🚨 Security: Critical or high vulnerabilities in notion container

🚨 Security Scan Alert

A periodic security scan found fixable critical or high severity vulnerabilities in the container image. Findings at this level also block publishing in the build workflow.

• Image: ghcr.io/stacklok/dockyard/npx/notion:2.5.1
• Critical vulnerabilities: 0
• High vulnerabilities: 4

Details

See the Security tab for full details.

High Vulnerabilities

• GHSA-5jgf-p345-68v8 in fast-uri@3.1.5: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-jqff-g426-hqxp in fast-uri@3.1.5: fast-uri vulnerable to host confusion via percent-encoded scheme normalization
• GHSA-f65p-4m7j-42xc in fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
• GHSA-fph4-wmhf-6fwf in fast-uri@3.1.5: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding

Automated security scan from periodic-security-scan workflow

Start with the periodic-security-scan workflow and the Security tab findings for ghcr.io/stacklok/dockyard/npx/notion:2.5.1. Trace where fast-uri@3.1.5 enters the notion container and determine the supported dependency update path. Done means the four high-severity findings are resolved and the build workflow no longer blocks publishing.