A dependency advisory, checked and closed
Full release on GitHub ↗What shipped
fast-uri is updated from 3.1.8 to 3.1.9 for an advisory about host confusion. The stdio server reaches it only through the MCP SDK’s validation of elicitation responses, and it never sends elicitation requests. The Worker does not depend on it at all.
Why it matters
Neither server was exposed, but upgrading keeps the advisory off the dependency tree.