🚨 Security: Critical or high vulnerabilities in tavily-mcp container

🚨 Security Scan Alert

A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.

• Image: ghcr.io/stacklok/dockyard/npx/tavily-mcp:0.2.22
• Critical vulnerabilities: 0
• High vulnerabilities: 4

Details

See the Security tab for full details.

High Vulnerabilities

• GHSA-5jgf-p345-68v8 in fast-uri@3.1.5: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-jqff-g426-hqxp in fast-uri@3.1.5: fast-uri vulnerable to host confusion via percent-encoded scheme normalization
• GHSA-f65p-4m7j-42xc in fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
• GHSA-fph4-wmhf-6fwf in fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

Automated security scan from periodic-security-scan workflow

Start with the Security tab findings for ghcr.io/stacklok/dockyard/npx/tavily-mcp:0.2.22 and inspect the periodic-security-scan workflow to locate how this image and its fast-uri dependency are built. Determine the available dependency or image update path, then verify that the four high-severity findings are resolved and the publishing workflow is no longer blocked.