encoded authority delimiters (HIGH) fast-uri is a transitive dep pulled in by the ajv → fastify-style chain. The 3.1.2 release normalises percent-encoded sequences before authority/path parsing, closing both classes of confusion.
1 parent 4f9dcbc commit ae44ae4

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

package.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,8 @@
8383
"esbuild": "^0.25.0",
8484
"nanoid": ">=3.3.11 <4.0.0 || >=5.0.9",
8585
"yaml": ">=1.10.3 <2.0.0 || >=2.8.3",
86-
"webpack": "^5.104.1"
86+
"webpack": "^5.104.1",
87+
"fast-uri": "^3.1.2"
8788
},
8889
"onlyBuiltDependencies": []
8990
}

0 commit comments

Comments
 (0)