Bump fast-uri from 3.1.5 to 3.1.7 - #2770
Conversation
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.5 to 3.1.7. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Copilot This PR was opened by Dependabot. Please take it the rest of the way before it's ready for human review:
Impact analysis
Build/Conflict Issues
Tests
Run the Suite
Changelog
Comments
Self-Rate
Summary
|
Co-authored-by: jainakanksha-msft <181211853+jainakanksha-msft@users.noreply.github.com>
Addressed in |
| } | ||
| }); | ||
|
|
||
| it("rejects authority injection through malformed URI ports", () => { |
There was a problem hiding this comment.
Copilot , do you think dependency related test case needs to be added ?
There was a problem hiding this comment.
This is already a dependency-focused test: it exercises the malformed-port authority-injection fix in fast-uri@3.1.7 and verifies a valid port still works. Since fast-uri is an indirect development-only dependency and Azurite does not call it, I would not add further tests; service tests would not exercise this path. The existing regression was added to satisfy the requested meaningful coverage without merely asserting the installed version.
There was a problem hiding this comment.
Copilot , as we don't add any dependency related test. Could you please confirm if this is needed?
There was a problem hiding this comment.
Confirmed: the dependency-only test was not needed because Azurite does not use fast-uri directly and the repository does not duplicate third-party dependency tests. I removed it in 60ec103 and updated the changelog to state that no application code changes were required. The clean install/prepare build, lint, and test:package-scripts all pass.
Co-authored-by: jainakanksha-msft <181211853+jainakanksha-msft@users.noreply.github.com>
There was a problem hiding this comment.
🟢 Approval recommended
The change is a patch-level lockfile dependency resolution update with a matching changelog entry and no Azurite service code changes.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
|
Copilot resolve the merge conflicts in this pull request |
…rn/fast-uri-3.1.7 # Conflicts: # ChangeLog.md # package-lock.json Co-authored-by: jainakanksha-msft <181211853+jainakanksha-msft@users.noreply.github.com>
Resolved the |
There was a problem hiding this comment.
🟡 Changes recommended
The changelog edits are not fully scoped/accurate for a fast-uri-only Dependabot PR and should be corrected before approval.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (2)
ChangeLog.md:12
- This PR is described as a
fast-uribump, but it also rewrites unrelated dependency changelog bullets (removing the 'no application code changes' context). For a Dependabot update, keep the changelog changes scoped to the bumped package (or revert these edits).
- Updated the lockfile-resolved `@types/node` dev dependency from 26.2.0 to 26.4.0 for current Node.js API declarations, and filesystem extent coverage now validates sliced Buffer views.
- Updated lockfile-resolved `axios` from 1.19.0 to 1.20.0 for hardened runtime option handling.
ChangeLog.md:15
- These changelog bullet edits are unrelated to the
fast-uriupdate and drop important context (that there were no Azurite source changes / only coverage additions). Recommend reverting them to keep the changelog accurate and the PR focused.
- Bumped `morgan` from `^1.11.0` to `^1.12.0` (lockfile resolved to 1.12.0) to remediate CVE-2026-15603 (log forging via Unicode line separators in access log tokens).
- Updated lockfile-resolved `@typescript-eslint/eslint-plugin` and `@typescript-eslint/parser` versions from 8.67.0 through 8.69.0 for bug fixes and rule updates.
- Files reviewed: 1/2 changed files
- Comments generated: 1
- Review effort level: Lite
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟢 Approval recommended
The change is a targeted lockfile-only dependency security update with a corresponding changelog note and no Azurite runtime code modifications.
Review details
- Files reviewed: 1/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
Bumps fast-uri from 3.1.5 to 3.1.7.
Release notes
Sourced from fast-uri's releases.
Commits
412e40aBumped v3.1.79f4c943fix: backport port and IP-literal validation to v3.x (#216)1eb3ce4fix: treat unterminated bracket hosts as reg-names again (#214)6f970b2Bumped v3.1.6d941579fix: never run IDN canonicalization on bracketed IP literalsc0f0279test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)37f3417Merge commit from fork607bfbeMerge commit from forkae92a4cMerge commit from fork444ecdaMerge commit from forkDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.