Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

chore(deps): bump fast-uri from 3.1.5 to 3.1.8

Open
Number: #756
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: Unknown
Comments: 1
Created: October 03, 2026 at 08:08 AM UTC
(11 days ago)
Updated: October 03, 2026 at 08:08 AM UTC
(11 days ago)
Labels:
dependencies javascript
Description:

Bumps fast-uri from 3.1.5 to 3.1.8.

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: https://github.com/fastify/fast-uri/compare/v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: https://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.6

Commits
  • ead3ab7 Bumped v3.1.8
  • c88b59e fix: normalize decoded reg-name case
  • 412e40a Bumped v3.1.7
  • 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
  • 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
  • 6f970b2 Bumped v3.1.6
  • d941579 fix: never run IDN canonicalization on bracketed IP literals
  • c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
  • 37f3417 Merge commit from fork
  • 607bfbe Merge commit from fork
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.
Package Dependencies
Package:
fast-uri
Ecosystem:
npm
Version Change:
3.1.5 → 3.1.8
Update Type:
Patch
Security Advisories
fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
GHSA-5jgf-p345-68v8 CVE-2026-75931 HIGH
### Impact `fast-uri` canonicalizes a host to its ASCII form only when the input carries an explicit scheme. When `resolve()` resolves a scheme-relative reference (`//host/`) against a scheme-bear...
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
GHSA-f65p-4m7j-42xc CVE-2026-75975 HIGH
### Impact `fast-uri` does not validate the complete RFC 3986 grammar for bracketed IPv6 literals, so a malformed literal with invalid trailing text is silently truncated to a different valid IPv6...
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
GHSA-fph4-wmhf-6fwf CVE-2026-75899 HIGH
### Impact `fast-uri` decodes a hostname's percent escapes twice in a single `normalize()` or `resolve()` call: once during parsing and again during authority recomposition. A nested percent-encod...
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
GHSA-jqff-g426-hqxp CVE-2026-76172 HIGH
### Impact `fast-uri` decodes percent-encoded characters in the scheme component with the legacy global `unescape()` and serializes the result back as raw characters, without re-escaping it or val...
fast-uri vulnerable to authority injection via an unvalidated port in serialize
GHSA-qw65-cvwx-89v3 CVE-2026-84292 HIGH
### Impact `fast-uri` serializes the `port` component of a URI without validating it. When recomposing the authority, `fast-uri` escapes the userinfo and host components but concatenates the port ...
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
GHSA-58mr-gqgx-xq4g CVE-2026-84394 HIGH
### Impact `fast-uri` accepts a host that contains an unbalanced or misplaced authority bracket (`[` or `]`) without reporting an error. A host that starts with `[` but does not end with `]`, such...
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
GHSA-hrr3-gc8f-f4qj CVE-2026-86472 MODERATE
### Impact `fast-uri` folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase unreserved octet such as `%41` decodes to a literal `A` that is never folded. F...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 16659111
UUID: 5687814783
Node ID: PR_kwDOBuP93s8AAAABGaMKqg
Host: GitHub
Repository: sid88in/serverless-appsync-plugin