From 378ff53339ddeec2d25b3a50636be92b5500d385 Mon Sep 17 00:00:00 2001
From: Imran Siddique <imran.siddique@opaque.co>
Date: Sat, 5 Sep 2026 13:57:45 -0700
Subject: [PATCH] fix(security): patch 4 fast-uri CVEs and stop tag
 interpolation in release.yml

fast-uri 3.1.5 is vulnerable to four high-severity advisories reachable
through the ajv chain in packages/typescript. Two are SSRF via malformed
IPv6 normalization (GHSA-f65p-4m7j-42xc) and repeated hostname
percent-decoding (GHSA-fph4-wmhf-6fwf); two are host confusion via
skipped IDN canonicalization (GHSA-5jgf-p345-68v8) and percent-encoded
scheme normalization (GHSA-jqff-g426-hqxp). Lockfile moves to 3.1.7,
which is past the 3.1.6 fix for all four. npm audit now reports zero.

release.yml also substituted github.event.release.tag_name directly into
two run: blocks. ${{ }} expansion happens before the shell parses the
line, so a crafted tag name is shell input, not an argument. Both now
pass the value through env.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t
---
 .github/workflows/release.yml         | 11 +++++++++--
 packages/typescript/package-lock.json |  6 +++---
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4515861..82cc2bf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,9 +28,14 @@ jobs:
           cache: npm
           cache-dependency-path: packages/typescript/package-lock.json
       - name: Verify release identity
+        env:
+          # Passed through the environment, never interpolated into the shell:
+          # a release tag is attacker-chosen text, and ${{ }} substitution happens
+          # before the shell parses the line.
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
           python tools/check_versions.py
-          python tools/check_release_tag.py "${{ github.event.release.tag_name }}"
+          python tools/check_release_tag.py "$RELEASE_TAG"
       - name: Derive npm dist-tag from the contract version
         id: npm_tag
         run: echo "tag=$(python tools/npm_dist_tag.py)" >> "$GITHUB_OUTPUT"
@@ -115,4 +120,6 @@ jobs:
       - name: Attach immutable build outputs to the GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release upload "${{ github.event.release.tag_name }}" release-assets/* --repo "${{ github.repository }}"
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          TARGET_REPO: ${{ github.repository }}
+        run: gh release upload "$RELEASE_TAG" release-assets/* --repo "$TARGET_REPO"
diff --git a/packages/typescript/package-lock.json b/packages/typescript/package-lock.json
index 9d0fd38..401f09a 100644
--- a/packages/typescript/package-lock.json
+++ b/packages/typescript/package-lock.json
@@ -612,9 +612,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
-      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
+      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
       "funding": [
         {
           "type": "github",