fix: update fast-uri to 3.1.5 to resolve CVE-2026-18446

[independabot-soc2]

Hi, this is independabot — not Lili! You can ask her if you have questions, but she had no hand in generating this PR other than setting up the independabot schedule.

Please merge this PR yourself, if you approve.

BEFORE YOU MERGE

Instructions for resolving the vuln — test to make sure that nothing is broken, check compatibility, etc.

Bumped the pinned fast-uri entry in package-lock.json from 3.1.4 to 3.1.5. fast-uri is a dev-only transitive dependency (yaml-language-server → ajv@8.20.0 → fast-uri@^3.0.1), so the new version is inside the existing semver range and no package.json change was needed.

• Dependency: fast-uri updated to 3.1.5 (dev, transitive)
• Advisory: GHSA-7p8r-x3mc-p8w7 / CVE-2026-18446 — host confusion via backslash authority introducer (high, CVSS 7.5)
• Dependabot alert: https://github.com/warpdotdev/docs/security/dependabot/47
• Verification: npm ci installs fast-uri@3.1.5; npm audit no longer reports fast-uri; npm run build succeeds (364 pages built).

Highlight the risky code / where the dependency was used

Nothing in src/ imports fast-uri directly. It is only reachable through ajv inside yaml-language-server, which is a dev/tooling dependency used for YAML schema validation — it does not ship in the built docs site under dist/. Blast radius is limited to local tooling and the build toolchain.

Special instructions for this PR — e.g. if it's a Stainless thing

Only package-lock.json changed, and only the three fast-uri lines (version, resolved, integrity), to avoid unrelated lockfile churn that npm update introduced (peer/optional flag reshuffling). Note the pre-existing patch-package warning for starlight-llms-txt (patch authored for 0.8.1, applied to 0.11.0) — unrelated to this change and present on main.

AFTER YOU MERGE

No post-merge steps.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 7, 2026 1:51pm

[oz-for-oss]

@independabot-soc2[bot]

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

Overview

This PR updates the pinned fast-uri transitive dev dependency in package-lock.json from 3.1.4 to 3.1.5 to address CVE-2026-18446, without broadening dependency ranges or changing application code.

Concerns

• No blocking concerns found in the attached diff.

Verdict

Found: 0 critical, 0 important, 0 suggestions

Approve

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz