forzagreen / n2words / 33684051103

99%

push

github

chore(deps): bump fast-uri to 3.1.7 to clear a high-severity audit (#435)

`npm audit --audit-level=high` fails CI's Lint & Security job on main:
fast-uri 3.1.5 carries four high-severity advisories (host confusion via
skipped IDN canonicalization and via percent-encoded scheme normalization;
SSRF via malformed IPv6 normalization and via repeated hostname
percent-decoding).

Dev-only and transitive — @commitlint/cli -> @commitlint/load ->
@commitlint/config-validator -> ajv -> fast-uri — so nothing ships to
consumers. ajv's constraint is ^3.0.1, which 3.1.7 satisfies, so this is a
lockfile-only bump with no package.json change.

Edited the single fast-uri entry by hand rather than running `npm audit
fix`: the lockfile was generated by the npm that ships with Node 26 (what
CI uses), and running audit fix under an older npm strips the `libc` fields
from rollup's optional platform packages, which would churn 45 unrelated
lines and change how Linux glibc/musl builds resolve. Integrity hash
verified against the registry.

6352 of 6647 branches covered (95.56%)

Branch coverage included in aggregate %.

31568 of 31896 relevant lines covered (98.97%)

1218.21 hits per line