chore(deps): bump fast-uri from 3.1.6 to 3.1.8
Bumps fast-uri from 3.1.6 to 3.1.8.
Release notes
Sourced from fast-uri's releases.
v3.1.8
⚠️ Security Warning
This security release fixes the following medium-severity security advisory:
- GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets
Users of the v3.x release line should upgrade to v3.1.8.
Full Changelog: https://github.com/fastify/fast-uri/compare/v3.1.7...v3.1.8
v3.1.7
⚠️ Security Warning
This is a security release that fixes the following high-severity security advisories:
- GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in
serialize()- GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets
Users of the v3.x release line should upgrade to v3.1.7.
Full Changelog: https://github.com/fastify/fast-uri/compare/v3.1.6...v3.1.7
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by cubic
Bumps fast-uri from 3.1.6 to 3.1.8 to address three security advisories: a medium-severity host case normalization issue and two high-severity advisories covering authority injection via unvalidated ports and host confusion from IP-literal brackets. This is an indirect dependency, so only package-lock.json changes; no code, billing, or metering impact. Dependabot reports a compatible score and existing tests cover the affected parsing path.