From 9980dea436a45833b8b5254fb70e863c0824f931 Mon Sep 17 00:00:00 2001
From: larryro <371767072@qq.com>
Date: Fri, 4 Sep 2026 15:06:34 +0800
Subject: [PATCH] fix(deps): patch the fast-uri and mysql2 high-severity
 advisories
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Security workflow's Trivy gate fails on main (run 33846607955): five
fixable HIGH findings in bun.lock — fast-uri 3.1.5 (CVE-2026-75899,
-75931, -75975, -76172: SSRF and host confusion in URI parsing) and
mysql2 3.21.1 (GHSA-3f6p-5ww8-9rcr: auth-plugin downgrade leaking
plaintext credentials). Bump the root fast-uri pin to 3.1.6 and the
platform's mysql2 to 3.23.1, the versions renovate proposed in #3152 and
#3124. Those two PRs each fix one advisory, so the gates keep failing on
the other one for both of them; one change clears the gate.

fast-uri is only reached through ajv (@tale/platform, commitlint, the MCP
SDK); mysql2 is a direct platform dependency referenced from a reference
file and an optional better-auth peer. `bun install --frozen-lockfile
--dry-run` resolves the updated lock cleanly.
---
 bun.lock                       | 8 ++++----
 package.json                   | 2 +-
 services/platform/package.json | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/bun.lock b/bun.lock
index fa131fe5fb..55a9f6cc8e 100644
--- a/bun.lock
+++ b/bun.lock
@@ -260,7 +260,7 @@
         "micromark-extension-gfm": "3.0.0",
         "mssql": "12.2.1",
         "mustache": "4.2.0",
-        "mysql2": "3.21.1",
+        "mysql2": "3.23.1",
         "nodemailer": "9.0.3",
         "openai": "6.42.0",
         "parse5": "8.0.0",
@@ -454,7 +454,7 @@
     "brace-expansion": "5.0.9",
     "defu": "6.1.6",
     "esbuild": "0.28.1",
-    "fast-uri": "3.1.5",
+    "fast-uri": "3.1.6",
     "follow-redirects": "1.16.0",
     "form-data": "4.0.6",
     "hono": "4.12.34",
@@ -2893,7 +2893,7 @@
 
     "fast-string-width": ["fast-string-width@3.0.2", "", { "dependencies": { "fast-string-truncated-width": "^3.0.2" } }, "sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg=="],
 
-    "fast-uri": ["fast-uri@3.1.5", "", {}, "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw=="],
+    "fast-uri": ["fast-uri@3.1.6", "", {}, "sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q=="],
 
     "fast-wrap-ansi": ["fast-wrap-ansi@0.2.2", "", { "dependencies": { "fast-string-width": "^3.0.2" } }, "sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q=="],
 
@@ -3625,7 +3625,7 @@
 
     "mute-stream": ["mute-stream@0.0.8", "", {}, "sha512-nnbWWOkoWyUsTjKrhgD0dcz22mdkSnpYqbEjIm2nhwhuxlSkpywJmBo8h0ZqJdkp73mb90SssHkN4rsRaBAfAA=="],
 
-    "mysql2": ["mysql2@3.21.1", "", { "dependencies": { "aws-ssl-profiles": "^1.1.2", "denque": "^2.1.0", "generate-function": "^2.3.1", "iconv-lite": "^0.7.2", "long": "^5.3.2", "lru.min": "^1.1.4", "named-placeholders": "^1.1.6", "sql-escaper": "^1.3.3" }, "peerDependencies": { "@types/node": ">= 8" } }, "sha512-vywGTUeqMwPQHJCWTWmmdIpcLfhU0UWIhOYbSWehqL+0Y/NTPGViM0wDtIgLuzqm5RqSygXKLJnxFGhQkhM1wg=="],
+    "mysql2": ["mysql2@3.23.1", "", { "dependencies": { "aws-ssl-profiles": "^1.1.2", "denque": "^2.1.0", "generate-function": "^2.3.1", "iconv-lite": "^0.7.2", "long": "^5.3.2", "lru.min": "^1.1.4", "named-placeholders": "^1.1.6", "sql-escaper": "^1.5.1" }, "peerDependencies": { "@types/node": ">= 8" } }, "sha512-tTuRnC7qCet2IOfSNMYZ5SwXuBnfvBPAcIA28P0gtruXyZlU1LMxA6uha32kYypoFgyYklMqhLWwt4laYwXR/Q=="],
 
     "mz": ["mz@2.7.0", "", { "dependencies": { "any-promise": "^1.0.0", "object-assign": "^4.0.1", "thenify-all": "^1.0.0" } }, "sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q=="],
 
diff --git a/package.json b/package.json
index 24e33654d4..d2b4802ed2 100644
--- a/package.json
+++ b/package.json
@@ -130,7 +130,7 @@
     "brace-expansion": "5.0.9",
     "defu": "6.1.6",
     "esbuild": "0.28.1",
-    "fast-uri": "3.1.5",
+    "fast-uri": "3.1.6",
     "follow-redirects": "1.16.0",
     "form-data": "4.0.6",
     "hono": "4.12.34",
diff --git a/services/platform/package.json b/services/platform/package.json
index 17c5a568de..b8039de4d1 100644
--- a/services/platform/package.json
+++ b/services/platform/package.json
@@ -112,7 +112,7 @@
     "micromark-extension-gfm": "3.0.0",
     "mssql": "12.2.1",
     "mustache": "4.2.0",
-    "mysql2": "3.21.1",
+    "mysql2": "3.23.1",
     "nodemailer": "9.0.3",
     "openai": "6.42.0",
     "parse5": "8.0.0",