Summary

apps/api

• fast-uri override bumped: >=3.1.5 <4.0.0 → >=3.1.7 <4.0.0
  • Resolves GHSA-5jgf-p345-68v8 (host confusion via skipped IDN canonicalization)
  • Resolves GHSA-f65p-4m7j-42xc (SSRF via malformed IPv6 normalization)
  • Resolves GHSA-fph4-wmhf-6fwf (SSRF via repeated hostname percent-decoding)
  • Resolves GHSA-jqff-g426-hqxp (host confusion via percent-encoded scheme normalization)
  • Resolved version: 3.1.7, release date: 2026-09-02
  • Override selector: fast-uri: ">=3.1.7 <4.0.0" — the <4.0.0 ceiling prevents drift into the v4 major.
• fast-uri added to minimumReleaseAgeExclude in pnpm-workspace.yaml — allows the 12-hour supply-chain age gate to be bypassed for this security-patch release (same pattern as follow-redirects).

apps/ui/ingestion-ui

• fast-uri override bumped: >=3.1.5 <4.0.0 → >=3.1.7 <4.0.0
  • Resolves GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp (same advisories, transitive via eslint → ajv → fast-uri)
  • Resolved version: 3.1.7, release date: 2026-09-02
  • Override selector: fast-uri: ">=3.1.7 <4.0.0" — the <4.0.0 ceiling prevents drift into the v4 major.
• fast-uri@3.1.7 added to minimumReleaseAgeExclude (auto-inserted by pnpm) to unblock the age-gated install.

Summary by cubic

Upgrades fast-uri from 3.1.5 to 3.1.7 in the API and ingestion UI to fix four host-confusion and SSRF advisories: GHSA-5JGF, GHSA-F65P, GHSA-FPH4, and GHSA-JQFF. The existing <4.0.0 version ceiling remains in place.

Dependencies

• Excludes the security patch from the 12-hour minimum release-age gate so installs can use fast-uri@3.1.7 immediately.

^{Written for commit 48b5f58. Summary will update on new commits.}