[dependabot]

Bumps fast-uri from 3.1.8 to 3.1.9.

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

• Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
• Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
• Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
• Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

• ci: enable trusted publishing releases (v3.x) by @​mcollina in fastify/fast-uri#229

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

Commits

• 0def703 Bumped v3.1.9
• a1d0da2 test: generate only relative path references
• 9eb8759 fix: preserve relative paths in suffix and relative resolution
• 54c30f7 docs: note suffix-reference authority ambiguity
• 39e6493 fix: escape a first-segment colon in suffix references
• 745183c test: cover first-segment colon in suffix references
• ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
• d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
• eb483b5 test: cover colon-first relative references in normalization
• b110a35 fix(SEC-02): preserve meaning of relative references during normalization
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[conatus]

Dependency verification: needs a human review

Package	Change	Class	Gear
fast-uri (packages/join-flow)	3.1.8 → 3.1.9 (patch, security)	build	1: first time this package has been verified

Where it touches our code: nowhere directly. npm why fast-uri shows it only comes in through ajv ← ajv-formats ← schema-utils. Webpack, babel-loader, css-loader, sass-loader, style-loader, html-webpack-plugin, webpack-cli and webpack-dev-server all use schema-utils to validate their options. scripts/bundled-packages.js finds 0 modules from fast-uri, ajv or schema-utils in the production bundle, so none of it ships to members.

What verifies it: the production build (CI: E2E Tests › Build join-flow bundle) and the dev server (scripts/dev-server-smoke.sh). No new test file was needed.

Red/green evidence

Run	Result
Build and dev server on 3.1.8 (base lockfile)	✅ build passes, with the same 3 bundle-size warnings as 3.1.9
Our side broken: unknown option notAnOption on the .scss rule's css-loader	❌ ValidationError: Invalid options object. CSS Loader has been initialized using an options object that does not match the API schema.
Library broken: fast-uri's resolve() appends /changed to its result	❌ build: MissingRefError: can't resolve reference https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/data.json# from id http://json-schema.org/draft-07/schema. Dev server exits with the same error.
Build, dev server and Jest (86 tests) on 3.1.9	✅ all pass

Changelog: four URI-parsing security fixes. Ours are fixed, schema-internal URIs, so none of the newly rejected inputs apply. The release was published by GitHub Actions (npm trusted publishing) rather than a person, which Dependabot flags as a new releaser. That's expected, because the release notes include enabling trusted publishing (fastify/fast-uri#229).

This PR now also adds .github/dependency-coverage/npm/packages/join-flow/fast-uri.json, the ledger entry for fast-uri. Once it's merged, later patch and minor bumps of fast-uri can merge automatically when CI is green. The two commits on top of Dependabot's only touch the ledger (the second moves it to a file per package so parallel Dependabot PRs can't conflict).

Reviewer: @joaquimds. All the packages that pull fast-uri in were added by Chris Devereux in 2020, when the app moved off Create React App. That commit isn't linked to a current collaborator, so the review goes to the person who most recently changed those dependencies.

Please check: is the build plus the dev server enough coverage for a build-only package, and is anything missing from the dependency chain above?

---

Generated by Claude Code