From 5f4ed76910cbd305c311e5222f73484c3f9868b5 Mon Sep 17 00:00:00 2001
From: askalf <263217947+askalf@users.noreply.github.com>
Date: Wed, 5 Aug 2026 13:52:03 -0400
Subject: [PATCH] fix(deps): override fast-uri to 3.1.5 (GHSA-7p8r-x3mc-p8w7)

fast-uri is pulled in transitively via @modelcontextprotocol/sdk ->
ajv, resolving to 3.1.4 with no override in place. GHSA-7p8r-x3mc-p8w7
/ CVE-2026-18446 (high, CVSS 7.5): fast-uri doesn't treat `\`, `/\`,
`\/` as an authority introducer, but Node's native WHATWG URL/fetch
does for http(s) -- so the two parsers can extract different hosts
from the same string. Patched in 3.1.5.
---
 package-lock.json | 6 +++---
 package.json      | 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 57dde1e..59c4f11 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -509,9 +509,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
-      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
+      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
       "funding": [
         {
           "type": "github",
diff --git a/package.json b/package.json
index b74c515..da19fc8 100644
--- a/package.json
+++ b/package.json
@@ -37,6 +37,7 @@
   },
   "overrides": {
     "@askalf/redstamp": "$@askalf/redstamp",
-    "@hono/node-server": "^2.0.5"
+    "@hono/node-server": "^2.0.5",
+    "fast-uri": "^3.1.5"
   }
 }