Possible fix(deps): fast-uri 3.1.2 → 4.0.1, 3.1.3, 2.4.2 (CVE-2026-13676) in package-lock.json

[begininvoke]

I think there may be a problem in sideshow-term/package-lock.json around line 649.

fast-uri 3.1.2 does not correctly canonicalize Unicode (IDN) hostnames for HTTP URLs. An attacker can supply a URL with a non‑ASCII host that fast-uri treats as a different hostname than Node's built‑in URL parser, allowing bypass of host‑based security checks (e.g., deny‑lists, loopback filters, redirect validation). This can lead to unauthorized outbound connections or request forgery, which is why the CVE is rated HIGH.

Something like this might fix it:

*** Begin Patch
*** Update File: sideshow-term/package-lock.json
@@
-          "version": "3.1.2",
-          "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-          "integrity": "sha512-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
-          "requires": {
-            "some-dep": "^1.0.0"
-          }
+          "version": "3.1.3",
+          "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz",
+          "integrity": "sha512-INSERT_NEW_INTEGRITY_HASH_FOR_3.1.3",
+          "requires": {
+            "some-dep": "^1.0.0"
+          }
*** End Patch
*** End Patch

For reference: rule CVE-2026-13676. Rated high.

The suggested change is untested against this project, so please read it before applying it.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.