StoneCypher / jssm / 8b8ad55327e9b53df92524e431335563c7fca75f

100%

master: 100%

Pull #972

github

build(deps): bump fast-uri to 3.1.4 and release 5.163.5

fast-uri <= 3.1.3 is GHSA-v2hh-gcrm-f6hx (high): host confusion via a literal backslash authority delimiter. It reaches jssm through ajv, which is a runtime dependency, not a dev one -- so it installs for every consumer. GitHub's alert labels the scope 'development', which is wrong here.

Dependabot bumped only the lockfile, so verify-version-bump failed with 'Version unchanged: locally 5.163.4, publicly also 5.163.4' and the PR could never merge. This adds the 5.163.5 bump and the full release build that a publish requires.

Also bumps better_git_changelog to 1.6.21. The changelog step died with ENOBUFS here too: the tool reads 'git log --reflog', and a repo's reflog is SHARED ACROSS WORKTREES, so this 5.x tree reached the v6 branch's history and blew past node's 1 MiB default. main's apparent 126 KB of headroom was never as safe as it looked -- any sibling worktree can push a branch over on its own.

2652 of 2652 branches covered (100.0%)

Branch coverage included in aggregate %.

2 of 2 new or added lines in 1 file covered. (100.0%)

4288 of 4288 relevant lines covered (100.0%)

49075.57 hits per line