Skip to content

chore(deps): bump fast-uri in /server - #146

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/server/multi-db0bac8a53
Closed

chore(deps): bump fast-uri in /server#146
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/server/multi-db0bac8a53

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026

Copy link
Copy Markdown
Contributor

Bumps and fast-uri. These dependencies needed to be updated together.
Updates fast-uri from 3.1.5 to 3.1.7

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

Commits
  • 412e40a Bumped v3.1.7
  • 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
  • 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
  • 6f970b2 Bumped v3.1.6
  • d941579 fix: never run IDN canonicalization on bracketed IP literals
  • c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
  • 37f3417 Merge commit from fork
  • 607bfbe Merge commit from fork
  • ae92a4c Merge commit from fork
  • 444ecda Merge commit from fork
  • Additional commits viewable in compare view

Updates fast-uri from 4.1.2 to 4.1.4

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

Commits
  • 412e40a Bumped v3.1.7
  • 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
  • 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
  • 6f970b2 Bumped v3.1.6
  • d941579 fix: never run IDN canonicalization on bracketed IP literals
  • c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
  • 37f3417 Merge commit from fork
  • 607bfbe Merge commit from fork
  • ae92a4c Merge commit from fork
  • 444ecda Merge commit from fork
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump fast-uri in /server
fc0616e 
Bumps  and [fast-uri](https://github.com/fastify/fast-uri). These dependencies needed to be updated together.

Updates `fast-uri` from 3.1.5 to 3.1.7
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.5...v3.1.7)

Updates `fast-uri` from 4.1.2 to 4.1.4
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.5...v3.1.7)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.7
  dependency-type: indirect
- dependency-name: fast-uri
  dependency-version: 4.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 2, 2026
@dependabot
dependabot Bot requested a review from thewrz as a code owner September 2, 2026 18:09
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 2, 2026
This was referenced Sep 15, 2026
Closed
Merged
thewrz added a commit that referenced this pull request Sep 15, 2026
@thewrz @claude
fix(deps): honour the 7-day release-age gate for the security pins
e5848e3 
renovate.json sets minimumReleaseAge: 7 days as a supply-chain guard.
Re-pin every version this branch pulled in that was younger than that
to the newest patched release older than 7 days:

- fastify   5.12.4 (4 days)  -> 5.12.3 (11 days)
- puppeteer 25.11.0 (1 day)  -> 25.10.0 (12 days)
- fast-uri  3.1.8 / 4.1.5 (0 days) -> 3.1.7 / 4.1.4 (13 days; the same
  pins dependabot proposed in #146)
- nanoid    3.3.19 (5 days)  -> 3.3.18 (39 days)

Lockfile integrity hashes for the transitive re-pins come from the npm
registry dist metadata and were validated by a clean `npm ci`. Audit
stays at 0 vulnerabilities; typecheck, build, and test:coverage
unchanged (1670 passed).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@thewrz

thewrz commented Sep 15, 2026

Copy link
Copy Markdown
Collaborator

This was written agentically; verify its assertions:

Closing as superseded by #153 (merged as 4bc264f), which landed this bump together with every other open advisory fix. The per-package PRs could not merge individually: branch protection requires the audit check green and an up-to-date branch, and each bot PR inherited the red audit from the advisories the others fixed. #153 resolves all of them in one step (npm audit --audit-level=high → 0 vulnerabilities on main).

🤖 Co-authored by Claude Fable 5.1.

@thewrz thewrz closed this Sep 15, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 15, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@thewrz
thewrz deleted the dependabot/npm_and_yarn/server/multi-db0bac8a53 branch September 15, 2026 19:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@thewrz thewrz Awaiting requested review from thewrz thewrz is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@thewrz