Skip to content

deps: bump brace-expansion, fast-uri, and @heroku/mcp-server - #3965

Merged
heroku-johnny merged 4 commits into
mainfrom
update-cli-deps-brace-fast-uri
Sep 30, 2026
Merged

deps: bump brace-expansion, fast-uri, and @heroku/mcp-server#3965
heroku-johnny merged 4 commits into
mainfrom
update-cli-deps-brace-fast-uri

Conversation

@heroku-johnny

@heroku-johnny heroku-johnny commented Sep 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Consolidates two stale Dependabot PRs (#3963, #3964) that couldn't rebase automatically after #3962 merged, and bumps @heroku/mcp-server to pick up two security-relevant bug fixes.

  • brace-expansion: 1.1.18 → 1.1.21 (lock file only — fixes GHSA-q2hr-2g5m-vwhr: quadratic-time DoS)
  • fast-uri: 3.1.7 → 3.1.8 (lock file only — fixes GHSA-hrr3-gc8f-f4qj: inconsistent host case normalization)
  • @heroku/mcp-server: 1.2.5 → 1.2.9 — picks up:
    • fix: quote flag and argument values in CommandBuilder (W-23972762)
    • fix: stop deploy packer from following out-of-root symlinks

Type of Change

Breaking Changes (major semver update)

  • Add a ! after your change type to denote a change that breaks current behavior

Feature Additions (minor semver update)

  • feat: Introduces a new feature to the codebase

Patch Updates (patch semver update)

  • fix: Bug fix
  • deps: Dependency upgrade
  • revert: Revert a previous commit
  • chore: Change that does not affect production code
  • refactor: Refactoring existing code without changing behavior
  • test: Add/update/remove tests

Testing

Steps:
Passing CI suffices.

Related Issues

GitHub issue: Closes #3963, Closes #3964
GUS work item: W-23972762 (mcp-server CommandBuilder quoting fix)

@heroku-johnny @claude
deps: bump brace-expansion to 1.1.21 and fast-uri to 3.1.8
44dee7a 
Security fixes — fast-uri 3.1.8 fixes GHSA-hrr3-gc8f-f4qj (inconsistent
host case normalization). Both are transitive dep lock file updates only.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@heroku-johnny
heroku-johnny requested a review from a team as a code owner September 30, 2026 22:38
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 22:38 — with GitHub Actions Active
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 22:38 — with GitHub Actions Active
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 22:38 — with GitHub Actions Active
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 22:38 — with GitHub Actions Active
@heroku-johnny heroku-johnny mentioned this pull request Sep 30, 2026
Closed
@github-actions github-actions Bot added the size/XS Extra small PR (code churn < 10) label Sep 30, 2026
@heroku-johnny heroku-johnny mentioned this pull request Sep 30, 2026
Closed
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 22:45 — with GitHub Actions Active
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 22:45 — with GitHub Actions Active
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 22:45 — with GitHub Actions Active
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 22:45 — with GitHub Actions Active
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 22:56 — with GitHub Actions Active
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 22:56 — with GitHub Actions Active
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 22:56 — with GitHub Actions Active
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 22:56 — with GitHub Actions Active
@heroku-johnny @claude
deps: bump @heroku/mcp-server from 1.2.5 to 1.2.9
6461b6c 
Picks up two bug fixes:
- 1.2.9: quote flag and argument values in CommandBuilder (W-23972762)
- 1.2.7: stop deploy packer from following out-of-root symlinks

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 23:10 — with GitHub Actions Active
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 23:10 — with GitHub Actions Active
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 23:10 — with GitHub Actions Active
@heroku-johnny
heroku-johnny deployed to AcceptanceTests September 30, 2026 23:10 — with GitHub Actions Active
@heroku-johnny heroku-johnny changed the title deps: bump brace-expansion to 1.1.21 and fast-uri to 3.1.8 deps: bump brace-expansion, fast-uri, and @heroku/mcp-server Sep 30, 2026
@heroku-johnny
heroku-johnny merged commit 93bea80 into main Sep 30, 2026
22 checks passed
@heroku-johnny
heroku-johnny deleted the update-cli-deps-brace-fast-uri branch September 30, 2026 23:24
@heroku-johnny heroku-johnny mentioned this pull request Oct 1, 2026
Merged
5 tasks done

This branch was successfully deployed

1 active deployment
AcceptanceTests — 6461b6c8 Deployed Sep 30, 2026 by heroku-johnny via integration (20.x, ubuntu-latest) #9385
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@eablack eablack eablack approved these changes

Assignees

No one assigned

Labels

size/XS Extra small PR (code churn < 10)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@heroku-johnny @eablack