From ed45f245e2debfb09e1293d89edb69f3ab90ae3d Mon Sep 17 00:00:00 2001
From: fro-bot <80104189+fro-bot@users.noreply.github.com>
Date: Thu, 23 Jul 2026 04:41:55 +0000
Subject: [PATCH 1/2] fix(security): remediate fast-uri host confusion advisory
 (High)

fast-uri (transitive devDependency via ajv <- eslint-plugin-json-schema-validator
<- @bfra.me/eslint-config) is vulnerable to GHSA-v2hh-gcrm-f6hx: host
confusion via literal backslash authority delimiter (Dependabot alert #43,
High severity). Patched in fast-uri 3.1.4.

The existing pnpm-workspace.yaml override (added in #655 for earlier
fast-uri advisories) pinned to ^3.1.3, which is itself within the newly
disclosed vulnerable range (>= 3.0.0, <= 3.1.3). Bumped the override to
^3.1.4 and regenerated the lockfile.

Verified: pnpm lint (0 errors), pnpm build, pnpm test (1298/1298 passing).
---
 pnpm-lock.yaml      | 10 +++++-----
 pnpm-workspace.yaml |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 7712f12..05ee522 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -5,7 +5,7 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
-  fast-uri: ^3.1.3
+  fast-uri: ^3.1.4
 
 importers:
 
@@ -1672,8 +1672,8 @@ packages:
   fast-levenshtein@2.0.6:
     resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
 
-  fast-uri@3.1.3:
-    resolution: {integrity: sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==}
+  fast-uri@3.1.4:
+    resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==}
 
   fault@2.0.1:
     resolution: {integrity: sha512-WtySTkS4OKev5JtpHXnib4Gxiurzh5NCGvWrFaZ34m6JehfTUhKZvn9njTfw48t6JumVQOmrKqpmGcdwxnhqBQ==}
@@ -3575,7 +3575,7 @@ snapshots:
   ajv@8.18.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.3
+      fast-uri: 3.1.4
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
@@ -4263,7 +4263,7 @@ snapshots:
 
   fast-levenshtein@2.0.6: {}
 
-  fast-uri@3.1.3: {}
+  fast-uri@3.1.4: {}
 
   fault@2.0.1:
     dependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index b7609cd..1cbd930 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -14,4 +14,4 @@ shellEmulator: true
 strictPeerDependencies: false
 
 overrides:
-  fast-uri: ^3.1.3
+  fast-uri: ^3.1.4

From cb038914275356719891f3291d2e6b23fe75be3e Mon Sep 17 00:00:00 2001
From: fro-bot <80104189+fro-bot@users.noreply.github.com>
Date: Wed, 5 Aug 2026 06:08:57 +0000
Subject: [PATCH 2/2] fix(security): bump fast-uri override to ^3.1.5 (GHSA
 host confusion)

Dependabot alert #52 flagged the fast-uri host confusion advisory (High)
as still open against 3.1.4, which this PR previously pinned. Upstream
patched the issue fully in 3.1.5; bump the pnpm override to close the
remaining exposure.
---
 pnpm-lock.yaml      | 10 +++++-----
 pnpm-workspace.yaml |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 05ee522..764debe 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -5,7 +5,7 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
-  fast-uri: ^3.1.4
+  fast-uri: ^3.1.5
 
 importers:
 
@@ -1672,8 +1672,8 @@ packages:
   fast-levenshtein@2.0.6:
     resolution: {integrity: sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==}
 
-  fast-uri@3.1.4:
-    resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==}
+  fast-uri@3.1.5:
+    resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==}
 
   fault@2.0.1:
     resolution: {integrity: sha512-WtySTkS4OKev5JtpHXnib4Gxiurzh5NCGvWrFaZ34m6JehfTUhKZvn9njTfw48t6JumVQOmrKqpmGcdwxnhqBQ==}
@@ -3575,7 +3575,7 @@ snapshots:
   ajv@8.18.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.4
+      fast-uri: 3.1.5
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
@@ -4263,7 +4263,7 @@ snapshots:
 
   fast-levenshtein@2.0.6: {}
 
-  fast-uri@3.1.4: {}
+  fast-uri@3.1.5: {}
 
   fault@2.0.1:
     dependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 1cbd930..270001a 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -14,4 +14,4 @@ shellEmulator: true
 strictPeerDependencies: false
 
 overrides:
-  fast-uri: ^3.1.4
+  fast-uri: ^3.1.5