From b5463e1771ae91910774e2d2efafc87848af8cc3 Mon Sep 17 00:00:00 2001 From: Anso Date: Fri, 8 May 2026 15:45:32 -0400 Subject: [PATCH] chore(deps): bump fast-uri to 3.1.1+ to clear GHSA-q3j6-qgpj-74h6 (#1001) GitHub published a high-severity advisory against fast-uri <= 3.1.0 (path traversal via percent-encoded dot segments, GHSA-q3j6-qgpj-74h6) which CI's npm audit step now flags. The vulnerability is not exploitable in Sencho's usage: The dependency chain is composerize@1.7.5 -> composeverter@1.7.5 -> ajv@8.18.0 -> fast-uri@3.1.0. Composerize is consumed only by POST /api/convert/ in routes/convert.ts, which parses CLI-style docker run flags (not URLs) and returns YAML. ajv's use of fast-uri is for internal JSON-Schema $ref/$id resolution, not user input. The CVE requires attacker-controlled URLs flowing into fast-uri.normalize() or equal() for path-based policy bypass; that flow does not exist in Sencho. Even though the vulnerability is not exploitable, npm audit blocks CI regardless of exploitability assessment (it does not read VEX). This commit is a lockfile-only bump produced by npm audit fix. ajv@8.18.0's range already accepts fast-uri >= 3.1.1 so no package.json change is needed. Verification: npm audit reports 0 vulnerabilities post-fix; backend test suite (1921 tests, 5 skipped) is green; tsc --noEmit is clean. --- backend/package-lock.json | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/backend/package-lock.json b/backend/package-lock.json index 23307167..37efa62a 100644 --- a/backend/package-lock.json +++ b/backend/package-lock.json @@ -10,7 +10,6 @@ "hasInstallScript": true, "license": "SEE LICENSE IN LICENSE", "dependencies": { - "@aws-sdk/client-s3": "3.1043.0", "axios": "^1.15.0", "bcrypt": "^6.0.0", "better-sqlite3": "^12.6.2", @@ -4906,9 +4905,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.0", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz", - "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==", + "version": "3.1.2", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz", + "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==", "funding": [ { "type": "github",