From 91929da2b909336521bad8b0b25ad5ade23d6adf Mon Sep 17 00:00:00 2001 From: Oleksii Orel Date: Wed, 27 May 2026 16:24:25 +0300 Subject: [PATCH 1/2] fix(deps): bump fast-uri to 3.1.2 to address path traversal CVE fast-uri <= 3.1.0 decoded percent-encoded path separators before applying dot-segment removal in normalize() and equal(), allowing attacker-controlled URIs to bypass path-based policy checks. Add resolution pin fast-uri@^3.1.1 to force all transitive dependents to use the patched release (3.1.2). Fixes: CRW-10862 Signed-off-by: Oleksii Orel --- package.json | 3 ++- yarn.lock | 8 ++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index 3cbb767a39..604702e20a 100644 --- a/package.json +++ b/package.json @@ -75,6 +75,7 @@ "svgo": "^3.3.3", "follow-redirects": "^1.16.0", "@fastify/static": "^9.1.1", - "brace-expansion": "^1.1.13" + "brace-expansion": "^1.1.13", + "fast-uri": "^3.1.1" } } diff --git a/yarn.lock b/yarn.lock index 520bcabac7..5b916e119a 100644 --- a/yarn.lock +++ b/yarn.lock @@ -6754,10 +6754,10 @@ __metadata: languageName: node linkType: hard -"fast-uri@npm:^3.0.0, fast-uri@npm:^3.0.1, fast-uri@npm:^3.0.5": - version: 3.1.0 - resolution: "fast-uri@npm:3.1.0" - checksum: 10/818b2c96dc913bcf8511d844c3d2420e2c70b325c0653633f51821e4e29013c2015387944435cd0ef5322c36c9beecc31e44f71b257aeb8e0b333c1d62bb17c2 +"fast-uri@npm:^3.1.1": + version: 3.1.2 + resolution: "fast-uri@npm:3.1.2" + checksum: 10/1dff04865b2a38d3e0659deadfbf72efdf83a776bfbf9667e4aa9e5a3ec31bc341cda9622136b32b7652a857c8ba11896794186e8f876f8b2b72731fce8622f6 languageName: node linkType: hard From ea3165d1da520d5c9545fa11432822e5d4fcd8b0 Mon Sep 17 00:00:00 2001 From: Oleksii Orel Date: Wed, 27 May 2026 16:30:58 +0300 Subject: [PATCH 2/2] chore(deps): regenerate license dependency files Signed-off-by: Oleksii Orel --- .deps/dev.md | 1 - 1 file changed, 1 deletion(-) diff --git a/.deps/dev.md b/.deps/dev.md index d52910259f..f6fee01ca1 100644 --- a/.deps/dev.md +++ b/.deps/dev.md @@ -502,7 +502,6 @@ | `fast-glob@3.3.3` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/fast-glob/3.3.3) | | `fast-json-stable-stringify@2.1.0` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/fast-json-stable-stringify/2.1.0) | | `fast-levenshtein@2.0.6` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/fast-levenshtein/2.0.6) | -| `fast-uri@3.1.0` | BSD-3-Clause | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/fast-uri/3.1.0) | | `fastest-levenshtein@1.0.16` | MIT | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/fastest-levenshtein/1.0.16) | | `fastq@1.15.0` | ISC | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/fastq/1.15.0) | | `fb-watchman@2.0.2` | Apache-2.0 | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/fb-watchman/2.0.2) |