diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4515861..82cc2bf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,9 +28,14 @@ jobs:
           cache: npm
           cache-dependency-path: packages/typescript/package-lock.json
       - name: Verify release identity
+        env:
+          # Passed through the environment, never interpolated into the shell:
+          # a release tag is attacker-chosen text, and ${{ }} substitution happens
+          # before the shell parses the line.
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
           python tools/check_versions.py
-          python tools/check_release_tag.py "${{ github.event.release.tag_name }}"
+          python tools/check_release_tag.py "$RELEASE_TAG"
       - name: Derive npm dist-tag from the contract version
         id: npm_tag
         run: echo "tag=$(python tools/npm_dist_tag.py)" >> "$GITHUB_OUTPUT"
@@ -115,4 +120,6 @@ jobs:
       - name: Attach immutable build outputs to the GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release upload "${{ github.event.release.tag_name }}" release-assets/* --repo "${{ github.repository }}"
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          TARGET_REPO: ${{ github.repository }}
+        run: gh release upload "$RELEASE_TAG" release-assets/* --repo "$TARGET_REPO"
diff --git a/packages/typescript/package-lock.json b/packages/typescript/package-lock.json
index 9d0fd38..401f09a 100644
--- a/packages/typescript/package-lock.json
+++ b/packages/typescript/package-lock.json
@@ -612,9 +612,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
-      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
+      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
       "funding": [
         {
           "type": "github",