EDM-5555: patch CVE-2026-84292 fast-uri Authority Injection

[redhat-chai-bot]

Summary

• Patches CVE-2026-84292 (HIGH, CVSS 7.5) — fast-uri Authority Injection via Unvalidated Port Serialization
• Adds npm override to pin fast-uri to 3.1.7 (from vulnerable 3.1.6)
• Follows existing project pattern for dependency overrides (js-yaml, immutable)

CVE Details

CVE-2026-84292 — fast-uri serializes the port component of a URI without validation, allowing authority injection when untrusted data is assigned to the port through serialize, normalize, or equal functions. Fixed in fast-uri 3.1.7.

Fix Strategy

npm override (lowest risk): Added "fast-uri": "3.1.7" to root package.json overrides. This is a patch-level bump within the existing ^3.0.1 semver range used by the transitive dependency chain (ajv → fast-uri).

Changes

File	Change
package.json	Added "fast-uri": "3.1.7" to overrides
package-lock.json	fast-uri 3.1.6 → 3.1.7

Validation

• fast-uri version confirmed at 3.1.7 in lockfile
• npm run lint — PASS
• npm run build — PASS

Test plan

• Verify CI passes (lint, build)
• Confirm no regressions in UI functionality

Resolves: EDM-5555

---

AI-generated. Review for accuracy.

@amir-yogev-gh requested in Slack thread

Summary

• Pins transitive fast-uri to 3.1.7 through the root npm override.
• Updates package-lock.json with the package URL and integrity hash.
• Fixes CVE-2026-84292, a HIGH-severity (CVSS 7.5) authority injection vulnerability.
• The version remains within the existing ^3.0.1 range.

Affected areas

• No direct changes affect libs/ui-components/, libs/types/, libs/i18n/, libs/cypress/, apps/standalone/, or apps/ocp-plugin/.
• No changes affect the Go auth proxy, packaging, container builds, E2E tests, or CI configuration.
• The update applies to consumers of the shared dependency across the workspace.
• Lint and build validation passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 4d54c411-141d-488f-8c82-36a5b0542c0f

📥 Commits

Reviewing files that changed from the base of the PR and between f16e00d and 80865a7.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The package override configuration now pins the transitive fast-uri dependency to version 3.1.7.

Changes

Dependency pinning

Layer / File(s)	Summary
fast-uri override package.json	The overrides block now pins fast-uri to version 3.1.7.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 80865

The dependency override pins fast-uri to the patched 3.1.7 release, with the lockfile resolution reported as aligned. No current merge-readiness risk is identified.

Suggested reviewers: celdrake

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Ai-Attribution	❌ Error	The pull request uses AI, as stated in the PR description and in the commit trailer. The changed commit adds Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>. The custom check explicitly flag…	Remove the AI Co-Authored-By trailer and amend the commit. Use an accepted trailer such as Made-with: Claude Opus 4.6 or Assisted-by: Claude Opus 4.6 instead.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the security fix, the affected package, and the CVE. It matches the primary change in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No-Hardcoded-Secrets	✅ Passed	PASS. The pull request changes only the fast-uri override and its npm lockfile metadata. The added URL is a public npm registry URL. The added 88-character Base64-looking value is the sha512 integ…
No-Weak-Crypto	✅ Passed	PASS. The pull request changes only package.json and package-lock.json: it pins fast-uri from 3.1.6 to 3.1.7. No MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto implementation, or secret-compa…
No-Injection-Vectors	✅ Passed	PASS — The pull request changes only dependency metadata. It adds the fast-uri 3.1.7 override and updates the lockfile from 3.1.6 to 3.1.7. It introduces no eval/exec, dangerouslySetInnerHTML,…
Container-Privileges	✅ Passed	The pull request changes only package.json and package-lock.json. The diff adds the fast-uri npm override and updates its lockfile entry. It changes no container or Kubernetes manifest and intro…
No-Sensitive-Data-In-Logs	✅ Passed	PASS. The pull request changes only package.json and package-lock.json. The added content pins fast-uri to 3.1.7 and updates its checksum. No application code, logging call, or log payload was…
Resource-Leaks	✅ Passed	PASS. The pull request changes only package.json and package-lock.json. The diff contains no files under proxy/ and no Go code changes. Therefore, it introduces no opened files, HTTP response bodies, …
Unchecked-Errors	✅ Passed	PASS — The pull request changes only package.json and package-lock.json. No proxy/ or Go file changed. The change adds the fast-uri 3.1.7 override and lockfile update, so it cannot introduce a…
Generated-Files-Not-Hand-Edited	✅ Passed	The pull request changes only package.json and package-lock.json. No files under libs/types/models/, libs/types/alpha/models/, libs/types/imagebuilder/models/**, or libs/i18n/locales/en/translatio…
I18n-Compliance	✅ Passed	PASS. The pull request changes only package.json and package-lock.json. It adds the fast-uri override and updates the lockfile from 3.1.6 to 3.1.7. No .tsx files, user-facing strings, or t() calls cha…

Full details: Ai-Attribution

Explanation

The pull request uses AI, as stated in the PR description and in the commit trailer. The changed commit adds Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>. The custom check explicitly flags Co-Authored-By for AI tools. The parent used Made-with: Cursor, so the violating trailer is introduced by this pull request commit.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[asafbennatan]

LGTM