From 273449e7cec0b3c5005889b6305050b84a3ec3bb Mon Sep 17 00:00:00 2001
From: Jonathan Norris <jonathan.norris@dynatrace.com>
Date: Tue, 8 Sep 2026 10:22:40 -0400
Subject: [PATCH 1/4] chore: resolve open dependabot security alerts

- fast-uri 3.1.5 -> 3.1.7 (high, alerts #55, #56, #57, #58)
---
 package.json | 2 +-
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index 6652350..c0beb42 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
     "picomatch": "^2.3.2",
     "flatted": "^3.4.2",
     "minimatch": "^9.0.7",
-    "fast-uri": "^3.1.5",
+    "fast-uri": "^3.1.6",
     "js-yaml": "^4.3.1",
     "brace-expansion": "^2.1.2"
   }
diff --git a/yarn.lock b/yarn.lock
index d549350..af9a730 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -562,10 +562,10 @@ fast-levenshtein@^2.0.6:
   resolved "https://registry.yarnpkg.com/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz#3d8a5c66883a16a30ca8643e851f19baa7797917"
   integrity sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==
 
-fast-uri@^3.0.1, fast-uri@^3.1.5:
-  version "3.1.5"
-  resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.5.tgz#610f37419a030270430cecd68d74e3d4d96725d0"
-  integrity sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==
+fast-uri@^3.0.1, fast-uri@^3.1.6:
+  version "3.1.7"
+  resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.7.tgz#743157d957f3cbb4c65310e033dc2ad4ad7dc60a"
+  integrity sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==
 
 fastq@^1.6.0:
   version "1.20.1"

From c8ad87364bb52a17bc55fc96eb26dca74f270597 Mon Sep 17 00:00:00 2001
From: Jonathan Norris <jonathan.norris@dynatrace.com>
Date: Tue, 15 Sep 2026 13:32:00 +0200
Subject: [PATCH 2/4] chore: ignore .worktrees directory

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 4d8026b..2425e89 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@ utils/testsuite_helper/build
 .idea/
 *.wasm
 *.wat
+.worktrees/

From c41d38a918f605f626be1fcb3e490e3f1a631351 Mon Sep 17 00:00:00 2001
From: Jonathan Norris <jonathan.norris@dynatrace.com>
Date: Tue, 15 Sep 2026 13:32:02 +0200
Subject: [PATCH 3/4] chore: resolve open dependabot security alerts

- js-yaml 4.3.1 -> 4.3.2 (high, alert #59)
---
 package.json | 2 +-
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index c0beb42..fdfdac5 100644
--- a/package.json
+++ b/package.json
@@ -30,7 +30,7 @@
     "flatted": "^3.4.2",
     "minimatch": "^9.0.7",
     "fast-uri": "^3.1.6",
-    "js-yaml": "^4.3.1",
+    "js-yaml": "^4.3.2",
     "brace-expansion": "^2.1.2"
   }
 }
diff --git a/yarn.lock b/yarn.lock
index af9a730..b7e2aa9 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -757,10 +757,10 @@ isobject@^2.0.0:
   dependencies:
     isarray "1.0.0"
 
-js-yaml@^4.1.0, js-yaml@^4.3.1:
-  version "4.3.1"
-  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.1.tgz#01216c001d67f48e2cd560d708c7af21090a3848"
-  integrity sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==
+js-yaml@^4.1.0, js-yaml@^4.3.2:
+  version "4.3.2"
+  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.2.tgz#8e44fb14a2643c59726bb15787b5f1512cb3d3fb"
+  integrity sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==
   dependencies:
     argparse "^2.0.1"
 

From 8bbd14754ef34d55fb1d50b9f0f438d7837f3aec Mon Sep 17 00:00:00 2001
From: Jonathan Norris <jonathan.norris@dynatrace.com>
Date: Tue, 15 Sep 2026 13:38:52 +0200
Subject: [PATCH 4/4] chore: tighten fast-uri resolution to ^3.1.7

Address Copilot review feedback: ^3.1.6 still permitted the vulnerable
3.1.6 release; ^3.1.7 guarantees the patched version.
---
 package.json | 2 +-
 yarn.lock    | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package.json b/package.json
index fdfdac5..53ef427 100644
--- a/package.json
+++ b/package.json
@@ -29,7 +29,7 @@
     "picomatch": "^2.3.2",
     "flatted": "^3.4.2",
     "minimatch": "^9.0.7",
-    "fast-uri": "^3.1.6",
+    "fast-uri": "^3.1.7",
     "js-yaml": "^4.3.2",
     "brace-expansion": "^2.1.2"
   }
diff --git a/yarn.lock b/yarn.lock
index b7e2aa9..e0d5091 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -562,10 +562,10 @@ fast-levenshtein@^2.0.6:
   resolved "https://registry.yarnpkg.com/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz#3d8a5c66883a16a30ca8643e851f19baa7797917"
   integrity sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==
 
-fast-uri@^3.0.1, fast-uri@^3.1.6:
-  version "3.1.7"
-  resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.7.tgz#743157d957f3cbb4c65310e033dc2ad4ad7dc60a"
-  integrity sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==
+fast-uri@^3.0.1, fast-uri@^3.1.7:
+  version "3.1.8"
+  resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.8.tgz#f7db8d942e20eead3cfe93b0beeb4eb0169e938b"
+  integrity sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==
 
 fastq@^1.6.0:
   version "1.20.1"