Bump fast-uri from 3.1.5 to 3.1.7

[dependabot]

Bumps fast-uri from 3.1.5 to 3.1.7.

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

• GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()
• GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

• GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding
• GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization
• GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

Commits

• 412e40a Bumped v3.1.7
• 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
• 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
• 6f970b2 Bumped v3.1.6
• d941579 fix: never run IDN canonicalization on bracketed IP literals
• c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
• 37f3417 Merge commit from fork
• 607bfbe Merge commit from fork
• ae92a4c Merge commit from fork
• 444ecda Merge commit from fork
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[atlas-commons-bot]

Atlas Commons PR review

Requirement	Status
DCO sign-off	pass
Required checks	pass
Summary filled	fail
Checklist	pass
Linked issue	warn

Overall: fail

• All commits include DCO sign-off.
• Required checks passed.
• Summary section is empty or still has placeholder text.
• All checklist items ticked or none present.
• No linked issue (advisory).

View PR #26 · Atlas-Commons/StreamBooru

[atlas-commons-bot]

Atlas Commons code review (LLM)

Summary

This PR is a lockfile-only bump of transitive fast-uri from 3.1.5 to 3.1.7 in package-lock.json. The dependency is not declared in root package.json; it is pulled in as electron-builder → app-builder-lib → ajv → fast-uri, and the lockfile entry is marked "dev": true. The upgrade backports fixes for several high-severity advisories (SSRF, host confusion, authority injection in serialize()). The diff is minimal and appropriate for a Dependabot security update.

Potential issues

1. Limited runtime security impact. fast-uri is not used by StreamBooru application or server code. User-facing URL handling in server/src/index.js, server/src/proxyFetch.js, and src/shared/refererFor.js relies on the Node built-in URL parser and a hostname allowlist, not fast-uri. Merging this PR improves the build-tool dependency tree and audit posture, but it does not directly harden the deployed server’s proxy endpoints.

2. Server URL validation remains a separate concern. The fixed advisories target fast-uri parsing/serialization behavior. StreamBooru’s booru proxy and imgproxy paths can still be affected by how Node’s URL interprets tricky hostnames (for example, suffix-matching logic in refererFor.js). Existing tests in scripts/test-server-local.js show awareness of this, but that protection is independent of this bump.

3. Future dependency drift is possible without lockfile discipline. This PR correctly pins 3.1.7 in package-lock.json, but fast-uri remains transitive (via ajv ^8.18.0 in app-builder-lib). A future lockfile regeneration or partial update could reintroduce a vulnerable version unless npm ci (or equivalent) is used consistently in CI and release workflows.

Suggestions

• Merge this promptly. Even with limited runtime exposure, it clears known high-severity advisories in the dependency graph and is a semver patch within the same major line.
• After merge, run the existing CI/build checks that exercise electron-builder (for example npm ci followed by npm run pack or npm run test:package) to confirm ajv/fast-uri resolution still works; breakage risk is low but the chain sits on the packaging path.
• Optionally note in the PR or merge commit that runtime SSRF/host protections live in server allowlist code, so reviewers do not assume this dependency bump alone closes server-side URL abuse vectors.
• If Dependabot opens similar PRs for other packages in the ajv/electron-builder tree, prefer keeping those aligned rather than ignoring transitive security updates.

Overall assessment

This is a straightforward, low-risk security maintenance change with a correct scope (lockfile-only, single version bump). I did not identify bugs or correctness issues in the diff itself. The main caveat is contextual: the fixed vulnerabilities are unlikely to affect StreamBooru’s production URL proxy logic because fast-uri is a dev-time transitive dependency, not part of the server runtime. Still, upgrading is the right call for supply-chain hygiene and should be prioritized over leaving 3.1.5 in the tree.

---

Advisory review only — not a merge approval.

View PR #26 · Atlas-Commons/StreamBooru