chore: upgrade fast-uri to 3.1.7 to address CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, CVE-2026-76172

[claude]

Fixes SOU-2123
Fixes SOU-2124
Fixes SOU-2125
Fixes SOU-2126

Summary

fast-uri resolved to 3.1.5, which is affected by four advisories. The repo already carries a qualified resolution (fast-uri@npm:^3.0.1), but its floor of ^3.1.2 still admitted the vulnerable version. This raises the floor to ^3.1.6; the lockfile now resolves fast-uri to 3.1.7.

Advisories addressed

CVE	GHSA	Summary
CVE-2026-75899	GHSA-fph4-wmhf-6fwf	SSRF via repeated hostname percent-decoding
CVE-2026-75931	GHSA-5jgf-p345-68v8	Host confusion via skipped IDN canonicalization
CVE-2026-75975	GHSA-f65p-4m7j-42xc	SSRF via malformed IPv6 normalization
CVE-2026-76172	GHSA-jqff-g426-hqxp	URI parsing flaw enabling SSRF and off-site redirects

All are fixed in 3.1.6.

Verification

• yarn why fast-uri reports a single instance: ajv@npm:8.18.0 -> fast-uri@npm:3.1.7 (via npm:^3.1.6). No affected version remains in the graph.
• yarn install --immutable succeeds.
• yarn build:deps succeeds.
• yarn test passes (2153 tests across queryLanguage, shared, backend, and web).

🤖 Generated with Claude Code

---

Note

Low Risk
Dependency-only security patch with no runtime logic changes; risk is limited to URI parsing behavior in the upgraded library.

Overview
Raises the Yarn resolution floor for fast-uri from ^3.1.2 to ^3.1.6, so the lockfile no longer pins the vulnerable 3.1.5 release and instead resolves 3.1.7. This is a transitive dependency (e.g. via ajv) with no application code changes.

Documents the upgrade under Unreleased → Fixed in CHANGELOG.md.

^{Reviewed by Cursor Bugbot for commit 2daba5e. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Updates yarn.lock to resolve fast-uri to 3.1.7 instead of the vulnerable 3.1.5, fixing four CVEs (SSRF, host confusion, and URI parsing) and closing SOU-2123 through SOU-2126. Adds a CHANGELOG entry under Unreleased → Fixed.

^{Written for commit 0fd03e9. Summary will update on new commits.}

[github-actions]

License Audit

⚠️Status: PASS

Metric	Count
Total packages	2173
Resolved (non-standard)	8
Unresolved	0
Strong copyleft	0
Weak copyleft	28

Weak Copyleft Packages (informational)

Package	Version	License
@img/sharp-libvips-darwin-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.3.2	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.3.2	LGPL-3.0-or-later
@img/sharp-wasm32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.35.3	Apache-2.0 AND LGPL-3.0-or-later
axe-core	4.10.3	MPL-2.0
dompurify	3.4.13	(MPL-2.0 OR Apache-2.0)
lightningcss	1.32.0	MPL-2.0
lightningcss-android-arm64	1.32.0	MPL-2.0
lightningcss-darwin-arm64	1.32.0	MPL-2.0
lightningcss-darwin-x64	1.32.0	MPL-2.0
lightningcss-freebsd-x64	1.32.0	MPL-2.0
lightningcss-linux-arm-gnueabihf	1.32.0	MPL-2.0
lightningcss-linux-arm64-gnu	1.32.0	MPL-2.0
lightningcss-linux-arm64-musl	1.32.0	MPL-2.0
lightningcss-linux-x64-gnu	1.32.0	MPL-2.0
lightningcss-linux-x64-musl	1.32.0	MPL-2.0
lightningcss-win32-arm64-msvc	1.32.0	MPL-2.0
lightningcss-win32-x64-msvc	1.32.0	MPL-2.0

Resolved Packages (8)

Package	Version	Original	Resolved	Source
codemirror-lang-elixir	4.0.0	UNKNOWN	Apache-2.0	npm tarball LICENSE file (Apache License 2.0 full text)
khroma	2.1.0	UNKNOWN	MIT	npm tarball license file (MIT License text)
lezer-elixir	1.1.2	UNKNOWN	Apache-2.0	npm tarball LICENSE file (Apache License 2.0 full text)
map-stream	0.1.0	UNKNOWN	MIT	npm tarball LICENCE file (MIT License text)
memorystream	0.3.1	UNKNOWN	MIT	extracted from object (npm registry "licenses": [{"type":"MIT"}])
pause-stream	0.0.11	MIT,Apache2	MIT OR Apache-2.0	npm tarball LICENSE file ("Dual Licensed MIT and Apache 2")
posthog-js	1.369.0	SEE LICENSE IN LICENSE	Apache-2.0	npm tarball LICENSE file (Apache License 2.0 full text)
valid-url	1.0.9	UNKNOWN	MIT	npm tarball LICENSE file (MIT License text)

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 0fd03e9. Configure here.}

[cursor]

Resolution floor still allows vulnerable versions

Medium Severity

The fast-uri resolution is still ^3.1.2, so affected 3.1.2–3.1.5 releases remain in range. The lockfile now pins 3.1.7, but the floor was not raised to ^3.1.6. A later lockfile rewrite can accept a vulnerable version again.

^{Reviewed by Cursor Bugbot for commit 0fd03e9. Configure here.}