8000 fix: resolve high-severity npm vulnerability (fast-uri) by dominicusin · Pull Request #414 · dominicusin/dominicusin.github.io · GitHub
[go: up one dir, main page]
Skip to content

fix: resolve high-severity npm vulnerability (fast-uri) - #414

Merged
dominicusin merged 1 commit into
mainfrom
fix/npm-audit-security
Sep 5, 2026
Merged

fix: resolve high-severity npm vulnerability (fast-uri)#414
dominicusin merged 1 commit into
mainfrom
fix/npm-audit-security

Conversation

@dominicusin
@dominicusin dominicusin commented Sep 5, 2026
Copy link
Copy Markdown
Owner

npm audit fix cleared fast-uri (host confusion + SSRF). Remaining 12 low-severity in hardhat-network-helpers (dev dep).

@dominicusin
fix: resolve high-severity npm vulnerability (fast-uri)
2039e49 
npm audit fix cleared the high severity fast-uri vulnerability
(host confusion + SSRF). Remaining 12 low-severity issues are
in @nomicfoundation/hardhat-network-helpers (dev dependency, not
related to blog runtime).
@vercel
vercel Bot commented Sep 5, 2026 •
edited
Loading
Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
dominicusin-github-io Error Error Sep 5, 2026 12:20pm UTC
3 Skipped Deployments
Project Deployment Actions Updated
dominicusin-dominicusin.github.io Ignored Ignored Preview Sep 5, 2026 12:20pm UTC
dominicusin-dominicusin.github.io-lw64 Ignored Ignored Preview Sep 5, 2026 12:20pm UTC
dominicusin-github-io-5612 Ignored Ignored Preview Sep 5, 2026 12:20pm UTC

@bolt-new-by-stackblitz
bolt-new-by-stackblitz Bot commented Sep 5, 2026
Copy link
Copy Markdown

Review PR in StackBlitz Codeflow Run & review this pull request in StackBlitz Codeflow.

@qodo-code-review
qodo-code-review Bot commented Sep 5, 2026
Copy link
Copy Markdown

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

Copilot AI commented Sep 5, 2026
Copy link
Copy Markdown

@dominicusin Thanks for sending me some feedback. Unfortunately, I hit an error while trying to use the custom Copilot setup steps configured for this repository. The error I am seeing is:

no supported setup-steps job found in your workflow file. Please ensure you have a job named copilot-setup-steps. For more details, see https://gh.io/copilot/actions-setup-steps

Once you or someone with the necessary access fixes the problem, please let me know in a comment and I'll try again. Thanks!

@github-actions github-actions Bot added the dependencies Pull requests that update a dependency file label Sep 5, 2026
@coderabbitai
coderabbitai Bot commented Sep 5, 2026
Copy link
Copy Markdown

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 769875e1-8e9d-4c2e-b8d8-8a2d7bcdd3f6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions
github-actions Bot commented Sep 5, 2026
Copy link
Copy Markdown
Contributor

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/fast-uri 3.1.7 🟢 8.2
Details
CheckScoreReason
Code-Review🟢 5Found 16/28 approved changesets -- score normalized to 5
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
License🟢 9license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests🟢 1019 out of 19 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 17 contributing companies or organizations
npm/fast-uri 4.1.4 🟢 8.2
Details
CheckScoreReason
Code-Review🟢 5Found 16/28 approved changesets -- score normalized to 5
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 8SAST tool is not run on all commits -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
License🟢 9license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
CI-Tests🟢 1019 out of 19 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 17 contributing companies or organizations

Scanned Files

  • package-lock.json

@dominicusin
dominicusin merged commit b87bdf2 into main Sep 5, 2026
23 of 26 checks passed
@dominicusin
dominicusin deleted the fix/npm-audit-security branch September 5, 2026 12:22

This branch had an error being deployed

1 failed deployment
Preview – dominicusin-github-io — 2039e49b Deployed Sep 5, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file size/XS

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dominicusin
0