From 3a0b0fdc6b138de34da0e345bf8b559eac682f4b Mon Sep 17 00:00:00 2001 From: Phodal Huang Date: Tue, 4 Aug 2026 20:38:29 +0800 Subject: [PATCH] chore(deps): bump fast-uri from 3.1.4 to 3.1.5 in docs Dependabot alert 5 flags GHSA-7p8r-x3mc-p8w7 (CVE-2026-18446, high): fast-uri below 3.1.5 does not treat a backslash authority introducer as equivalent to `//`, so its host extraction can disagree with Node's WHATWG URL parser. The package is a transitive docs-site dependency reached through @docusaurus/core -> webpack-dev-server -> schema-utils -> ajv, and the existing `^3.0.1` range already admits the patched release, so only the docs lockfile pin moves. Validation: docs `npm ls fast-uri` resolves 3.1.5 with the installed tree on disk at 3.1.5, `npm run build` in docs succeeds for both en and zh-Hans, and node --test over dependency-governance, docs-site, and docs-dx passes (16/16). Co-authored-by: QoderAI (Qwen 3.8 Max) --- docs/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/package-lock.json b/docs/package-lock.json index 20fcb5e..b54baef 100644 --- a/docs/package-lock.json +++ b/docs/package-lock.json @@ -9026,9 +9026,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.4", - "resolved": "https://registry.npmmirror.com/fast-uri/-/fast-uri-3.1.4.tgz", - "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", + "version": "3.1.5", + "resolved": "https://registry.npmmirror.com/fast-uri/-/fast-uri-3.1.5.tgz", + "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", "funding": [ { "type": "github",