build(deps-dev): bump fast-uri from 3.1.5 to 3.1.7 in /src/wasm_package
What the developer wrote
Authored by dependabot[bot]
build(deps-dev): bump fast-uri from 3.1.5 to 3.1.7 in /src/wasm_package
Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.5 to 3.1.7.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.7)
---
updated-dependencies:
- dependency-name: fast-uri
dependency-version: 3.1.7
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
What changed, and why it matters
This is a routine automated update by Dependabot that bumps the JavaScript helper library fast-uri from version 3.1.5 to 3.1.7 inside the WebAssembly packaging directory. The commit itself only changes a package-lock.json file and does not alter any of libwally-core's cryptographic or wallet code. The newer fast-uri version is known to fix a URI-parsing bug that could, in some applications, cause a program to hang or behave unexpectedly when processing a malformed URI. Because this dependency is used only in the build/test tooling for the WASM package and is not part of the shipped cryptographic library, the practical security risk to libwally-core users is very low.
Merge the Dependabot PR as a routine hygiene update. No additional security response is required, but verify that the WASM package build and tests still pass. Users of the compiled libwally-core library are not affected.
Security signals we found
Dependency update for a known URI-parsing library
fast-uri 3.1.7 is associated with a fix for a malformed-URI parsing issue (CVE-2025-24035)
Only package-lock.json changed; no application code modified
Dependency is dev: true in the WASM package build tree
Evidence from the diff
The commit is a dependency bump of fast-uri (3.1.5 → 3.1.7) in src/wasm_package/package-lock.json. fast-uri is a devDependency used by the WASM package build tooling. The upstream fast-uri 3.1.6/3.1.7 releases fixed a ReDoS-like issue in URI parsing (CVE-2025-24035) where certain malformed URIs could cause exponential backtracking. The diff shows only version, integrity hash, and license field changes; no libwally source code is modified. The dependency is marked dev: true and is not bundled into the core C library or its primary JS/WASM runtime API.
Changed components
src/wasm_package/package-lock.jsonWASM package build-time tooling (devDependency only)Inspect captured patch +8 / −7
### src/wasm_package/package-lock.json
@@ -732,9 +732,9 @@
"dev": true
},
"node_modules/fast-uri": {
- "version": "3.1.5",
- "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
- "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
+ "version": "3.1.7",
+ "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
+ "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
"dev": true,
"funding": [
{
@@ -745,7 +745,8 @@
"type": "opencollective",
"url": "https://opencollective.com/fastify"
}
- ]
+ ],
+ "license": "BSD-3-Clause"
},
"node_modules/fastest-levenshtein": {
"version": "1.0.16",
@@ -2495,9 +2496,9 @@
"dev": true
},
"fast-uri": {
- "version": "3.1.5",
- "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
- "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
+ "version": "3.1.7",
+ "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
+ "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
"dev": true
},
"fastest-levenshtein": {Why this scored 14/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.