From efb2834c33a67f813e090af357e3b8e3a65ac87e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 11:39:50 +0000 Subject: [PATCH 1/2] Bump fast-uri from 3.1.4 to 3.1.5 Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.1.4...v3.1.5) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index fce231fd..57077319 100644 --- a/package-lock.json +++ b/package-lock.json @@ -6523,9 +6523,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.4", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz", - "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==", + "version": "3.1.5", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz", + "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==", "funding": [ { "type": "github", From e7c61489edbe8be5ba191a9d5c6e94f1fb8a3930 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 11:40:28 +0000 Subject: [PATCH 2/2] Rebuild --- dist/query.js | 22 +++++++++++++++++++++- dist/update-repo-task-status.js | 22 +++++++++++++++++++++- dist/update-repo-task-statuses.js | 22 +++++++++++++++++++++- 3 files changed, 63 insertions(+), 3 deletions(-) diff --git a/dist/query.js b/dist/query.js index aa8992a8..f5b2da29 100644 --- a/dist/query.js +++ b/dist/query.js @@ -70798,7 +70798,12 @@ var require_fast_uri = __commonJS({ } function resolve2(baseURI, relativeURI, options) { const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" }; - const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true); + const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions); + const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions); + if (baseMalformed || relativeMalformed) { + throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed."); + } + const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true); schemelessOptions.skipEscape = true; return serialize(resolved, schemelessOptions); } @@ -70924,6 +70929,7 @@ var require_fast_uri = __commonJS({ } var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u; var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/; + var AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/; function getParseError(parsed, matches) { if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") { return 'URI path must start with "/" when authority is present.'; @@ -70958,6 +70964,20 @@ var require_fast_uri = __commonJS({ parsed.error = "URI authority must not contain a literal backslash."; malformedAuthorityOrPort = true; } + const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION); + if (introducerMatch !== null) { + const region = introducerMatch[1]; + const normalizedRegion = region.replace(/[\t\n\r]/g, ""); + if (normalizedRegion.length >= 2) { + if (normalizedRegion.slice(0, 2) !== "//") { + parsed.error = parsed.error || "URI authority must not contain a literal backslash."; + malformedAuthorityOrPort = true; + } else if (region.length !== normalizedRegion.length) { + parsed.error = parsed.error || "URI authority introducer must not contain whitespace."; + malformedAuthorityOrPort = true; + } + } + } const matches = uri.match(URI_PARSE); if (matches) { parsed.scheme = matches[1]; diff --git a/dist/update-repo-task-status.js b/dist/update-repo-task-status.js index 24b5c206..c7626fab 100644 --- a/dist/update-repo-task-status.js +++ b/dist/update-repo-task-status.js @@ -22356,7 +22356,12 @@ var require_fast_uri = __commonJS({ } function resolve(baseURI, relativeURI, options) { const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" }; - const resolved = resolveComponent(parse2(baseURI, schemelessOptions), parse2(relativeURI, schemelessOptions), schemelessOptions, true); + const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions); + const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions); + if (baseMalformed || relativeMalformed) { + throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed."); + } + const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true); schemelessOptions.skipEscape = true; return serialize(resolved, schemelessOptions); } @@ -22482,6 +22487,7 @@ var require_fast_uri = __commonJS({ } var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u; var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/; + var AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/; function getParseError(parsed, matches) { if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") { return 'URI path must start with "/" when authority is present.'; @@ -22516,6 +22522,20 @@ var require_fast_uri = __commonJS({ parsed.error = "URI authority must not contain a literal backslash."; malformedAuthorityOrPort = true; } + const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION); + if (introducerMatch !== null) { + const region = introducerMatch[1]; + const normalizedRegion = region.replace(/[\t\n\r]/g, ""); + if (normalizedRegion.length >= 2) { + if (normalizedRegion.slice(0, 2) !== "//") { + parsed.error = parsed.error || "URI authority must not contain a literal backslash."; + malformedAuthorityOrPort = true; + } else if (region.length !== normalizedRegion.length) { + parsed.error = parsed.error || "URI authority introducer must not contain whitespace."; + malformedAuthorityOrPort = true; + } + } + } const matches = uri.match(URI_PARSE); if (matches) { parsed.scheme = matches[1]; diff --git a/dist/update-repo-task-statuses.js b/dist/update-repo-task-statuses.js index 829a2177..21f4c2f3 100644 --- a/dist/update-repo-task-statuses.js +++ b/dist/update-repo-task-statuses.js @@ -22356,7 +22356,12 @@ var require_fast_uri = __commonJS({ } function resolve(baseURI, relativeURI, options) { const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" }; - const resolved = resolveComponent(parse2(baseURI, schemelessOptions), parse2(relativeURI, schemelessOptions), schemelessOptions, true); + const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions); + const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions); + if (baseMalformed || relativeMalformed) { + throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed."); + } + const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true); schemelessOptions.skipEscape = true; return serialize(resolved, schemelessOptions); } @@ -22482,6 +22487,7 @@ var require_fast_uri = __commonJS({ } var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u; var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/; + var AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/; function getParseError(parsed, matches) { if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") { return 'URI path must start with "/" when authority is present.'; @@ -22516,6 +22522,20 @@ var require_fast_uri = __commonJS({ parsed.error = "URI authority must not contain a literal backslash."; malformedAuthorityOrPort = true; } + const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION); + if (introducerMatch !== null) { + const region = introducerMatch[1]; + const normalizedRegion = region.replace(/[\t\n\r]/g, ""); + if (normalizedRegion.length >= 2) { + if (normalizedRegion.slice(0, 2) !== "//") { + parsed.error = parsed.error || "URI authority must not contain a literal backslash."; + malformedAuthorityOrPort = true; + } else if (region.length !== normalizedRegion.length) { + parsed.error = parsed.error || "URI authority introducer must not contain whitespace."; + malformedAuthorityOrPort = true; + } + } + } const matches = uri.match(URI_PARSE); if (matches) { parsed.scheme = matches[1];