🚨 Security: Critical or high vulnerabilities in next-devtools-mcp container

🚨 Security Scan Alert

A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.

• Image: ghcr.io/stacklok/dockyard/npx/next-devtools-mcp:0.4.0
• Critical vulnerabilities: 0
• High vulnerabilities: 4

Details

See the Security tab for full details.

High Vulnerabilities

• GHSA-5jgf-p345-68v8 in fast-uri@3.1.5: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-jqff-g426-hqxp in fast-uri@3.1.5: fast-uri vulnerable to host confusion via percent-encoded scheme normalization
• GHSA-f65p-4m7j-42xc in fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
• GHSA-fph4-wmhf-6fwf in fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

Automated security scan from periodic-security-scan workflow

Start with the periodic-security-scan workflow and inspect the Security tab for the dependency path and remediation details for fast-uri@3.1.5 in the next-devtools-mcp image. Update the relevant dependency or image inputs, then verify that the scan reports no fixable high vulnerabilities and the build workflow can publish the image.