Skip to content

fix(deps): vuln fast-uri (patch → 3.1.8) [packages/libdatadog/package.json] - #297

Merged
dd-prapprover-prod-77c48c[bot] merged 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/libdatadog/1-1791200169
Oct 5, 2026
Merged

fix(deps): vuln fast-uri (patch → 3.1.8) [packages/libdatadog/package.json]#297
dd-prapprover-prod-77c48c[bot] merged 1 commit into
mainfrom
engraver-auto-version-upgrade/minorpatch/npm/libdatadog/1-1791200169

Conversation

@gh-worker-campaigns-3e9aa4

@gh-worker-campaigns-3e9aa4 gh-worker-campaigns-3e9aa4 Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

Summary: Security update — 1 package upgraded (patch changes only)

Manifests changed:

  • packages/libdatadog/package.json (npm)

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

Updates

Package From To Type Dep Type Vulnerabilities Fixed
fast-uri 3.1.7 3.1.8 patch Transitive 2 MEDIUM

Security Details

ℹ️ Other Vulnerabilities (2)
Package CVE Severity Summary Unsafe Version Fixed In Case
fast-uri GHSA-hrr3-gc8f-f4qj MODERATE fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets 3.1.7 2.4.7 -
fast-uri CVE-2026-86472 MODERATE fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets 3.1.7 - -

Review Checklist

Standard review:

  • Review changes for compatibility with your code
  • Check for breaking changes in release notes
  • Run tests locally or wait for CI
  • Approve and merge this PR

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System

@github-actions

github-actions Bot commented Oct 5, 2026

Copy link
Copy Markdown

WASM size comparison

Compared e214315 (base) with ea79770 (PR merge).

Artifact Before After Change
libdatadog 244,451 (238.7 KiB) 244,451 (238.7 KiB) 0 (0.00%)
remote config 336,768 (328.9 KiB) 336,768 (328.9 KiB) 0 (0.00%)

Negative changes reduce size.
Crate sizes come from symbol-preserving builds with debug names excluded and generic functions assigned to their symbol owner.

libdatadog: 0 changed, 46 unchanged

Inline artifact layers

Inline artifact layer Before After Change
Raw WASM (before Brotli) 492,791 (481.2 KiB) 492,791 (481.2 KiB) 0 (0.00%)
Brotli-compressed WASM 167,943 (164.0 KiB) 167,943 (164.0 KiB) 0 (0.00%)
Base64 encoding overhead 55,981 (54.7 KiB) 55,981 (54.7 KiB) 0 (0.00%)
JavaScript glue/loader 20,527 (20.0 KiB) 20,527 (20.0 KiB) 0 (0.00%)
Final inlined JavaScript 244,451 (238.7 KiB) 244,451 (238.7 KiB) 0 (0.00%)

Raw WebAssembly sections

Section Before After Change
header 8 (0.0 KiB) 8 (0.0 KiB) 0 (0.00%)
type 616 (0.6 KiB) 616 (0.6 KiB) 0 (0.00%)
import 3,257 (3.2 KiB) 3,257 (3.2 KiB) 0 (0.00%)
function 1,079 (1.1 KiB) 1,079 (1.1 KiB) 0 (0.00%)
table 13 (0.0 KiB) 13 (0.0 KiB) 0 (0.00%)
memory 5 (0.0 KiB) 5 (0.0 KiB) 0 (0.00%)
global 27 (0.0 KiB) 27 (0.0 KiB) 0 (0.00%)
export 1,167 (1.1 KiB) 1,167 (1.1 KiB) 0 (0.00%)
element 660 (0.6 KiB) 660 (0.6 KiB) 0 (0.00%)
data count 3 (0.0 KiB) 3 (0.0 KiB) 0 (0.00%)
code 444,191 (433.8 KiB) 444,191 (433.8 KiB) 0 (0.00%)
data 41,470 (40.5 KiB) 41,470 (40.5 KiB) 0 (0.00%)
custom 295 (0.3 KiB) 295 (0.3 KiB) 0 (0.00%)

Code by Rust crate

Crate/function owner Before After Change
Rust standard library 65,470 (63.9 KiB) 65,470 (63.9 KiB) 0 (0.00%)
libdatadog-wasm 58,088 (56.7 KiB) 58,088 (56.7 KiB) 0 (0.00%)
libdd-trace-obfuscation 42,144 (41.2 KiB) 42,144 (41.2 KiB) 0 (0.00%)
zrip-encode 41,358 (40.4 KiB) 41,358 (40.4 KiB) 0 (0.00%)
regex-lite 28,248 (27.6 KiB) 28,248 (27.6 KiB) 0 (0.00%)
libdd-trace-utils 24,499 (23.9 KiB) 24,499 (23.9 KiB) 0 (0.00%)
bindings / unattributed 22,847 (22.3 KiB) 22,847 (22.3 KiB) 0 (0.00%)
http 22,303 (21.8 KiB) 22,303 (21.8 KiB) 0 (0.00%)
rustc-demangle 16,094 (15.7 KiB) 16,094 (15.7 KiB) 0 (0.00%)
serde-json 12,421 (12.1 KiB) 12,421 (12.1 KiB) 0 (0.00%)
hashbrown 11,516 (11.2 KiB) 11,516 (11.2 KiB) 0 (0.00%)
libdd-trace-stats 11,441 (11.2 KiB) 11,441 (11.2 KiB) 0 (0.00%)
rmp 11,039 (10.8 KiB) 11,039 (10.8 KiB) 0 (0.00%)
serde-transcode 10,093 (9.9 KiB) 10,093 (9.9 KiB) 0 (0.00%)
rmp-serde 9,266 (9.0 KiB) 9,266 (9.0 KiB) 0 (0.00%)
anyhow 9,080 (8.9 KiB) 9,080 (8.9 KiB) 0 (0.00%)
dlmalloc 5,071 (5.0 KiB) 5,071 (5.0 KiB) 0 (0.00%)
crossbeam-channel 4,269 (4.2 KiB) 4,269 (4.2 KiB) 0 (0.00%)
rand-chacha 4,267 (4.2 KiB) 4,267 (4.2 KiB) 0 (0.00%)
libdd-trace-protobuf 4,176 (4.1 KiB) 4,176 (4.1 KiB) 0 (0.00%)
bytes 3,875 (3.8 KiB) 3,875 (3.8 KiB) 0 (0.00%)
zrip-core 3,631 (3.5 KiB) 3,631 (3.5 KiB) 0 (0.00%)
fluent-uri 3,463 (3.4 KiB) 3,463 (3.4 KiB) 0 (0.00%)
libdd-common 2,806 (2.7 KiB) 2,806 (2.7 KiB) 0 (0.00%)
libdd-ddsketch 2,403 (2.3 KiB) 2,403 (2.3 KiB) 0 (0.00%)
js-sys 2,390 (2.3 KiB) 2,390 (2.3 KiB) 0 (0.00%)
zmij 2,243 (2.2 KiB) 2,243 (2.2 KiB) 0 (0.00%)
other crates (<2 KiB in both builds) 9,670 (9.4 KiB) 9,670 (9.4 KiB) 0 (0.00%)
remote config: 0 changed, 43 unchanged

Inline artifact layers

Inline artifact layer Before After Change
Raw WASM (before Brotli) 720,147 (703.3 KiB) 720,147 (703.3 KiB) 0 (0.00%)
Brotli-compressed WASM 230,616 (225.2 KiB) 230,616 (225.2 KiB) 0 (0.00%)
Base64 encoding overhead 76,872 (75.1 KiB) 76,872 (75.1 KiB) 0 (0.00%)
JavaScript glue/loader 29,280 (28.6 KiB) 29,280 (28.6 KiB) 0 (0.00%)
Final inlined JavaScript 336,768 (328.9 KiB) 336,768 (328.9 KiB) 0 (0.00%)

Raw WebAssembly sections

Section Before After Change
header 8 (0.0 KiB) 8 (0.0 KiB) 0 (0.00%)
type 574 (0.6 KiB) 574 (0.6 KiB) 0 (0.00%)
import 4,790 (4.7 KiB) 4,790 (4.7 KiB) 0 (0.00%)
function 2,193 (2.1 KiB) 2,193 (2.1 KiB) 0 (0.00%)
table 13 (0.0 KiB) 13 (0.0 KiB) 0 (0.00%)
memory 5 (0.0 KiB) 5 (0.0 KiB) 0 (0.00%)
global 33 (0.0 KiB) 33 (0.0 KiB) 0 (0.00%)
export 1,139 (1.1 KiB) 1,139 (1.1 KiB) 0 (0.00%)
element 1,550 (1.5 KiB) 1,550 (1.5 KiB) 0 (0.00%)
data count 4 (0.0 KiB) 4 (0.0 KiB) 0 (0.00%)
code 629,686 (614.9 KiB) 629,686 (614.9 KiB) 0 (0.00%)
data 79,830 (78.0 KiB) 79,830 (78.0 KiB) 0 (0.00%)
custom 322 (0.3 KiB) 322 (0.3 KiB) 0 (0.00%)

Code by Rust crate

Crate/function owner Before After Change
serde-json 96,377 (94.1 KiB) 96,377 (94.1 KiB) 0 (0.00%)
tuf 96,309 (94.1 KiB) 96,309 (94.1 KiB) 0 (0.00%)
Rust standard library 93,533 (91.3 KiB) 93,533 (91.3 KiB) 0 (0.00%)
libdd-remote-config 79,352 (77.5 KiB) 79,352 (77.5 KiB) 0 (0.00%)
data-encoding 40,626 (39.7 KiB) 40,626 (39.7 KiB) 0 (0.00%)
bindings / unattributed 36,298 (35.4 KiB) 36,298 (35.4 KiB) 0 (0.00%)
http 27,758 (27.1 KiB) 27,758 (27.1 KiB) 0 (0.00%)
hashbrown 25,059 (24.5 KiB) 25,059 (24.5 KiB) 0 (0.00%)
ring 17,349 (16.9 KiB) 17,349 (16.9 KiB) 0 (0.00%)
js-sys 15,849 (15.5 KiB) 15,849 (15.5 KiB) 0 (0.00%)
rustc-demangle 13,732 (13.4 KiB) 13,732 (13.4 KiB) 0 (0.00%)
anyhow 13,201 (12.9 KiB) 13,201 (12.9 KiB) 0 (0.00%)
sha2 10,885 (10.6 KiB) 10,885 (10.6 KiB) 0 (0.00%)
rand-chacha 6,242 (6.1 KiB) 6,242 (6.1 KiB) 0 (0.00%)
serde-wasm-bindgen 5,654 (5.5 KiB) 5,654 (5.5 KiB) 0 (0.00%)
prost 4,955 (4.8 KiB) 4,955 (4.8 KiB) 0 (0.00%)
dlmalloc 4,686 (4.6 KiB) 4,686 (4.6 KiB) 0 (0.00%)
serde 4,254 (4.2 KiB) 4,254 (4.2 KiB) 0 (0.00%)
base64 3,475 (3.4 KiB) 3,475 (3.4 KiB) 0 (0.00%)
libdd-common 3,220 (3.1 KiB) 3,220 (3.1 KiB) 0 (0.00%)
libdd-trace-protobuf 3,126 (3.1 KiB) 3,126 (3.1 KiB) 0 (0.00%)
bytes 2,706 (2.6 KiB) 2,706 (2.6 KiB) 0 (0.00%)
compiler-builtins 2,419 (2.4 KiB) 2,419 (2.4 KiB) 0 (0.00%)
zmij 2,296 (2.2 KiB) 2,296 (2.2 KiB) 0 (0.00%)
other crates (<2 KiB in both builds) 20,319 (19.8 KiB) 20,319 (19.8 KiB) 0 (0.00%)

@github-actions

github-actions Bot commented Oct 5, 2026

Copy link
Copy Markdown

Overall package size

Self size: 36.42 MB
Deduped: 36.42 MB
No deduping: 36.42 MB

Dependency sizes | name | version | self size | total size | |------|---------|-----------|------------|

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@dd-octo-sts
dd-octo-sts Bot marked this pull request as ready for review October 5, 2026 20:34
@dd-octo-sts
dd-octo-sts Bot requested review from a team as code owners October 5, 2026 20:34
@dd-prapprover-prod-77c48c

dd-prapprover-prod-77c48c Bot commented Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown

PRApprover will approve and merge this PR, FAQ, #dx-source-code-management

🛠️ PRApproval Status

  • ✅ PR is eligible for auto-approval by rule dependency-management-version-updater - 2026-10-05T20:45:07Z
  • ✅ CI tests passed - 2026-10-05T20:45:11Z
  • ✅ Approved (commit: ee3ff35) - 2026-10-05T20:45:13Z
  • ✅ Merge Started
  • ✅ Merged - 2026-10-05T20:45:25Z

➡️ Current phase: PR merged successfully! ✅

dd-prapprover-prod-77c48c[bot]
dd-prapprover-prod-77c48c Bot approved these changes Oct 5, 2026
View reviewed changes

@dd-prapprover-prod-77c48c dd-prapprover-prod-77c48c Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR has been automatically approved by the DD PR Approver bot.

@dd-prapprover-prod-77c48c
dd-prapprover-prod-77c48c Bot merged commit e793d6f into main Oct 5, 2026
55 checks passed
@dd-prapprover-prod-77c48c
dd-prapprover-prod-77c48c Bot deleted the engraver-auto-version-upgrade/minorpatch/npm/libdatadog/1-1791200169 branch October 5, 2026 20:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dd-prapprover-prod-77c48c dd-prapprover-prod-77c48c[bot] dd-prapprover-prod-77c48c[bot] approved these changes

Assignees

No one assigned

Labels

adms-dependency-update adms-medium-severity adms-mode-all-vulns adms-npm adms-patch-update bot_family:adms-dependency-update campaigner-automated-change

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants