fix: bump fast-uri to 3.1.4 to patch SNYK-JS-FASTURI-18021349#227
Merged
Conversation
Transitive lockfile-only bump of fast-uri 3.1.3 -> 3.1.4 (dev dependency, via ajv > fast-uri under the api-extractor toolchain), patching the high-severity Interpretation Conflict SNYK-JS-FASTURI-18021349. Reachable within the parent ajv's ^3.0.1 range. Resolved against public npmjs.org (the internal mirror lagged 3.1.4). Confirmed via `npm ci` + `snyk test`. Two remaining dev-only findings have no clean fix and are tracked separately: - SNYK-JS-INFLIGHT-6095116 (inflight@1.0.6, ISS-349246): abandoned package, no patched release; pulled in via jest > glob@7. - SNYK-JS-JSYAML-17342520 (js-yaml@3.15.0, ISS-349247): fix only in 4.2.0, unreachable — parent @istanbuljs/load-nyc-config pins js-yaml@^3.13.1.
radovanjorgic
marked this pull request as ready for review
July 22, 2026 09:07
gasperzgonec
approved these changes
Jul 22, 2026
radovanjorgic
added a commit
that referenced
this pull request
Jul 22, 2026
…gration docs Forward-port three main commits onto the refactored v2 code: - #225: attachment loader report emits plural 'attachments' item_type (loading-adapter.ts, both CREATED and FAILED branches; supportedItemTypes stays singular as the stats-file routing key) - #223: axios 1.17.0 -> 1.18.1 (lockfile-only; 10 Snyk fixes) - #227: fast-uri 3.1.3 -> 3.1.4 (lockfile-only, transitive; SNYK-JS-FASTURI-18021349) Correct MIGRATION.md and the migrate-v2 skill against the actual v2 source (from the doc/skill verification audit): fix the npm install version (@beta / newest 2.x, not @2.0.0 which 404s), broaden the WorkerAdapter detect to catch value-context construction, add dispositions for the removed dist/state/state State class and createAdapterState, document the ProcessTaskInterface and TaskAdapterInterface generic flip, correct the mappers *Response count and the ExternalSystemAttachmentIteratorFunction symbol name, and remove stale "MIGRATION.md is wrong" callouts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR patches a high-severity Snyk finding in the transitive dev dependency
fast-uri.It bumps
fast-uri3.1.3 → 3.1.4 as a lockfile-only change (dev dependency, pulled in viaajv > fast-uriunder the@microsoft/api-extractortoolchain), fixing the Interpretation Conflict vulnerability SNYK-JS-FASTURI-18021349. The bump is reachable within the parentajv's^3.0.1range, so nopackage.jsonchange is needed. Resolved againstregistry.npmjs.org(the internal mirror lagged on3.1.4); no internal-mirror URLs remain in the lockfile. Verified with a cleannpm ci,npm run build,npm test, and a re-run ofsnyk test(SNYK-JS-FASTURI-18021349no longer present).Remaining dev-only findings with no clean fix (tracked separately, not addressed here):
inflight@1.0.6(ISS-349246): abandoned package, no patched release; pulled in transitively viajest > glob@7. Would need anoverridesentry or an upstream jest/glob upgrade — larger than a vuln-patch warrants.js-yaml@3.15.0(ISS-349247): fix only in4.2.0, unreachable because the parent@istanbuljs/load-nyc-config@1.1.0pinsjs-yaml@^3.13.1(cross-major).Both are dev/test tooling only and are not shipped in the published package.
Connected Issues
Checklist
npm run testOR no tests needed.npm run test:backwards-compatibility.npm run lint.