fix(deps): bump fast-uri to patch GHSA-4c8g-83qw-93j6 - #240
Conversation
ajv@8.17.1 already accepts fast-uri ^3.0.1, so this is a lockfile bump within the existing range -- no override or ajv bump needed.
|
Warning Review limit reached
Next review available in: 53 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (8)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughSummary by CodeRabbit
WalkthroughComposer now uses one consolidated configuration block. Development dependencies now contain PHP_CodeSniffer and WPCS. Existing repository, stability, licence, and plugin permission settings remain. ChangesComposer tooling
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to This PR updates fast-uri to the patched 3.1.3 release within the existing dependency range, with no actionable merge-blocking risk remaining after normal checks and review. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Tick the box to add this pull request to the merge queue (same as
|
composer.json had two "config" and two "require-dev" keys; JSON silently keeps only the last of each, so an earlier attempt to allow the composer/installers plugin was discarded and composer install has been failing since at least 2026-07-17 (pre-existing, confirmed on main). Removes the dead shadowed blocks and keeps composer/installers in the one effective allow-plugins list. Does not add the missing phpcs.xml.dist that "composer lint" also needs -- authoring a WPCS ruleset is a separate decision for this repo's maintainers, not something to improvise inside a dependency-security PR.
…solves .phpcs.xml.dist (the ruleset the CI lint job actually runs) references the PHPCompatibilityWP standard, provided by phpcompatibility/phpcompatibility-wp. That package was only ever declared in the dead, JSON-key-shadowed require-dev block removed in the previous commit -- restoring it here, in the one effective require-dev, is what that removal was missing. Also fixes composer.json's own format/lint scripts, which pointed at phpcs.xml.dist (no leading dot) -- a file that has never existed in this repo. The GitHub Actions lint job always used the correct .phpcs.xml.dist directly; only the composer scripts were wrong. Confirmed locally: ./vendor/bin/phpcs -p --standard=.phpcs.xml.dist now runs to completion instead of erroring on the missing sniff. It reports 11 pre-existing style violations (trailing whitespace, extra blank lines) across files this PR does not touch -- out of scope for a dependency- security fix; left to a separate cleanup.
Mechanical only (trailing whitespace, blank-line trailing whitespace, one comment spacing) -- run via ./vendor/bin/phpcbf now that the lint pipeline actually executes. 7 errors and 6 warnings remain in class-frontend.php and class-images.php that need a real code decision (mixed boolean operators without parens, unused callback params, doc-comment capitalization) -- left for the maintainers, not auto-fixable and not part of this PR's scope.
1 participant
Summary
version to 3.1.3 (patched) within the existing range -- no ajv bump or override needed.
Test plan
npm ls fast-uriresolves cleanly to 3.1.3 under ajv@8.17.1