Skip to content

Bump the npm-dependencies-security group across 6 directories with 1 update - #4092

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/plotly/dash-test-components/npm-dependencies-security-046f7ece56
Open

dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/plotly/dash-test-components/npm-dependencies-security-046f7ece56

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-dependencies-security group with 1 update in the /@plotly/dash-test-components directory: fast-uri.
Bumps the npm-dependencies-security group with 1 update in the /@plotly/dash-jupyterlab directory: fast-uri.
Bumps the npm-dependencies-security group with 1 update in the /@plotly/dash-generator-test-component-typescript directory: fast-uri.
Bumps the npm-dependencies-security group with 1 update in the /@plotly/dash-generator-test-component-standard directory: fast-uri.
Bumps the npm-dependencies-security group with 1 update in the /@plotly/dash-generator-test-component-nested directory: fast-uri.
Bumps the npm-dependencies-security group with 1 update in the /@plotly/dash-component-plugins directory: fast-uri.

Updates fast-uri from 3.1.8 to 3.1.9

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

  • Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
  • Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
  • Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
  • Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

Commits
  • 0def703 Bumped v3.1.9
  • a1d0da2 test: generate only relative path references
  • 9eb8759 fix: preserve relative paths in suffix and relative resolution
  • 54c30f7 docs: note suffix-reference authority ambiguity
  • 39e6493 fix: escape a first-segment colon in suffix references
  • 745183c test: cover first-segment colon in suffix references
  • ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
  • d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
  • eb483b5 test: cover colon-first relative references in normalization
  • b110a35 fix(SEC-02): preserve meaning of relative references during normalization
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.


Updates fast-uri from 3.1.8 to 3.1.9

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

  • Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
  • Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
  • Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
  • Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

Commits
  • 0def703 Bumped v3.1.9
  • a1d0da2 test: generate only relative path references
  • 9eb8759 fix: preserve relative paths in suffix and relative resolution
  • 54c30f7 docs: note suffix-reference authority ambiguity
  • 39e6493 fix: escape a first-segment colon in suffix references
  • 745183c test: cover first-segment colon in suffix references
  • ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
  • d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
  • eb483b5 test: cover colon-first relative references in normalization
  • b110a35 fix(SEC-02): preserve meaning of relative references during normalization
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.


Updates fast-uri from 3.1.8 to 3.1.9

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

  • Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
  • Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
  • Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
  • Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

Commits
  • 0def703 Bumped v3.1.9
  • a1d0da2 test: generate only relative path references
  • 9eb8759 fix: preserve relative paths in suffix and relative resolution
  • 54c30f7 docs: note suffix-reference authority ambiguity
  • 39e6493 fix: escape a first-segment colon in suffix references
  • 745183c test: cover first-segment colon in suffix references
  • ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
  • d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
  • eb483b5 test: cover colon-first relative references in normalization
  • b110a35 fix(SEC-02): preserve meaning of relative references during normalization
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.


Updates fast-uri from 3.1.8 to 3.1.9

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

  • Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
  • Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
  • Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
  • Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

Commits
  • 0def703 Bumped v3.1.9
  • a1d0da2 test: generate only relative path references
  • 9eb8759 fix: preserve relative paths in suffix and relative resolution
  • 54c30f7 docs: note suffix-reference authority ambiguity
  • 39e6493 fix: escape a first-segment colon in suffix references
  • 745183c test: cover first-segment colon in suffix references
  • ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
  • d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
  • eb483b5 test: cover colon-first relative references in normalization
  • b110a35 fix(SEC-02): preserve meaning of relative references during normalization
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.


Updates fast-uri from 3.1.8 to 3.1.9

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

  • Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
  • Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
  • Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
  • Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

Commits
  • 0def703 Bumped v3.1.9
  • a1d0da2 test: generate only relative path references
  • 9eb8759 fix: preserve relative paths in suffix and relative resolution
  • 54c30f7 docs: note suffix-reference authority ambiguity
  • 39e6493 fix: escape a first-segment colon in suffix references
  • 745183c test: cover first-segment colon in suffix references
  • ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
  • d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
  • eb483b5 test: cover colon-first relative references in normalization
  • b110a35 fix(SEC-02): preserve meaning of relative references during normalization
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.


Updates fast-uri from 3.1.8 to 3.1.9

Release notes

Sourced from fast-uri's releases.

v3.1.9

Security

This security release fixes four URI parsing and normalization vulnerabilities in fast-uri 3.x. Applications that process untrusted URI input should upgrade to v3.1.9.

  • Medium — URI scheme spoofing through percent-encoded schemes (GHSA-w74x-v6f9-j3xg, CVE-2026-110306): percent-encoded scheme input is now rejected instead of being decoded into a live scheme.
  • Medium — Host confusion during domain-host canonicalization (GHSA-wjr9-j795-jxcr, CVE-2026-110180): malformed domain hosts containing ambiguous delimiters or stripped control characters are now rejected instead of being silently rewritten.
  • Low — Incorrect relative-reference normalization (GHSA-xhq7-xmqj-769h, CVE-2026-110095): dot-segment removal now preserves the resolution semantics of relative references.
  • Low — Scheme injection in suffix references (GHSA-333x-w4r6-6crp, CVE-2026-110725): first-segment colons in path-only suffix references are now escaped so the output is not reparsed as a scheme.

Upgrade with:

npm install fast-uri@3.1.9

Thanks to @​zekth for reporting the scheme, host, and relative-reference issues, and to @​UlisesGascon for finding the suffix-reference issue and reviewing the remediations.

What's Changed

Full Changelog: fastify/fast-uri@v3.1.8...v3.1.9

Commits
  • 0def703 Bumped v3.1.9
  • a1d0da2 test: generate only relative path references
  • 9eb8759 fix: preserve relative paths in suffix and relative resolution
  • 54c30f7 docs: note suffix-reference authority ambiguity
  • 39e6493 fix: escape a first-segment colon in suffix references
  • 745183c test: cover first-segment colon in suffix references
  • ddfc6a5 fix(SEC-03): reject non reg-name characters in domain hosts
  • d86a8d2 fix: keep a colon-first segment behind "./" in relative normalization
  • eb483b5 test: cover colon-first relative references in normalization
  • b110a35 fix(SEC-02): preserve meaning of relative references during normalization
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-uri since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…update

Bumps the npm-dependencies-security group with 1 update in the /@plotly/dash-test-components directory: [fast-uri](https://github.com/fastify/fast-uri).
Bumps the npm-dependencies-security group with 1 update in the /@plotly/dash-jupyterlab directory: [fast-uri](https://github.com/fastify/fast-uri).
Bumps the npm-dependencies-security group with 1 update in the /@plotly/dash-generator-test-component-typescript directory: [fast-uri](https://github.com/fastify/fast-uri).
Bumps the npm-dependencies-security group with 1 update in the /@plotly/dash-generator-test-component-standard directory: [fast-uri](https://github.com/fastify/fast-uri).
Bumps the npm-dependencies-security group with 1 update in the /@plotly/dash-generator-test-component-nested directory: [fast-uri](https://github.com/fastify/fast-uri).
Bumps the npm-dependencies-security group with 1 update in the /@plotly/dash-component-plugins directory: [fast-uri](https://github.com/fastify/fast-uri).


Updates `fast-uri` from 3.1.8 to 3.1.9
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.8...v3.1.9)

Updates `fast-uri` from 3.1.8 to 3.1.9
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.8...v3.1.9)

Updates `fast-uri` from 3.1.8 to 3.1.9
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.8...v3.1.9)

Updates `fast-uri` from 3.1.8 to 3.1.9
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.8...v3.1.9)

Updates `fast-uri` from 3.1.8 to 3.1.9
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.8...v3.1.9)

Updates `fast-uri` from 3.1.8 to 3.1.9
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](fastify/fast-uri@v3.1.8...v3.1.9)

---
updated-dependencies:
- dependency-name: fast-uri
  dependency-version: 3.1.9
  dependency-type: indirect
  dependency-group: npm-dependencies-security
- dependency-name: fast-uri
  dependency-version: 3.1.9
  dependency-type: indirect
  dependency-group: npm-dependencies-security
- dependency-name: fast-uri
  dependency-version: 3.1.9
  dependency-type: indirect
  dependency-group: npm-dependencies-security
- dependency-name: fast-uri
  dependency-version: 3.1.9
  dependency-type: indirect
  dependency-group: npm-dependencies-security
- dependency-name: fast-uri
  dependency-version: 3.1.9
  dependency-type: indirect
  dependency-group: npm-dependencies-security
- dependency-name: fast-uri
  dependency-version: 3.1.9
  dependency-type: indirect
  dependency-group: npm-dependencies-security
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 27, 2026
@sonarqubecloud

Copy link
Copy Markdown

@github-actions

Copy link
Copy Markdown
Contributor

Dash performance benchmarks

⚠️ regressions to review

scenario metric p90 (ms) median growth baseline p90 note
⚠️ full_children_replace replace_ms 5750.6 2082.2 19.68x 4697.1 1.3x baseline (norm)
✅ callback_chain chain_ms 501.2 484.4 0.95x 499.1
✅ callback_chain graph_ms 2.3 2.3 1.0x 2.4
✅ callback_fanout fanout_ms 82.6 77.5 0.92x 92.5
✅ deep_nesting render_ms 57.1 53.6 1.11x 56.8
✅ initial_render_large render_ms 573.3 502.5 1.02x 694.4
✅ initial_render_small render_ms 105.0 90.0 1.12x 104.0
✅ patch_append_nested append_ms 137.7 91.4 2.64x 192.3
✅ patch_append_toplevel append_ms 115.2 92.3 2.18x 140.2
✅ patch_scalar_update_large update_ms 139.5 127.8 0.87x 202.9
✅ wildcard_all_resolve wildcard_ms 300.2 272.5 0.91x 313.6
✅ wildcard_all_resolve graph_ms 1.0 1.0 1.0x 1.3

growth = late-third / early-third per-op time; ~1 is flat, a large value means the per-op cost scales with accumulated state.

machine scale vs baseline: 0.94x - divided out of the baseline ratios so they compare like for like (the absolute warn/fail ceilings are left un-scaled); calibrated on initial_render_small.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants