fix(deps): bump fast-uri, undici and brace-expansion past their advisories

[shabaraba]

Why

Three packages in the dependency graph are on versions with open high severity advisories.

fast-uri@4.1.3 — fixed in 4.1.4:

• GHSA-58mr-gqgx-xq4g — parse() accepts a host with an unclosed authority bracket ([@127.0.0.1), so an application that makes a host decision from parse().host and then hands the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches.
• GHSA-qw65-cvwx-89v3 — serialize() concatenates the port component verbatim, so a non-numeric port can inject authority delimiters and demote the intended host to userinfo.

fast-uri is not a direct dependency. It comes in through ajv, which uses it to normalize and compare $id / $ref schema identifiers. That path makes no host decisions, and the port it serializes always comes from parse(), which the second advisory calls out as unaffected. Exploitability is low; the point is to stop shipping an affected version in the lockfile.

undici@7.28.0 — fixed in 7.29.1:

• GHSA-w293-vg96-wgc3 — TLS certificate validation bypass through connect options dropped in BalancedPool.
• GHSA-rfgv-xxqx-mfg5 — denial of service via an unrequested WebSocket subprotocol.

Unlike the other two, this one is a runtime dependency of @kintone/rest, so it reaches consumers of the published package.

brace-expansion at 1.1.16 / 2.1.2 / 5.0.9 — fixed in 1.1.20 / 2.1.6 / 5.0.11:

• GHSA-6j4f-fj2g-mc7p — stack exhaustion via uncontrolled recursion in parseCommaParts.
• GHSA-qhr7-859c-m2p7 — stack exhaustion via uncontrolled recursion on nested brace groups.

What

• fast-uri override: >=4.1.3 → >=4.1.4 <5. The lockfile resolves 4.2.1 for both ajv@8.18.0 and ajv@8.20.0. ajv still declares fast-uri: ^3.0.1 as of its latest release 8.20.0, so v4 is reached only through this override. The upper bound is there so the next major cannot be picked up unnoticed, which is how v4 was reached in the first place. Drop it once ajv declares v4 or later.
• undici in packages/rest: 7.28.0 → 7.29.1.
• brace-expansion overrides: ^1 → >=1.1.20 <2, ^2 → >=2.1.6 <3, ^5 → >=5.0.11 <6. The lockfile resolves 1.1.21, 2.1.7 and 5.0.12. The ^5 entry gains an upper bound so it matches the other two and cannot cross a major its consumers do not declare.
• The minimumReleaseAgeExclude entries for fast-uri@4.1.2 and undici@7.28.0 go away. Both floors have moved past those versions, and 4.1.4 (2026-09-02) and 7.29.1 (2026-09-04) are well beyond the 24 hour hold.

This supersedes #3934, which raised the brace-expansion floors for an earlier advisory (CVE-2026-69152) to versions that the two advisories above have since overtaken. It also covers #3924, which bumps undici to 7.29.0 — one patch short of the fix.

How to test

pnpm install
pnpm build
pnpm lint
pnpm -r run test:ci

All green locally: lint, and 842 tests across the seven packages. That includes packages/rest, which is the direct undici consumer, and the 113 tests in plugin-manifest-validator, the heaviest ajv user in the repo.

Two notes on running this locally. pnpm build has to come first, otherwise lint:package fails on the missing lib/es/index.d.ts. And pnpm test:root fails here for a reason unrelated to this change — __tests__/lib/workspace.ts passes "--depth 0" to pnpm m ls as a single argument, which a recent pnpm rejects — it fails the same way on an unmodified main, so the package suites were run directly.

Checklist

• Read CONTRIBUTING.md
• Updated documentation if it is required.
• Added tests if it is required.
• Passed pnpm lint and pnpm test on the root directory.

Related PRs

The same fast-uri override change is going out to the other repositories in this org:

• fix(deps): pin fast-uri, undici and brace-expansion past their advisories cli-kintone#1597
• fix(deps): pin fast-uri and brace-expansion past their advisories [security] mcp-server#572

[Copilot]

Copilot review overview

🟢 Approval recommended

The manifests and lockfile are consistent, and all targeted dependencies resolve to patched versions.

Review effort: Balanced
Findings: None

What changed in this PR

Updates vulnerable dependencies to patched releases across the workspace.

Changes:

• Raises brace-expansion and fast-uri override floors.
• Upgrades runtime dependency undici to 7.29.1.
• Refreshes the lockfile and removes obsolete release-age exceptions.

File	Description
package.json	Updates security override ranges.
packages/​rest/​package.json	Upgrades undici.
pnpm-lock.yaml	Resolves patched dependency versions.
pnpm-workspace.yaml	Removes obsolete release-age exclusions.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.