From 75a3569933e5b52d2a46df060a778ee7791922fa Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 25 Jul 2026 10:26:43 +0000 Subject: [PATCH 1/2] Bump fast-uri from 3.1.2 to 3.1.4 Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.4) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index 3e812896..5b3ec074 100644 --- a/package-lock.json +++ b/package-lock.json @@ -6521,9 +6521,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.2", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz", - "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==", + "version": "3.1.4", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", + "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", "funding": [ { "type": "github", From 2030542b81a459459b6e7b36a5019c4d8a81044e Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 25 Jul 2026 10:27:30 +0000 Subject: [PATCH 2/2] Rebuild --- dist/query.js | 8 +++++++- dist/update-repo-task-status.js | 8 +++++++- dist/update-repo-task-statuses.js | 8 +++++++- 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/dist/query.js b/dist/query.js index 7f450b85..aa8992a8 100644 --- a/dist/query.js +++ b/dist/query.js @@ -70923,6 +70923,7 @@ var require_fast_uri = __commonJS({ return uriTokens.join(""); } var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u; + var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/; function getParseError(parsed, matches) { if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") { return 'URI path must start with "/" when authority is present.'; @@ -70952,6 +70953,11 @@ var require_fast_uri = __commonJS({ uri = "//" + uri; } } + const authorityMatch = uri.match(AUTHORITY_PREFIX); + if (authorityMatch !== null && authorityMatch[1].indexOf("\\") !== -1) { + parsed.error = "URI authority must not contain a literal backslash."; + malformedAuthorityOrPort = true; + } const matches = uri.match(URI_PARSE); if (matches) { parsed.scheme = matches[1]; @@ -70995,7 +71001,7 @@ var require_fast_uri = __commonJS({ if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) { if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) { try { - parsed.host = URL.domainToASCII(parsed.host.toLowerCase()); + parsed.host = new URL("http://" + parsed.host).hostname; } catch (e) { parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e; } diff --git a/dist/update-repo-task-status.js b/dist/update-repo-task-status.js index 5d92b8c5..24b5c206 100644 --- a/dist/update-repo-task-status.js +++ b/dist/update-repo-task-status.js @@ -22481,6 +22481,7 @@ var require_fast_uri = __commonJS({ return uriTokens.join(""); } var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u; + var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/; function getParseError(parsed, matches) { if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") { return 'URI path must start with "/" when authority is present.'; @@ -22510,6 +22511,11 @@ var require_fast_uri = __commonJS({ uri = "//" + uri; } } + const authorityMatch = uri.match(AUTHORITY_PREFIX); + if (authorityMatch !== null && authorityMatch[1].indexOf("\\") !== -1) { + parsed.error = "URI authority must not contain a literal backslash."; + malformedAuthorityOrPort = true; + } const matches = uri.match(URI_PARSE); if (matches) { parsed.scheme = matches[1]; @@ -22553,7 +22559,7 @@ var require_fast_uri = __commonJS({ if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) { if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) { try { - parsed.host = URL.domainToASCII(parsed.host.toLowerCase()); + parsed.host = new URL("http://" + parsed.host).hostname; } catch (e) { parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e; } diff --git a/dist/update-repo-task-statuses.js b/dist/update-repo-task-statuses.js index b89b2067..829a2177 100644 --- a/dist/update-repo-task-statuses.js +++ b/dist/update-repo-task-statuses.js @@ -22481,6 +22481,7 @@ var require_fast_uri = __commonJS({ return uriTokens.join(""); } var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u; + var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/; function getParseError(parsed, matches) { if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") { return 'URI path must start with "/" when authority is present.'; @@ -22510,6 +22511,11 @@ var require_fast_uri = __commonJS({ uri = "//" + uri; } } + const authorityMatch = uri.match(AUTHORITY_PREFIX); + if (authorityMatch !== null && authorityMatch[1].indexOf("\\") !== -1) { + parsed.error = "URI authority must not contain a literal backslash."; + malformedAuthorityOrPort = true; + } const matches = uri.match(URI_PARSE); if (matches) { parsed.scheme = matches[1]; @@ -22553,7 +22559,7 @@ var require_fast_uri = __commonJS({ if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) { if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) { try { - parsed.host = URL.domainToASCII(parsed.host.toLowerCase()); + parsed.host = new URL("http://" + parsed.host).hostname; } catch (e) { parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e; }