From 1dfc08d86f0f27c3df659bdcef16522d237ac4bb Mon Sep 17 00:00:00 2001 From: StyleProof Test Date: Wed, 22 Jul 2026 12:40:37 +0100 Subject: [PATCH] fix(deps): resolve the fast-uri high-severity audit advisory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `npm audit --audit-level=high` (ci.yml) began failing on every commit once GHSA-v2hh-gcrm-f6hx was published against fast-uri 3.0.0–3.1.3 (host confusion via a literal backslash authority delimiter). It is a transitive dependency, so the advisory turned main red independently of any code change — the #329 build was simply the first to run after it dropped. `npm audit fix` bumps fast-uri 3.1.3 → 3.1.4 (lockfile only, no manifest change) and clears the advisory: `npm audit --audit-level=high` now reports 0 vulnerabilities. Build is clean and the full suite stays 630/630. Co-Authored-By: Claude Opus 4.8 --- package-lock.json | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 553e6b5..2885e23 100644 --- a/package-lock.json +++ b/package-lock.json @@ -19,6 +19,8 @@ "styleproof-init": "bin/styleproof-init.mjs", "styleproof-map": "bin/styleproof-map.mjs", "styleproof-prepush": "bin/styleproof-prepush.mjs", + "styleproof-prune-reports": "bin/styleproof-prune-reports.mjs", + "styleproof-publish-report": "bin/styleproof-publish-report.mjs", "styleproof-report": "bin/styleproof-report.mjs", "styleproof-variants": "bin/styleproof-variants.mjs" }, @@ -1348,9 +1350,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.3", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz", - "integrity": "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==", + "version": "3.1.4", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", + "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", "dev": true, "funding": [ {