fix(deps): resolve the fast-uri high-severity audit advisory - #331
Merged
Conversation
`npm audit --audit-level=high` (ci.yml) began failing on every commit once GHSA-v2hh-gcrm-f6hx was published against fast-uri 3.0.0–3.1.3 (host confusion via a literal backslash authority delimiter). It is a transitive dependency, so the advisory turned main red independently of any code change — the #329 build was simply the first to run after it dropped. `npm audit fix` bumps fast-uri 3.1.3 → 3.1.4 (lockfile only, no manifest change) and clears the advisory: `npm audit --audit-level=high` now reports 0 vulnerabilities. Build is clean and the full suite stays 630/630. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
🗺️ StyleProof report📊 View the side-by-side visual report →Coverage, determinism, or report/diff consistency evidence is incomplete — repair the capture or reflow source; visual approval cannot clear this failure. |
BenSheridanEdwards
added a commit
that referenced
this pull request
Jul 22, 2026
Cut 4.7.0 from the six commits merged since 4.6.3. Two are feature work, so this is a minor bump; the version bump is the Release workflow's signal to tag, publish to npm, and cut the GitHub Release on merge. Added - Reports publish through the git-data API (#328). - styleproof-init prunes reports by API with a retention + size-budget sweep (#329). - CERTIFICATION_FAILED dogfooded end-to-end (#327). Security - Cleared two high-severity transitive advisories: brace-expansion 5.0.6→5.0.7 (#330) and fast-uri 3.1.3→3.1.4, GHSA-v2hh-gcrm-f6hx (#331). Verified locally: build, typecheck, lint, format:check, privacy:check all clean; full node --test suite 630/630 with a complete install. Co-authored-by: StyleProof Test <styleproof@example.test> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why does this feature exist?
The CI workflow's dependency audit step (
npm audit --audit-level=high, ci.yml) fails on every branch including main over one high severity advisory in transitivefast-uri3.1.3 — GHSA-v2hh-gcrm-f6hx, host confusion via a literal backslash authority delimiter.fast-uriis a transitive dependency, so main went red independently of any diff; the #329 build was simply the first to run after the advisory was published.What changed?
package-lock.jsononly:fast-uri3.1.3 to 3.1.4 vianpm audit fix. No direct dependency changed, no manifest change, no code changed.Behavioural Proof (with video and screenshots)
Not applicable: a lockfile-only transitive bump with no rendered surface. Proof is
npm audit --audit-level=highreporting 0 vulnerabilities after the bump, and the full test suite passing against the updated tree.Verification Summary
npm audit --audit-level=high: 1 high severity vulnerability before, 0 after.npm run build(tsc): clean.node --testsuite: 630 pass, 0 fail.package-lock.json(version + integrity + resolved for fast-uri 3.1.4).