chore(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 - #1881
Conversation
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.4) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 3.1.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dhensby
left a comment
dhensby
left a comment
There was a problem hiding this comment.
✅ Approved — fast-uri 3.1.2 → 3.1.4 (transitive)
Human reviewed the failing checks and authorised the merge.
Lockfile-only, patch. package-lock.json is the sole changed file; fast-uri is an indirect dependency (dependency-type: indirect), reached via ajv. No manifest change, no first-party code affected.
Supply-chain verification
| Check | Result |
|---|---|
| Publisher | matteo.collina <hello@matteocollina.com> — Fastify lead maintainer |
| Publisher continuity | 3.1.2 published by the same account ✅ |
| Repository | github.com/fastify/fast-uri ✅ |
| Lifecycle hooks | none ✅ |
| Diff scope | package-lock.json only ✅ |
The 4 failing checks are unrelated to this change
Run tests (windows-2025, 20.x, …) fails for all four SQL Server versions. The cause is a native-module build failure, not a test failure:
npm error gyp ERR! stack Error: Could not find any Visual Studio installation to use
gyp ERR! cwd D:\a\node-mssql\node-mssql\node_modules\msnodesqlv8
node -v v20.20.2
node-gyp -v v10.1.0
fast-uri is a pure-JavaScript URI parser pulled in transitively — it cannot influence whether node-gyp locates a Visual Studio toolchain.
Three independent lines of evidence that this is runner-image drift:
- Isolated to one cell of the matrix.
windows-2025passes on Node 18.x, 22.x and 24.x;windows-2022passes on Node 20.x. Onlywindows-2025+ Node 20.x fails — i.e. it tracks the image/Node pairing, not the dependency. - Temporal. PR #1875 ran the identical matrix on 14 Jul and
windows-2025, 20.xpassed; this PR ran on 25 Jul and it fails. The workflow definition did not change in between. - Mechanism. Node 20.x bundles
node-gyp10.1.0, whose Visual Studio detection does not recognise the toolchain on the updatedwindows-2025image. Newer Node lines bundle a newernode-gypand are unaffected.
The PR's merge state is UNSTABLE rather than BLOCKED, confirming these checks are not required for merge — no protection is being bypassed.
Raising the broken matrix separately so it gets fixed at the workflow level rather than re-diagnosed on every PR.
1 participant
Bumps fast-uri from 3.1.2 to 3.1.4.
Release notes
Sourced from fast-uri's releases.
Commits
6aeece6Bumped v3.1.42d50fbafix: reject literal backslash in URI authority0549fe3Bumped v3.1.32a6d357Merge commit from forkDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.