From d869f91b650699238716b8a856fde96b4f0ceb90 Mon Sep 17 00:00:00 2001 From: Antonis Lilis Date: Thu, 3 Sep 2026 10:40:03 +0200 Subject: [PATCH] chore(deps): Bump fast-uri to ^3.1.6 to resolve security alerts Adds a `fast-uri` resolution to dedupe the transitive copy (pulled via ajv) to a patched version (3.1.6), resolving four high-severity Dependabot alerts affecting fast-uri >= 3.0.0 < 3.1.6: host confusion via percent-encoded scheme normalization and via skipped IDN canonicalization, plus SSRF via malformed IPv6 normalization and via repeated hostname percent-decoding. fast-uri is a dev/build/test-only transitive dependency; it is not a dependency of packages/core and is not shipped in @sentry/react-native. Co-Authored-By: Claude Opus 4.8 --- package.json | 3 ++- yarn.lock | 8 ++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/package.json b/package.json index 20a036e608..001bd40813 100644 --- a/package.json +++ b/package.json @@ -142,7 +142,8 @@ "shell-quote": "^1.10.0", "downlevel-dts@npm:0.11.0/typescript": "5.9.3", "deepmerge-ts": "^8.0.0", - "browserslist": "^4.28.7" + "browserslist": "^4.28.7", + "fast-uri": "^3.1.6" }, "version": "0.0.0", "name": "sentry-react-native", diff --git a/yarn.lock b/yarn.lock index c9372eafc4..693eba2c3e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -17271,10 +17271,10 @@ __metadata: languageName: node linkType: hard -"fast-uri@npm:^3.0.1": - version: 3.1.5 - resolution: "fast-uri@npm:3.1.5" - checksum: 10c0/2bf60eb800dd610c65e17be436425dcb21c92aff3a87d442a8bccab0b7b071e88cf1a5d7d1ea946370b937e6fc0375c405c0296c10587e57de4f78be4646d1d0 +"fast-uri@npm:^3.1.6": + version: 3.1.6 + resolution: "fast-uri@npm:3.1.6" + checksum: 10c0/77fa4f966f7d2cf83c34af2d3eb88882872fe90634f27a6bd309551db65377d3ca55616467c7cb4dcc57e33523d149e2fec1952d51cc2f00bfce68a66c3711ea languageName: node linkType: hard