[dependabot]

Bumps fast-uri from 2.4.6 to 2.4.8.

Release notes

Sourced from fast-uri's releases.

v2.4.8

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 2.x. Applications that process untrusted URI input should upgrade to v2.4.8.

• Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
• Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
• Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
• Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@2.4.8

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

• ci: enable trusted publishing releases (v2.x) by @​mcollina in fastify/fast-uri#228

Full Changelog: fastify/fast-uri@v2.4.7...v2.4.8

v2.4.7

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

• GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v2.x release line should upgrade to v2.4.7.

Full Changelog: fastify/fast-uri@v2.4.6...v2.4.7

Commits

• 3505e4b Bumped v2.4.8
• 62d6316 fix: preserve v2 suffix authority parsing
• 1d0a85c test: generate only relative path references
• 7c19f8b fix: preserve relative paths in suffix and relative resolution
• 17294a7 docs: note suffix-reference authority ambiguity
• 8071835 fix: escape a first-segment colon in suffix references
• 39340e1 test: cover first-segment colon in suffix references
• 58c183d fix(SEC-03): reject non reg-name characters in domain hosts
• fcbce51 fix: keep a colon-first segment behind "./" in relative normalization
• 09e8a26 test: cover colon-first relative references in normalization
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.