Repository navigation
(janitor/dependencies): patch fast-uri normalization vulnerabilities - #8890
Open
kilo-code-bot[bot] wants to merge 1 commit into
Open
kilo-code-bot[bot] wants to merge 1 commit into
kilo-code-bot[bot] wants to merge 1 commit into
Conversation
Contributor
Author
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Executive SummaryThe change is a narrow, internally consistent dependency bump: Assumptions: Files Reviewed (2 files)
Reviewed by deepseek-flash-latest · Input: 31.1K · Output: 4.5K · Cached: 367.9K Review guidance: REVIEW.md from base branch |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes by use
Shared JSON-schema URI resolution (MCP runtime and build/CLI tooling): bump the existing exact
fast-urioverride 3.1.8 → 3.1.9 and regeneratepnpm-lock.yamlwith pinned pnpm 11.1.2. One PR because all consumers share this override and lockfile. No unrelated package changes.fast-uriis not directly declared or catalogued. Its only installed parent isajv@8.20.0(fast-uri: ^3.0.1). Paths include MCP SDK → extension/harness/OpenClaw, EAS CLI, Vercel static-config and webpack/schema-utils/addons-linter tooling. Existing AJV override remains unchanged. Node 24.22.1 satisfies repository >=24 <25; fast-uri declares no engine or peers. Same-major patch, no export/API migration. 3.1.9 is the smallest version on the installed major outside every applicable advisory range; 2.4.8 would downgrade the parent out of range and 4.2.3 would require a major override.3.1.9 was published 2026-10-19T23:05:26.357Z and clears the 6842-minute release-age window. Policy, exclusions, catalog, other pins, and patches are unchanged. No lockfile entries were hand-edited.
Complete open-alert inventory
Enumerated every open alert using paginated REST (explicit
per_page=2verified four pages, seven alerts). All affect pnpm-lock.yaml. No alerts dismissed; GitHub closes addressed alerts only after scanning merged main.build/commandUtils/new/projectFiles.jsuses its default export. v7 removed that export; overriding to v8 breakseas project:new. Latest EAS 25.3.0 still pins 6.2.0 with the same import. Needs upstream migration or a separately reviewed EAS patch, not an unsafe major override. Only mobile dev tooling; no runtime app dependency.Alternate fast-uri affected lines (<2.4.8, >=4.0.0 <4.2.3; host-confusion starts at 2.4.2/4.0.1) have no installed copies. Complete lockfile review confirms only 3.1.9 remains.
Checked all open PRs with pagination, matching titles/bodies against packages and alert URLs. No existing PR addresses the new fast-uri/body-parser/ts-deepmerge alerts. #8745/#8547/#8393/#7327/#7083 cover earlier findings and mention unresolved node-forge, not these fast-uri fixes.
Validation
All commands from
/workspace/app, Node 24.22.1, pnpm 11.1.2, bounded to 210s. PostgreSQL/Redis were not started.git fetch origin maingh api --paginate 'repos/Kilo-Org/cloud/dependabot/alerts?state=open&per_page=2'gh api --paginate 'repos/Kilo-Org/cloud/pulls?state=open&per_page=100'pnpm view ajv@8.20.0 dependencies engines peerDependencies --jsonpnpm why -r fast-uriNODE_OPTIONS=--max-old-space-size=4096 pnpm install --lockfile-onlyNODE_OPTIONS=--max-old-space-size=4096 pnpm install --frozen-lockfilepnpm --filter kilo-extension verifypnpm format pnpm-workspace.yaml pnpm-lock.yamlpnpm exec oxfmt --list-different pnpm-workspace.yamlgit diff --checkExact additional smoke/audit commands (both PASS):
node -e 'const a=require("node:assert/strict"),{createRequire}=require("node:module"),r=createRequire(process.cwd()+"/node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/package.json"),u=r("fast-uri"),Ajv=r("ajv"); a.equal(r("fast-uri/package.json").version,"3.1.9"); for(const x of ["%6Aavascript:alert(1)","%u006Aavascript:alert(1)"]) a.notEqual(u.parse(x).scheme,"javascript"); a.equal(u.equal("%68ttp://a/","http://a/"),false); for(const x of ["http://a@b@evil.example/","http://ex\tample.com/","http://ex\rample.com/","http://ex\nample.com/"]) a.ok(u.parse(x).error); a.equal(u.normalize("../x"),"../x"); a.equal(u.resolve("https://example.com/a/","../x"),"https://example.com/x"); const ajv=new Ajv(); ajv.addSchema({$id:"https://example.com/schemas/value.json",type:"string",minLength:1}); const v=ajv.compile({$id:"https://example.com/schemas/root.json",type:"object",properties:{value:{$ref:"value.json"}},required:["value"],additionalProperties:false}); a.equal(v({value:"ok"}),true); a.equal(v({value:""}),false); a.equal(v({value:123}),false); console.log("PASS: patched URI security regressions and AJV relative refs/validation");' node -e 'const a=require("node:assert/strict"),fs=require("node:fs"),cp=require("node:child_process"),yaml=require("js-yaml"),s=fs.readFileSync("pnpm-lock.yaml","utf8"),lock=yaml.load(s),base=yaml.load(cp.execFileSync("git",["show","origin/main:pnpm-lock.yaml"],{encoding:"utf8",maxBuffer:20*1024*1024})); a.deepEqual(Object.keys(lock.packages).filter(x=>x.startsWith("fast-uri@")),["fast-uri@3.1.9"]); a.equal(s.includes("fast-uri: 3.1.8"),false); a.deepEqual(Object.keys(lock.packages).filter(x=>!base.packages[x]),["fast-uri@3.1.9"]); a.deepEqual(Object.keys(base.packages).filter(x=>!lock.packages[x]),["fast-uri@3.1.8"]); a.deepEqual(lock.patchedDependencies,base.patchedDependencies); for(const f of ["pnpm-workspace.yaml","pnpm-lock.yaml"]) a.equal(/^([<]{7}|={7}|[>]{7})/m.test(fs.readFileSync(f,"utf8")),false); console.log("PASS: only fast-uri changed, no vulnerable version, patches preserved, no conflict markers");'Audit passed against initial fetched main before final refresh; first attempt hit execFileSync's default output-buffer limit, corrected with maxBuffer above. Latest-main patch/lockfile difference was inspected separately and is unrelated to these hunks.
Not verified: PostgreSQL/Redis-dependent integration/E2E, live MCP/CLI services, browser/native E2E, full-repository checks or production builds. This is a narrowly scoped patch with real AJV smoke coverage and extension validation, not full-system verification. Ready for review; auto-merge requested subject to approval and required checks.