chore(deps): update dependency decode-uri-component to v0.5.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
decode-uri-component	0.2.2 → 0.5.0

---

decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

CVE-2026-45822 / GHSA-vcc3-ghjq-m6fr

More information

Details

Impact

An attacker who can supply input to decodeUriComponent() (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote code execution impact.

Patches

Upgrade to decode-uri-component@0.5.0.

Workarounds

Limit the size of the input.

Severity

• CVSS Score: 6.6 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

References

• https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-vcc3-ghjq-m6fr
• https://nvd.nist.gov/vuln/detail/CVE-2026-45822
• https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005
• https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js
• https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.0
• https://www.npmjs.com/package/decode-uri-component
• https://github.com/advisories/GHSA-vcc3-ghjq-m6fr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

SamVerschueren/decode-uri-component (decode-uri-component)

v0.5.0

Compare Source

v0.4.1

Compare Source

• Add TypeScript type definitions c345b4c

v0.4.0

Compare Source

• Require Node.js 14 and move to ESM (#​11) b09e39d

v0.3.0

Compare Source

• Do not decode + to a space - fixes #​3 3bbc879

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: @material-ui/core@4.9.14
npm error Found: react@17.0.2
npm error node_modules/react
npm error   react@"17.0.2" from the root project
npm error   peer react@"17.0.2" from @hot-loader/react-dom@17.0.2
npm error   node_modules/@hot-loader/react-dom
npm error     dev @hot-loader/react-dom@"17.0.2" from the root project
npm error   11 more (@testing-library/react, gatsby, gatsby-link, ...)
npm error
npm error Could not resolve dependency:
npm error peer react@"^16.8.0" from @material-ui/core@4.9.14
npm error node_modules/@material-ui/core
npm error   @material-ui/core@"4.9.14" from the root project
npm error   peer @material-ui/core@"^4.0.0" from @material-ui/icons@4.9.1
npm error   node_modules/@material-ui/icons
npm error     @material-ui/icons@"4.9.1" from the root project
npm error   1 more (@material-ui/lab)
npm error
npm error Conflicting peer dependency: react@16.14.0
npm error node_modules/react
npm error   peer react@"^16.8.0" from @material-ui/core@4.9.14
npm error   node_modules/@material-ui/core
npm error     @material-ui/core@"4.9.14" from the root project
npm error     peer @material-ui/core@"^4.0.0" from @material-ui/icons@4.9.1
npm error     node_modules/@material-ui/icons
npm error       @material-ui/icons@"4.9.1" from the root project
npm error     1 more (@material-ui/lab)
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-09-03T01_06_07_596Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-03T01_06_07_596Z-debug-0.log