morluto/rea
1
0 Fork 0
mirror of https://github.com/morluto/rea.git synced 2026-11-07 05:56:19 -10:00
Code Issues Packages Projects Releases 1 Wiki Activity

fix(deps): patch fast-uri, qs and HTTP/3 certifi (#7704)

Browse Source 
Refresh compatible security fixes and verified dependency notices. Keep
historical HTTP/3 guest verification separate from the refreshed trust store.

Fixes #7700

Assisted-by: Aya (gensokyo-skills:aya-source-investigation)
This commit is contained in:
gensokyo-dev authored and GitHub committed 2026-10-28 03:34:36 +00:00
1 parent aa6f6436c9
commit e556134302
6 files changed
+28 -22
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/http3-capture-lab.md
+6 -1
View File
@@ -40,7 +40,12 @@ Record the image digest, REA source revision and these dependency versions:
- OpenSSL and cURL advertising HTTP3 and HTTP2 in `curl --version`.
The verified guest used Python 3.14.7, cURL 8.22.0, ngtcp2 1.25.0 and nghttp3
1.18.0. Other dependency profiles need verification. Back up the guest's
1.18.0. The current requirements update certifi from 2026.7.22 to 2026.10.19
to remove the compromised emSign trust root described in
[GHSA-6q48-6c7w-9gw2](https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2).
The revised dependency graph has not been rerun in that sealed guest; the
historical verification does not cover this update. Other dependency profiles
need verification. Back up the guest's
`/etc/hosts` before adding `127.0.0.1 lab.test`. Reserve guest TCP/UDP loopback
ports 18443 and 19443. These changes belong only to the disposable guest.
licenses/npm-dependencies.txt
+8 -8
View File
@@ -2695,11 +2695,11 @@ [email protected] | runtime | MIT
Package: https://www.npmjs.com/package/fast-string-width/v/3.0.2
Archive: https://registry.npmjs.org/fast-string-width/-/fast-string-width-3.0.2.tgz
Integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==
[email protected].8 | runtime | BSD-3-Clause
[email protected].9 | runtime | BSD-3-Clause
Lockfile path: node_modules/fast-uri
Package: https://www.npmjs.com/package/fast-uri/v/3.1.8
Archive: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz
Integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==
Package: https://www.npmjs.com/package/fast-uri/v/3.1.9
Archive: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz
Integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==
[email protected] | runtime | MIT
Lockfile path: node_modules/fast-wrap-ansi
Package: https://www.npmjs.com/package/fast-wrap-ansi/v/0.2.2
@@ -3775,11 +3775,11 @@ [email protected] | development | MIT
Package: https://www.npmjs.com/package/pure-rand/v/8.4.2
Archive: https://registry.npmjs.org/pure-rand/-/pure-rand-8.4.2.tgz
Integrity: sha512-vvuOGgcuPJAirlHvuQw1TrOiw7ptaIXXmIbNuiNOY6lNGJJH49PQ1Kj4nd783nPdQhQdicgOjVI2yI/9BD6/Ng==
[email protected].0 | development | BSD-3-Clause
[email protected].1 | development | BSD-3-Clause
Lockfile path: node_modules/qs
Package: https://www.npmjs.com/package/qs/v/6.16.0
Archive: https://registry.npmjs.org/qs/-/qs-6.16.0.tgz
Integrity: sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==
Package: https://www.npmjs.com/package/qs/v/6.16.1
Archive: https://registry.npmjs.org/qs/-/qs-6.16.1.tgz
Integrity: sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==
[email protected] | runtime | MIT
Lockfile path: node_modules/quick-format-unescaped
Package: https://www.npmjs.com/package/quick-format-unescaped/v/4.0.4
licenses/npm-runtime-notices.txt
+4 -4
View File
@@ -1,7 +1,7 @@
REA third-party npm runtime copyright, license and NOTICE texts
Collected from integrity-verified locked npm archives. Release-specific supplements and upstream notice gaps are identified in their entries.
External engines are separately obtained; see THIRD_PARTY_NOTICES.md.
Runtime dependency fingerprint (SHA-256): 31bd2b9c5690c9d963d7dcf25da2fec9bc16a3d4724f661cf92489dd106fdbe1
Runtime dependency fingerprint (SHA-256): 09f8570cf168ddd3ad7c877dbcdd1ef5013de3af884a37fd27e6da3b99b49664
===== @babel/[email protected] =====
Declared license: MIT
@@ -3926,10 +3926,10 @@ FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.
===== [email protected].8 =====
===== [email protected].9 =====
Declared license: BSD-3-Clause
Archive: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz
Integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==
Archive: https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz
Integrity: sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==
Scope: npm runtime dependency, including optional platform packages.
--- package/LICENSE ---
package-lock.json
Generated
+6 -6
View File
@@ -7776,9 +7776,9 @@
}
},
"node_modules/fast-uri": {
"version": "3.1.8",
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
"integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
"version": "3.1.9",
"resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz",
"integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==",
"funding": [
{
"type": "github",
@@ -10729,9 +10729,9 @@
"license": "MIT"
},
"node_modules/qs": {
"version": "6.16.0",
"resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
"integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
"version": "6.16.1",
"resolved": "https://registry.npmjs.org/qs/-/qs-6.16.1.tgz",
"integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==",
"dev": true,
"license": "BSD-3-Clause",
"dependencies": {
package.json
+1 -1
View File
@@ -386,7 +386,7 @@
},
"overrides": {
"typed-rest-client": {
"qs": "6.16.0"
"qs": "6.16.1"
},
"vitepress": {
"vite": "6.4.4"
scripts/fixtures/http3-lab-requirements.txt
+3 -2
View File
@@ -1,7 +1,8 @@
# Exercised runtime graph: CPython 3.14.7, Linux x86_64 guest.
# Base runtime graph: CPython 3.14.7, Linux x86_64 guest.
# The certifi trust-store refresh has not been rerun in that guest.
aioquic==1.2.0
attrs==26.1.0
certifi==2026.7.22
certifi==2026.10.19
cffi==2.1.1
cryptography==50.0.2
pycparser==3.11