chore(deps): bump the npm_and_yarn group across 2 directories with 1 update - #1401
Merged
pathosDev merged 1 commit intoSep 3, 2026
Conversation
…update Bumps the npm_and_yarn group with 1 update in the /examples/chat/frontend-angular directory: [fast-uri](https://github.com/fastify/fast-uri). Bumps the npm_and_yarn group with 1 update in the /examples/voice/frontend-angular directory: [fast-uri](https://github.com/fastify/fast-uri). Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.7) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
pathosDev
deleted the
dependabot/npm_and_yarn/examples/chat/frontend-angular/npm_and_yarn-141dac4d79
branch
September 3, 2026 09:26
pathosDev
added a commit
that referenced
this pull request
Sep 4, 2026
#1401 bumped fast-uri 3.1.5 -> 3.1.7 in the two Angular example frontends, but Dependabot's npm updater only ever rewrites package-lock.json. Both directories also carry a bun.lock, which kept the vulnerable resolution -- 3.1.0 in chat, 3.1.2 in voice -- so that merge left each directory half-patched against two waves of high-severity advisories: authority injection via an unvalidated port, host confusion via unbalanced IP-literal brackets, and SSRF via malformed IPv6 normalization and repeated hostname percent-decoding. Nothing caught it because nothing installs these files. The frontend job in examples.yml builds the eight bundled frontends from package-lock.json via `npm ci` -- deliberately `ci`, so a desync is an error rather than a quiet rewrite -- and no gate anywhere reads an example bun.lock. It is the same class of defect that workflow's own header already records (ts-pattern declared in six package.json files and missing from all six package-lock.json files, unnoticed because nothing installed them), one lockfile over. Re-resolving with `bun update fast-uri --lockfile-only` also corrected a second, pre-existing desync in both files: package.json declares overrides pinning @hono/node-server to ^2.1.0 and @modelcontextprotocol/sdk to ^1.30.0, while bun.lock still resolved 1.19.14 and 1.29.0 -- a lockfile contradicting the manifest beside it. package-lock.json had already resolved both correctly (2.1.0 / 1.30.0), which is further evidence that the bun half is the unmaintained one. The recorded overrides block and configVersion field are bun 1.4 lockfile format, written by that same re-resolution. Verified with `bun install --frozen-lockfile --dry-run` in both directories. No CHANGELOG entry: dependency patches inside examples/ have never carried one. This is the immediate sync only. Whether the drift is prevented structurally -- a frozen-lockfile leg in the frontend matrix, or dropping the example bun.lock files altogether, since npm is what CI and the documented build path actually use -- is still open on #1402. Refs #1402, #1401. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
pathosDev
added a commit
that referenced
this pull request
Sep 4, 2026
The eight bundled frontends each carry two lockfiles. The frontend job installed only package-lock.json, via `npm ci`, so a bun.lock could contradict the manifest beside it indefinitely and no check anywhere would say so. #1401 is what that cost: Dependabot's npm updater patched fast-uri in both Angular package-lock.json files and left bun.lock on the vulnerable resolution. Adds a `bun install --frozen-lockfile --dry-run` leg per matrix directory, placed before the Node setup so a desynced lockfile is reported without first paying for an install and a build. `--dry-run` because the question is whether the lockfile resolves, not whether node_modules can be written; the npm leg below still does the real install. What it catches, measured rather than assumed: a bun.lock contradicting its own package.json. The pre-fix tree is the worked example -- both Angular manifests declare overrides pinning @hono/node-server to ^2.1.0 while bun.lock still resolved 1.19.14 -- which exits 1 with `overrides in package.json changed`. What it does NOT catch, measured the same way and written into the step's comment so nobody later assumes wider coverage: a transitive dependency that is merely stale. Reverting fast-uri alone to 3.1.0 on an otherwise current lockfile exits 0, because fast-uri appears in no package.json and 3.1.0 still satisfies the ^3.0.1 that ajv asks for. So this leg would not, on its own, have caught #1401; on that tree it would have gone red only through the unrelated override violation. Closing that class needs a cross-lockfile version-map comparison between package-lock.json and bun.lock, which this step is not. #1402 stays open for it. Verified against all eight matrix directories before landing -- all green, so the new leg does not turn CI red on arrival. tests/unit/ci: 379 pass, 1 skip, 0 fail. Refs #1402, #1401. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
pathosDev
added a commit
that referenced
this pull request
Sep 4, 2026
Syncs the two Angular example bun.lock files onto fast-uri 3.1.7, which #1401 patched in package-lock.json only, and gates the example bun.lock files in CI so the bun half cannot drift unnoticed again. The gate's scope was measured, not assumed: it catches a bun.lock that contradicts its own package.json, and NOT a transitive dependency that is merely stale -- so it would not, by itself, have caught #1401. #1402 stays open for the cross-lockfile comparison that would. Verified on the merged tree: typecheck + typecheck:dev clean, bun test 8494 pass / 0 fail, and the new leg green on all eight matrix directories. Refs #1402, #1401. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 1 update in the /examples/chat/frontend-angular directory: fast-uri.
Bumps the npm_and_yarn group with 1 update in the /examples/voice/frontend-angular directory: fast-uri.
Updates
fast-urifrom 3.1.5 to 3.1.7Release notes
Sourced from fast-uri's releases.
Commits
412e40aBumped v3.1.79f4c943fix: backport port and IP-literal validation to v3.x (#216)1eb3ce4fix: treat unterminated bracket hosts as reg-names again (#214)6f970b2Bumped v3.1.6d941579fix: never run IDN canonicalization on bracketed IP literalsc0f0279test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)37f3417Merge commit from fork607bfbeMerge commit from forkae92a4cMerge commit from fork444ecdaMerge commit from forkUpdates
fast-urifrom 3.1.5 to 3.1.7Release notes
Sourced from fast-uri's releases.
Commits
412e40aBumped v3.1.79f4c943fix: backport port and IP-literal validation to v3.x (#216)1eb3ce4fix: treat unterminated bracket hosts as reg-names again (#214)6f970b2Bumped v3.1.6d941579fix: never run IDN canonicalization on bracketed IP literalsc0f0279test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)37f3417Merge commit from fork607bfbeMerge commit from forkae92a4cMerge commit from fork444ecdaMerge commit from forkDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.