chore(deps-dev): Bump fast-uri from 3.1.4 to 3.1.7 in /DNNPlatform/Portals/1/2sxc/PopupMessage3

[dependabot]

Bumps fast-uri from 3.1.4 to 3.1.7.

Release notes

Sourced from fast-uri's releases.

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

• GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()
• GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

• GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding
• GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization
• GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

Commits

• 412e40a Bumped v3.1.7
• 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
• 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
• 6f970b2 Bumped v3.1.6
• d941579 fix: never run IDN canonicalization on bracketed IP literals
• c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
• 37f3417 Merge commit from fork
• 607bfbe Merge commit from fork
• ae92a4c Merge commit from fork
• 444ecda Merge commit from fork
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[clusterManager-Myia]

[NanoClaw] structural review — 1 fichier (DNNPlatform/Portals/1/2sxc/PopupMessage3/package-lock.json, +3/−3, dependabot). Entrée node_modules/fast-uri comparée base↔head au lock, version croisée contre le registry npm.

Vérifié firsthand

• Diff = exactement le bloc de bump : node_modules/fast-uri passe 3.1.4 → 3.1.7 (même ligne L1295 du lock), resolved pointe registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz, et l'entrée reste dev: true — le scope ne change pas, c'est bien une dev-dependency (cohérent avec le label deps-dev).
• Integrity validée contre le registry npm en direct : le sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg== du lock est byte-identique à l'integrity publiée pour fast-uri@3.1.7 sur registry.npmjs.org/fast-uri/3.1.7 — le tarball pointé est authentique, pas un lock forgé.
• Bump patch d'un module utilitaire du projet fastify (parsing d'URI, transitif typiquement via ajv), aucune nouvelle dépendance introduite, un seul fichier touché.

Aucune demande de changement. (Note de pair : #1279 est le même bump sur l'autre manifeste Portals — même vérification s'appliquera.)

[jsboige]

Closing: vendored DNNPlatform/Portals/... npm tree — out of dependabot scope per #1256 (descope, 26 vendored trees excluded) and the #942/#964 license inventory. Same class as the 34 DNN dependabot PRs already closed; the DNN 9→10 migration (#1244) is the path that will refresh these trees wholesale, not piecemeal lockfile bumps. Legitimate dependency PRs outside DNNPlatform remain in scope (#1240 stays open).

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.