Repository navigation
chore(deps-dev): bump fast-uri from 3.1.7 to 4.2.2 - #868
Conversation
dependabot
Bot
added
dependencies
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.7 to 4.2.2. - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.7...v4.2.2) --- updated-dependencies: - dependency-name: fast-uri dependency-version: 4.2.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
4c8ae81 to
74e3521
Compare
green-dalii
left a comment
green-dalii
left a comment
There was a problem hiding this comment.
Merge audit, recorded before the squash. Administrative bypass on explicit instruction; ruleset added, used, restored, re-read field by field.
Why bypass. A dependabot PR cannot carry a review, and the ruleset requires one.
Pre-merge scans. No closing keyword. The branch has two commits: the bump, and the Dependabot lockfile sync commit that regenerates the three lockfiles. The only trailer is Signed-off-by: dependabot[bot], which is the bot's own sign-off; the squash uses an explicit message, so it is not carried onto the merge commit.
What was checked beyond Gate 1. fast-uri is a direct devDependency with no importer in scripts/, tools/ or src/ — it is a version pin for a transitive dependency, not a library this repository calls. The obvious hazard of a major bump would be forcing that major onto a consumer written for 3.x, and it does not happen: ajv keeps its own nested fast-uri@3.1.8 in both lockfiles, and only the direct dependency resolves 4.2.2. Verified in package-lock.json (node_modules/ajv/node_modules/fast-uri -> 3.1.8) and in pnpm-lock.yaml (fast-uri@3.1.8 under ajv's dependency block).
Not verified. No test exercises fast-uri itself, because nothing in this repository imports it. Its correctness rests on the pin resolving, which the lockfile diff shows.
Bumps fast-uri from 3.1.7 to 4.2.2.
Release notes
Sourced from fast-uri's releases.
... (truncated)
Commits
be1803eBumped v4.2.225378a0chore: bump playwright-test from 14.1.15 to 15.0.1 (#226)42e2318ci: enable trusted publishing releasesa2b6779fix: preserve dot segments in URN namespace strings (#222)9da8b0afix: encode invalid host characters (#223)86bb948fix: reject invalid URI reference edges (#221)5b254aaBumped v4.2.1f58dc11fix: make mailto normalization idempotent for authority recipients (#219)ee4e850Bumped v4.2.04fef6cefix: keep IPv6 zone identifiers stable across parse/normalize/serialize/equal...Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)