From 6a5d32756a84187f5023f96ef6a27d8c78a6ea6e Mon Sep 17 00:00:00 2001 From: "claude[bot]" Date: Wed, 5 Aug 2026 02:17:17 +0000 Subject: [PATCH 1/2] chore: upgrade fast-uri to ^3.1.5 to address CVE-2026-18446 Co-Authored-By: Claude Opus 5 (1M context) --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 7ba1fbf52..be24f168e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -14759,9 +14759,9 @@ __metadata: linkType: hard "fast-uri@npm:^3.1.2": - version: 3.1.4 - resolution: "fast-uri@npm:3.1.4" - checksum: 10c0/f90948821ceb49980f64f89b8216ba498f5957f26035be813526a55b6145d26cbd63ef5618d5205a3292b31edc9c08589749350cd72bd86c7095eb434dceb757 + version: 3.1.5 + resolution: "fast-uri@npm:3.1.5" + checksum: 10c0/2bf60eb800dd610c65e17be436425dcb21c92aff3a87d442a8bccab0b7b071e88cf1a5d7d1ea946370b937e6fc0375c405c0296c10587e57de4f78be4646d1d0 languageName: node linkType: hard From ecbafda338ecbb0cc533a5937e9eacf68ec9b9a1 Mon Sep 17 00:00:00 2001 From: "claude[bot]" Date: Wed, 5 Aug 2026 02:17:37 +0000 Subject: [PATCH 2/2] chore: add CHANGELOG entry for fast-uri upgrade Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ab1195e04..c0a7b7900 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Fixed a crash when searching with `context:` referencing a search context that does not exist; it now returns a graceful error. [#1362](https://github.com/sourcebot-dev/sourcebot/pull/1362) - Fixed search queries failing to parse when negating a bare term that contains a colon (e.g. `-foo:bar`, `-http://example.com`). [#1301](https://github.com/sourcebot-dev/sourcebot/pull/1301) - Fixed the Review Agent failing to fetch pull request diffs for private GitHub repositories. [#1352](https://github.com/sourcebot-dev/sourcebot/pull/1352) +- Upgraded `fast-uri` to `^3.1.5`. [#1541](https://github.com/sourcebot-dev/sourcebot/pull/1541) ## [5.1.5] - 2026-07-31