Skip to content

chore(deps): raise immutable and fast-uri resolutions - #69

Merged
Starosdev merged 1 commit into
developfrom
deps/immutable-fast-uri-advisories
Jul 26, 2026
Merged

Starosdev merged 1 commit into
developfrom
deps/immutable-fast-uri-advisories

Conversation

@Starosdev

Copy link
Copy Markdown
Owner

Part of the org-wide dependency sweep (INF-511).

Clears the four open advisories on this fork's frontend lockfile by raising the existing pinned resolutions:

  • immutable 4.3.8 to 4.3.9 (two high advisories: hash-collision DoS, List 32-bit trie overflow)
  • fast-uri 3.1.2 to 3.1.4 (two high advisories: host confusion via backslash authority delimiter and via failed IDN canonicalization)

This fork is not upstream-only: it is built and published as ghcr.io/staros-labs/radarr and deployed on Zeus, so the alerts describe an image we actually run.

Lockfile regenerated with yarn install --mode=update-lockfile; both packages resolve to the patched versions.

Bump the pinned resolutions to immutable 4.3.9 and fast-uri 3.1.4 to
clear the four open advisories on the frontend lockfile. This fork is
built and deployed as ghcr.io/staros-labs/radarr, so the alerts apply
to a running image.
@Starosdev
Starosdev merged commit 4e8c9fa into develop Jul 26, 2026
27 checks passed
@Starosdev
Starosdev deleted the deps/immutable-fast-uri-advisories branch July 26, 2026 05:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant