fix(deps): patch the fast-uri and mysql2 high-severity advisories - #3210
Merged
Conversation
The Security workflow's Trivy gate fails on main (run 33846607955): five fixable HIGH findings in bun.lock — fast-uri 3.1.5 (CVE-2026-75899, -75931, -75975, -76172: SSRF and host confusion in URI parsing) and mysql2 3.21.1 (GHSA-3f6p-5ww8-9rcr: auth-plugin downgrade leaking plaintext credentials). Bump the root fast-uri pin to 3.1.6 and the platform's mysql2 to 3.23.1, the versions renovate proposed in #3152 and #3124. Those two PRs each fix one advisory, so the gates keep failing on the other one for both of them; one change clears the gate. fast-uri is only reached through ajv (@tale/platform, commitlint, the MCP SDK); mysql2 is a direct platform dependency referenced from a reference file and an optional better-auth peer. `bun install --frozen-lockfile --dry-run` resolves the updated lock cleanly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The Security workflow fails on main — run 33846607955, job Trivy filesystem scan, step Trivy vulnerability gate (HIGH/CRITICAL):
The workflow has been red on main since 2026-09-03 (31a8329, 1ab399d); the push trigger only fires when
bun.lock, apackage.json, a Dockerfile or the ignore file changes, which #3208'sservices/db/Dockerfileedit did. The advisories are not new to today's merges.Renovate already opened one PR per advisory — #3152 (fast-uri → 3.1.6) and #3124 (mysql2 → 3.23.1) — but each of them still fails both security gates (Bun audit + Trivy) on the other advisory, so neither can land on its own. This PR carries both bumps in one change; renovate will close its two once main has the versions.
What changed
package.json: root pinfast-uri3.1.5 → 3.1.6 (the pin exists to force the version ajv resolves —bun why fast-uri: reached only viaajv@8.20.0from@tale/platform,@commitlint/*,@modelcontextprotocol/sdk).services/platform/package.json:mysql23.21.1 → 3.23.1 (direct dep of the platform, referenced from.tale/reference/convex/.../execute_mysql_query.tsand an optionalbetter-authpeer).bun.lock: the two resolution entries, taken verbatim from renovate's chore(deps): update dependency fast-uri to v3.1.6 [security] - autoclosed #3152 and fix(deps): update dependency mysql2 to v3.23.1 [security] - autoclosed #3124 (same integrity hashes). No other entry moves.Not in scope: renovate's #3153 (qs), #3151 (@xmldom/xmldom), #2830 (dompurify) — the gate does not flag them (not HIGH/CRITICAL fixable production findings); they stay for a separate decision.
Gates observed
git apply --checkof both renovate diffs on current main: clean;bun install --frozen-lockfile --dry-run(direct registry, proxies unset): exit 0.bun.lock/package.json), so its Bun audit and Trivy gates prove the fix before merge.