Skip to content

chore: resolve open dependabot security alerts#90

Open
jonathannorris wants to merge 1 commit into
mainfrom
chore/dependabot-alerts
Open

chore: resolve open dependabot security alerts#90
jonathannorris wants to merge 1 commit into
mainfrom
chore/dependabot-alerts

Conversation

@jonathannorris
Copy link
Copy Markdown
Member

Summary

  • Bumped fast-uri to 3.1.2 via yarn resolution to resolve two high-severity vulnerabilities

Dependabot Alerts Resolved

Alert Package Severity Fix
#45 fast-uri high Added fast-uri: >=3.1.2 to yarn resolutions
#44 fast-uri high Added fast-uri: >=3.1.2 to yarn resolutions

fast-uri is a transitive dependency pulled in via ajv. Both alerts are resolved by the single resolution entry.

- fast-uri 3.1.0 -> 3.1.2 via yarn resolution (high, alerts #44 #45)
Copilot AI review requested due to automatic review settings May 13, 2026 13:40
@jonathannorris jonathannorris requested a review from a team as a code owner May 13, 2026 13:40
@jonathannorris jonathannorris enabled auto-merge (squash) May 13, 2026 13:40
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Resolves Dependabot security alerts by forcing the vulnerable transitive dependency fast-uri (pulled via ajv) to a patched version across the Yarn dependency graph.

Changes:

  • Added a Yarn resolutions override for fast-uri to ensure patched versions are selected.
  • Updated yarn.lock to lock fast-uri to 3.1.2.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File Description
package.json Adds a Yarn resolution to enforce a minimum fast-uri version.
yarn.lock Updates the locked fast-uri entry to 3.1.2.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread package.json
"flatted": "^3.4.2",
"minimatch": "^9.0.7"
"minimatch": "^9.0.7",
"fast-uri": ">=3.1.2"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants