Bump fast-uri to 3.1.3 to resolve GHSA-4c8g-83qw-93j6

[Copilot]

Resolves Dependabot alert GHSA-4c8g-83qw-93j6 / CVE-2026-13676 (high): fast-uri 3.1.2 fails to canonicalize Unicode/IDN hostnames, causing host-confusion policy desync. Patched in 3.1.3.

fast-uri is a transitive, dev-only dependency of ol-mapbox-style-6.3.0 (via ajv → webpack/eslint tooling), so it was bumped through an overrides pin rather than a lock-file edit.

Changes

• package.json: added overrides to pin fast-uri to the lowest patched version, 3.1.3.

  "overrides": {
    "fast-uri": "3.1.3"
  }

• package-lock.json: regenerated via npm install --package-lock-only; fast-uri now resolves to 3.1.3 (was 3.1.2, in the vulnerable >= 2.3.1, <= 4.0.0 range).

Reachability Assessment

• Confidence: High. No application source imports or calls fast-uri's parse()/normalize()/equal() APIs; it is only present as a dev transitive dependency for build/lint tooling and is not in any runtime bundle. The vulnerable IDN host-confusion path is not reachable at runtime — this update primarily satisfies the vulnerability scanner rather than addressing an active risk.

Original prompt

---

This section details the Dependabot vulnerability alert you should resolve

<alert_title>fast-uri vulnerable to host confusion via failed IDN canonicalization</alert_title>
<alert_description>### Impact

fast-uri versions >= 2.3.1, <= 4.0.0 fail to canonicalize Unicode/IDN hostnames for HTTP-family URLs. The IDN conversion path calls URL.domainToASCII(...) on the global WHATWG URL constructor, where that helper does not exist. The resulting TypeError is silently routed into parsed.error, but parse(), normalize(), and equal() all return with the host left in its original Unicode form.

For example, http://127。0。0。1/ is treated by fast-uri as host 127。0。0。1, while Node's WHATWG URL parser and fetch() canonicalize the same input to 127.0.0.1.

Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL into Node's URL or fetch() consumers see a policy/use desync and can be steered to an unintended destination.

Patches

Upgrade to fast-uri v4.0.1, v3.1.3, or v2.4.2

Workarounds

None. Upgrade to the patched version.</alert_description>

high
GHSA-4c8g-83qw-93j6, CVE-2026-13676
fast-uri
npm
<vulnerable_versions>3.1.2</vulnerable_versions>
<patched_version>3.1.3</patched_version>
<manifest_path>twm/application/lib/ol-mapbox-style-6.3.0/package-lock.json</manifest_path>

https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6 https://nvd.nist.gov/vuln/detail/CVE-2026-13676 https://github.com/fastify/fast-uri/pull/188 https://github.com/fastify/fast-uri/commit/2a6d357a18a68e6d812824379fd3388a1ae50d05 https://github.com/fastify/fast-uri/commit/21ea1f9d70495c931f55dff893a8fa38f4f2e6bd https://github.com/fastify/fast-uri/commit/01db48010f594b98f7b323be18b393791c66ed1d https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13676.json https://github.com/fastify/fast-uri/releases/tag/v4.0.1 https://github.com/fastify/fast-uri/releases/tag/v3.1.3 https://github.com/fastify/fast-uri/releases/tag/v2.4.2 https://cna.openjsf.org/security-advisories.html https://bugzilla.redhat.com/show_bug.cgi?id=2494197 https://access.redhat.com/security/cve/CVE-2026-13676 https://access.redhat.com/errata/RHSA-2026:41929 https://access.redhat.com/errata/RHSA-2026:41928 https://access.redhat.com/errata/RHSA-2026:41066 https://access.redhat.com/errata/RHSA-2026:40945 https://access.redhat.com/errata/RHSA-2026:40262 https://access.redhat.com/errata/RHSA-2026:40118 https://access.redhat.com/errata/RHSA-2026:37628 https://access.redhat.com/errata/RHSA-2026:37585 https://access.redhat.com/errata/RHSA-2026:37186 https://access.redhat.com/errata/RHSA-2026:43038 https://access.redhat.com/errata/RHSA-2026:42815 https://access.redhat.com/errata/RHSA-2026:40765 https://access.redhat.com/errata/RHSA-2026:44239 https://access.redhat.com/errata/RHSA-2026:44268 https://access.redhat.com/errata/RHSA-2026:48126 https://access.redhat.com/errata/RHSA-2026:48124 https://access.redhat.com/errata/RHSA-2026:49642 https://access.redhat.com/errata/RHSA-2026:50479 https://access.redhat.com/errata/RHSA-2026:50340 https://github.com/advisories/GHSA-4c8g-83qw-93j6

<task_instructions>Resolve this alert by updating the affected package to a non-vulnerable version. Prefer the lowest non-vulnerable version (see the patched_version field above) over the latest to minimize breaking changes. Include a Reachability Assessment section in the PR description. Review the alert_description field to understand which APIs, features, or configurations are affected, then search the codebase for usage of those specific items. If the vulnerable code path is reachable, explain how (which files, APIs, or call sites use the affected functionality) and note that the codebase is actively exposed to this vulnerability. If the vulnerable code path is not reachable, explain why (e.g. the affected API is never called, the vulnerable configuration is not used) and note that the update is primarily to satisfy vulnerability scanners rather than to address an active risk. If the advisory is too vague to determine reachability (e.g. 'improper input validation' with no specific API named), state that reachability could not be determined and explain why. Include a confidence level in the reachability assessment (e.g. high confidence if the advisory names a specific API and you confirmed it is or is not called, low confidence if the usage is indir...

• Resolves bcgov/crt alert #609

---

Thanks for the PR!

After merge, new images are deployed and promoted to DEV:

• DEV Homepage

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud