Bump fast-uri to 3.1.8

[nelsonkopliku]

Description

Addresses https://bugzilla.suse.com/show_bug.cgi?id=1280779 and specifically GHSA-hrr3-gc8f-f4qj

We are not affected by https://bugzilla.suse.com/show_bug.cgi?id=1280788 and related GHSA-jvvf-x445-j334

Additionally fixes a moderate here

npm audit
# npm audit report

qs  2.2.5 - 6.15.3
Severity: moderate
qs array-limit bypass via bracket-key comma parsing - https://github.com/advisories/GHSA-x5fp-wj9c-mxmx
qs: Denial of Service via Attacker Controlled isBuffer - https://github.com/advisories/GHSA-4mjr-xmp4-gh2g

GHSA-hrr3-gc8f-f4qj is from yesteday, so that's why dependabot didn't open a PR, yet.

@arbulu89 @skrech what did we decide about CVEs on test deps like this? Backport or not?

[Copilot]

🟢 Approval recommended

The lockfile changes are internally consistent and reference valid upstream releases.

Pull request overview

Updates the E2E dependency graph to address vulnerabilities in fast-uri and qs.

Changes:

• Bumps fast-uri to 3.1.8.
• Bumps qs to 6.16.0 and refreshes transitive dependencies.

File summaries

File	Description
test/e2e/package-lock.json	Locks patched dependency versions for E2E tests.

Review details

Copilot wasn't able to review any files in this pull request.

Files not reviewed (1)

• test/e2e/package-lock.json: Generated file

• Files reviewed: 0/1 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[antgamdia]

Thanks! We'd need to add the label to backport it just in case I think?

Edit: I just read question: what did we decide about CVEs on test deps like this? Backport or not? 🤦 Personally, +1 to backport, as we might get bugzilla reports anyway for now.

[skrech]

In an ideal world, we don't need to backport dev and test dependencies. However, since we can't configure the vuln scanner to ignore dev deps currently, we'd be opened a Bugzilla ticket for that dev dep. Since we've established an "as-we-go" approach to backporting, I think it's better to backport bumps to dev deps if they have CVEs in them.

[skrech]

Question: Did you update qs separately from bumping the fast-uri dep? If so, maybe it's better to update these in separate PRs in the future?

[trentobot]

Created backport PR for release:

• Bump fast-uri to 3.1.8 #4778 with remaining conflicts!

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin backport-4777-to-release
git worktree add --checkout .worktree/backport-4777-to-release backport-4777-to-release
cd .worktree/backport-4777-to-release
git reset --hard HEAD^
git cherry-pick -x c4d0023776ab87c4c47de4b2150b3944066ecbfc