chore(deps): bump fast-uri from 3.1.5 to 3.1.7 in /mcp-server

[dependabot]

Bumps fast-uri from 3.1.5 to 3.1.7.

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

• GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()
• GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

• GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding
• GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization
• GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

Commits

• 412e40a Bumped v3.1.7
• 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
• 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
• 6f970b2 Bumped v3.1.6
• d941579 fix: never run IDN canonicalization on bracketed IP literals
• c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
• 37f3417 Merge commit from fork
• 607bfbe Merge commit from fork
• ae92a4c Merge commit from fork
• 444ecda Merge commit from fork
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[maxigimenez]

Security triage: Tier B — needs a decision (runtime exposure, and a release to reach consumers)

This PR closes 4 HIGH fast-uri advisories in mcp-server, two of which have a Vanta record and two of which do not. It is not merged or approved by this run.

What and why

fast-uri 3.1.5 -> 3.1.7 (transitive, via ajv@8.18.0).

Alert	GHSA	CVE	CVSS	Vulnerable range	Vanta SLA
146	GHSA-5jgf-p345-68v8	CVE-2026-75931	7.5	>=3.1.3 <3.1.6	2026-10-03, 30 days
147	GHSA-fph4-wmhf-6fwf	CVE-2026-75899	7.5	>=3.1.2 <3.1.6	2026-10-03, 30 days
—	GHSA-jqff-g426-hqxp	CVE-2026-76172	7.5	>=3.0.0 <3.1.6	no Vanta record
—	GHSA-f65p-4m7j-42xc	CVE-2026-75975	7.5	>=3.0.0 <3.1.6	no Vanta record

npm audit --package-lock-only on main reports all four against the installed 3.1.5, but Vanta has ingested only two for this repo. The two unrecorded ones are being reported separately as an ingestion gap; both are closed by this same bump, so no extra PR is needed.

Exposure: runtime, and it ships

Unlike the sibling bump in currents-dev/currents (development-only there), here fast-uri is in the production dependency tree of a published package:

@currents/mcp (published, v2.4.2)
  └─ @modelcontextprotocol/sdk  (dependencies)
       ├─ ajv@8.18.0        ──┐
       └─ ajv-formats@3.0.1 ──┴─ fast-uri@^3.0.1

No dev: true marker on any node in that chain, so the copy is present in npm ci --omit=dev installs and in the repo's Docker image.

All four advisories concern normalize() / resolve() on untrusted URIs. GHSA-fph4-wmhf-6fwf states the impact:

Applications that normalize or resolve an untrusted URI before an SSRF check, redirect validation, or host allowlist can be steered to a different destination, including internal addresses such as loopback or a cloud metadata endpoint, than the encoded input appeared to contain.

The reachable path here is ajv resolving $id/$ref in the tool input schemas the MCP SDK validates against. Those schemas are authored in this repo rather than supplied by a caller, so I found no path that feeds caller-controlled data into normalize()/resolve(). Worth a second opinion from someone who knows the SDK's validation internals — that judgement is the main reason this is Tier B rather than Tier A.

The fix

lockfile-upgrade — the narrowest mechanism available. The only requested range is fast-uri@^3.0.1 (declared by ajv), which already semver-satisfies 3.1.7, so no manifest edit and no overrides entry are needed. Diff is mcp-server/package-lock.json only, one stanza:

git diff --name-only origin/main...108b222
mcp-server/package-lock.json

Breaking-change check

• v3.1.7 is itself a security release fixing two further HIGH issues beyond 3.1.6 — "authority injection via an unvalidated port in serialize()" and "host confusion via unbalanced or misplaced IP-literal brackets". Taking 3.1.7 rather than the 3.1.6 Vanta names is strictly better.
• No breaking-change or removal section across 3.1.5 -> 3.1.7. Patch-only within major 3.

Verification (run locally on this PR's head 108b222)

Command	Result
git diff --name-only origin/main...HEAD	mcp-server/package-lock.json only
npm ci	clean; require('fast-uri/package.json').version -> 3.1.7
npm audit	fast-uri gone; only qs moderate remains (covered by #177)
npm run build	Build complete in 1247ms, 7 ESM files
npm test	435 passed / 435, 17 files passed

The local suite includes src/package-published-esm.integration.test.ts — the file that failed in CI — and it passes here.

CI coverage for head 108b222

• Test (Node 20.x) — success
• Test (Node 24.x) — success
• Test (Node 22.x) — failure
• Cursor Agent Dependency Review — failure
• [code]smith — skipped

Why the two red checks are not this diff

Test (Node 22.x) failed on one test, and the error is a git lock, not an assertion:

FAIL src/package-published-esm.integration.test.ts
     > ships package metadata that points at existing declaration files
Error: Command failed: ... npm-cli.js pack --ignore-scripts --pack-destination /tmp/mcp-pack-types-rptyLj
error: could not lock config file .git/config: File exists
npm error command sh -c git config core.hooksPath mcp-server/scripts/hooks

The prepare script runs git config core.hooksPath during npm pack, and two concurrent npm invocations raced on the .git/config lock. That is independent of any dependency version: 434 of 435 tests passed, Node 20 and Node 24 passed the same commit and the same test, and the full suite passes locally at 3.1.7. Note --ignore-scripts is already passed to pack, yet the prepare script still ran — if this recurs on unrelated PRs it is worth fixing at the source rather than re-running.

Cursor Agent Dependency Review never produced a review. Its log shows AGENT_ID, AGENT_URL and AGENT_STATUS all empty — the agent failed to launch, the step posted a Slack notification, and the job exited non-zero. There is no dependency finding behind this check; it is bot infrastructure.

What a human should still check

1. Re-run Test (Node 22.x) on 108b222. This run does not re-run jobs on PRs it did not open. Given Node 20/24 green plus 435/435 locally, it should pass.
2. Confirm the reachability read in the exposure section above — whether the MCP SDK can ever hand caller-controlled URI data to ajv's $ref resolution.
3. Decide on the release below.

Not applicable here: no patch-package in this repo, no majors collapsed, no pin widened, and the diff is a single stanza.

Needs release

@currents/mcp 2.4.2 — merging fixes the repo, but the fix reaches consumers only on a publish. npm consumers resolve ajv/fast-uri themselves and will pick up 3.1.7 on a fresh install regardless, but the Docker image installs from this lockfile, so image users stay on 3.1.5 until a release is cut. This run does not publish to any registry and does not create tags or releases.

---

Generated by Claude Code