Possible fix(deps): 4 vulnerable dependencies in package-lock.json

[begininvoke]

Spotted what might be an issue in manual/site/package-lock.json around line 3694.

fast-uri 3.1.5 double‑decodes percent‑encoded hostnames, allowing a maliciously crafted URL (e.g., //%25252e%25252e%25252e%25252e%25252e%25252e%25252e%25252e%25252e%25252e%25252e%25252e) to be normalized into a loopback address. This breaks RFC 3986, enabling server‑side request forgery (SSRF) and host‑policy bypass when the application normalizes or resolves untrusted URLs. The vulnerability is rated HIGH because it can be exploited without authentication to force the server to communicate with internal services. Upgrade to a non‑vulnerable version (≥ 3.1.6, ≥ 2.4.5, or ≥ 4.1.3) which normalises percent‑escapes only once.

Something like this might fix it:

*** Begin Patch
*** Update File: package.json
@@
-    "fast-uri": "3.1.5",
+    "fast-uri": "3.1.6",
*** End Patch
*** Begin Patch
*** Update File: package-lock.json
@@
-          "version": "3.1.5",
-          "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
-          "integrity": "sha512-...",
-          "requires": {
-            "...": "..."
-          }
+          "version": "3.1.6",
+          "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz",
+          "integrity": "sha512-...",
+          "requires": {
+            "...": "..."
+          }
*** End Patch

For reference: rule CVE-2026-75899. Rated high.

The suggested change is untested against this project, so please read it before applying it.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.