chore(deps): bump fast-uri to 3.1.1+ to clear GHSA-q3j6-qgpj-74h6 (#1001)

GitHub published a high-severity advisory against fast-uri <= 3.1.0
(path traversal via percent-encoded dot segments,
GHSA-q3j6-qgpj-74h6) which CI's npm audit step now flags. The
vulnerability is not exploitable in Sencho's usage:

The dependency chain is composerize@1.7.5 -> composeverter@1.7.5 ->
ajv@8.18.0 -> fast-uri@3.1.0. Composerize is consumed only by
POST /api/convert/ in routes/convert.ts, which parses CLI-style
docker run flags (not URLs) and returns YAML. ajv's use of fast-uri
is for internal JSON-Schema $ref/$id resolution, not user input.
The CVE requires attacker-controlled URLs flowing into
fast-uri.normalize() or equal() for path-based policy bypass; that
flow does not exist in Sencho.

Even though the vulnerability is not exploitable, npm audit blocks
CI regardless of exploitability assessment (it does not read VEX).
This commit is a lockfile-only bump produced by npm audit fix.
ajv@8.18.0's range already accepts fast-uri >= 3.1.1 so no
package.json change is needed.

Verification: npm audit reports 0 vulnerabilities post-fix; backend
test suite (1921 tests, 5 skipped) is green; tsc --noEmit is clean.
This commit is contained in:
Anso
2026-05-08 15:45:32 -04:00
committed by GitHub
parent 1803512f70
commit b5463e1771
+3 -4
View File
@@ -10,7 +10,6 @@
"hasInstallScript": true,
"license": "SEE LICENSE IN LICENSE",
"dependencies": {
"@aws-sdk/client-s3": "3.1043.0",
"axios": "^1.15.0",
"bcrypt": "^6.0.0",
"better-sqlite3": "^12.6.2",
@@ -4906,9 +4905,9 @@
"license": "MIT"
},
"node_modules/fast-uri": {
"version": "3.1.0",
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
"integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
"version": "3.1.2",
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
"integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
"funding": [
{
"type": "github",