@openclaw/lobster 2026.6.33 → 2026.6.34

package/node_modules/fast-uri/.github/dependabot.yml

@@ -2,12 +2,52 @@ version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
-      interval: "monthly"
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
     open-pull-requests-limit: 10
 
   - package-ecosystem: "npm"
     directory: "/"
+    commit-message:
+      # Prefix all commit messages with "chore: "
+      prefix: "chore"
     schedule:
-      interval: "monthly"
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    versioning-strategy: "increase-if-necessary"
+    allow:
+      - dependency-name: "*"
+        update-types:
+          - "version-update:semver-major"
+    ignore:
+      # TODO: remove ignore until neostandard support ESLint 10
+      - dependency-name: "eslint"
+      - dependency-name: "neostandard"
+      - dependency-name: "@stylistic/*"
     open-pull-requests-limit: 10
+    groups:
+      # Production dependencies with breaking changes
+      dependencies:
+        dependency-type: "production"
+      # ESLint related dependencies
+      dev-dependencies-eslint:
+        patterns:
+          - "eslint"
+          - "neostandard"
+          - "@stylistic/*"
+      # TypeScript related dependencies
+      dev-dependencies-typescript:
+        patterns:
+          - "@types/*"
+          - "tstyche"
+          - "typescript"

package/node_modules/fast-uri/.github/workflows/ci.yml

@@ -23,17 +23,65 @@ permissions:
   contents: read
 
 jobs:
+  type-tests:
+    name: Type Tests
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: ['20', '22', '24', '26']
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+          cache-dependency-path: package.json
+          check-latest: true
+
+      - name: Install dependencies
+        run: npm install --ignore-scripts
+
+      - name: Run type tests
+        run: npm run test:typescript
+
+  unit-tests:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: ['16', '18', '20', '22', '24', '26']
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+          cache-dependency-path: package.json
+          check-latest: true
+
+      - name: Install dependencies
+        run: npm install --ignore-scripts
+
+      - name: Run unit tests
+        run: npm test
+
   test-regression-check-node10:
     name: Test compatibility with Node.js 10
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '10'
           cache: 'npm'
@@ -71,11 +119,11 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
           cache: 'npm'
@@ -99,8 +147,8 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v6
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@2073dc8e1f9e172bf42daa3843c9dbd31af1e8cb # v6.0.0
     with:
       license-check: true
       lint: true
-      node-versions: '["16", "18", "20", "22", "24"]'
+      node-versions: '["16", "18", "20", "22", "24", "26"]'

package/node_modules/fast-uri/.github/workflows/lock-threads.yml

@@ -16,4 +16,4 @@ jobs:
     permissions:
       issues: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/lock-threads.yml@v6
+    uses: fastify/workflows/.github/workflows/lock-threads.yml@2073dc8e1f9e172bf42daa3843c9dbd31af1e8cb # v6.0.0

package/node_modules/fast-uri/.github/workflows/ossf-scorecard.yml

@@ -0,0 +1,45 @@
+name: OSSF Scorecard Analysis
+
+# **What it does**: Runs OSSF Scorecard analysis on the repository and uploads the results.
+# **Why we have it**: Security scanning.
+
+on:
+    branch_protection_rule:
+    push:
+        branches:
+            - main
+        paths-ignore:
+            - "docs/**"
+            - "*.md"
+    schedule:
+        #        ┌───────────── minute (0 - 59)
+        #        │  ┌───────────── hour (0 - 23)
+        #        │  │ ┌───────────── day of the month (1 - 31)
+        #        │  │ │ ┌───────────── month (1 - 12 or JAN-DEC)
+        #        │  │ │ │ ┌───────────── day of the week (0 - 6 or SUN-SAT)
+        #        │  │ │ │ │
+        #        │  │ │ │ │
+        #        │  │ │ │ │
+        #        *  * * * *
+        - cron: "21 17 * * 0"
+    # Allows this workflow to be run manually from the Actions tab
+    workflow_dispatch:
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+    group: "${{ github.workflow }}-${{ github.event.pull_request.head.label || github.head_ref || github.ref }}"
+    cancel-in-progress: true
+
+permissions:
+    contents: read
+
+jobs:
+    analysis:
+        name: OSSF Scorecard Analysis
+        permissions:
+            contents: read
+            id-token: write
+            security-events: write
+        uses: fastify/workflows/.github/workflows/reusable-ossf-scorecard.yml@ef591e2186785d5ab36b9fe6a79c7ce2f1d94e57 #v7.0.0
+        with:
+            publish_results: true

package/node_modules/fast-uri/README.md

@@ -3,6 +3,7 @@
 [![NPM version](https://img.shields.io/npm/v/fast-uri.svg?style=flat)](https://www.npmjs.com/package/fast-uri)
 [![CI](https://github.com/fastify/fast-uri/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/fastify/fast-uri/actions/workflows/ci.yml)
 [![neostandard javascript style](https://img.shields.io/badge/code_style-neostandard-brightgreen?style=flat)](https://github.com/neostandard/neostandard)
+[![OSSF Scorecard](https://api.scorecard.dev/projects/github.com/fastify/fast-uri/badge)](https://scorecard.dev/viewer/?uri=github.com/fastify/fast-uri)
 
 Dependency-free RFC 3986 URI toolbox.
 
@@ -27,10 +28,10 @@ Malformed authorities and out-of-range ports are reported through the parsed com
 	If set to `true`, the serializer will not resolve a relative `path` component.
 
 *	`unicodeSupport` (boolean, false)
-	If set to `true`, the parser will unescape non-ASCII characters in the parsed output as per [RFC 3987](http://www.ietf.org/rfc/rfc3987.txt).
+	If set to `true`, the parser will unescape non-ASCII characters in the parsed output as per [RFC 3987](https://www.ietf.org/rfc/rfc3987.txt).
 
 *	`domainHost` (boolean, false)
-	If set to `true`, the library will treat the `host` component as a domain name, and convert IDNs (International Domain Names) as per [RFC 5891](http://www.ietf.org/rfc/rfc5891.txt).
+	If set to `true`, the library will treat the `host` component as a domain name, and convert IDNs (International Domain Names) as per [RFC 5891](https://www.ietf.org/rfc/rfc5891.txt).
 
 ### Parse
 
@@ -90,14 +91,14 @@ true
 
 ## Scheme supports
 
-fast-uri supports inserting custom [scheme](http://en.wikipedia.org/wiki/URI_scheme)-dependent processing rules. Currently, fast-uri has built-in support for the following schemes:
+fast-uri supports inserting custom [scheme](https://en.wikipedia.org/wiki/URI_scheme)-dependent processing rules. Currently, fast-uri has built-in support for the following schemes:
 
-*	http \[[RFC 2616](http://www.ietf.org/rfc/rfc2616.txt)\]
-*	https \[[RFC 2818](http://www.ietf.org/rfc/rfc2818.txt)\]
-*	ws \[[RFC 6455](http://www.ietf.org/rfc/rfc6455.txt)\]
-*	wss \[[RFC 6455](http://www.ietf.org/rfc/rfc6455.txt)\]
-*	urn \[[RFC 2141](http://www.ietf.org/rfc/rfc2141.txt)\]
-*	urn:uuid \[[RFC 4122](http://www.ietf.org/rfc/rfc4122.txt)\]
+*	http \[[RFC 2616](https://www.ietf.org/rfc/rfc2616.txt)\]
+*	https \[[RFC 2818](https://www.ietf.org/rfc/rfc2818.txt)\]
+*	ws \[[RFC 6455](https://www.ietf.org/rfc/rfc6455.txt)\]
+*	wss \[[RFC 6455](https://www.ietf.org/rfc/rfc6455.txt)\]
+*	urn \[[RFC 2141](https://www.ietf.org/rfc/rfc2141.txt)\]
+*	urn:uuid \[[RFC 4122](https://www.ietf.org/rfc/rfc4122.txt)\]
 
 
 ## Benchmarks

package/node_modules/fast-uri/SECURITY.md

@@ -0,0 +1,168 @@
+# Security Policy
+
+This document describes the management of vulnerabilities for `fast-uri`, an
+official Fastify project package. It supplements the Fastify project's
+[organization-wide security policy](https://github.com/fastify/.github/blob/main/SECURITY.md).
+
+## Standards and scope
+
+`fast-uri` implements URI parsing and normalization according to
+[RFC 3986](https://www.rfc-editor.org/rfc/rfc3986). It does not implement the
+[WHATWG URL Standard](https://url.spec.whatwg.org/).
+
+Differences between `fast-uri` and WHATWG URL implementations are expected.
+Reports based on comparing or mixing parsers that follow these different
+standards are out of scope. Applications must use the same parsing and
+normalization rules for both security decisions and subsequent URI use.
+
+## Threat model
+
+`fast-uri`'s threat model extends the
+[Node.js threat model](https://github.com/nodejs/node/blob/main/SECURITY.md#the-nodejs-threat-model).
+
+**Trusted:** Application code, parser options, configuration, and the runtime
+environment.
+
+**Untrusted:** URI and IRI strings passed to the package's public APIs.
+
+### Examples of vulnerabilities
+
+- RFC 3986 parsing or normalization flaws that bypass security controls
+- Denial of service through malformed input
+- Inconsistent parsing or normalization between `fast-uri` APIs
+
+### Examples of non-vulnerabilities
+
+The following are **not** considered vulnerabilities in `fast-uri`:
+
+- **Different URL standards:** Differences between RFC 3986 behavior and
+  WHATWG URL behavior, including differences exposed by mixing parsers that
+  implement those standards
+- **Unsupported scheme semantics:** Scheme-specific behavior for schemes that
+  `fast-uri` does not document as supported
+- **Application code vulnerabilities:** Security flaws in code that consumes
+  `fast-uri` output
+- **Configuration mistakes:** Security issues caused by incorrect parser
+  options or application configuration
+- **Missing security features:** Application-level protections that are not
+  part of URI parsing or normalization
+- **Third-party dependencies:** Vulnerabilities in packages used by an
+  application alongside `fast-uri`
+
+## Reporting vulnerabilities
+
+Individuals who find potential vulnerabilities in `fast-uri` are invited to
+complete a vulnerability report via the
+[GitHub Security page][advisory].
+
+Do not assign or request a CVE directly.
+CVE assignment is handled by the Fastify Security Team.
+Fastify falls under the [OpenJS CNA](https://cna.openjsf.org/).
+A CVE will be assigned as part of our responsible disclosure process.
+
+> [!NOTE]
+> Fastify's [HackerOne](https://hackerone.com/fastify) program is now closed.
+
+[advisory]: ../../security/advisories/new
+
+### Strict measures when reporting vulnerabilities
+
+It is of the utmost importance that you read carefully and follow these
+guidelines to ensure the ecosystem as a whole is not disrupted due to
+improperly reported vulnerabilities:
+
+- Avoid creating new "informative" reports. Only create a new report if you are
+  confident the issue is an actual vulnerability. Third-party vendors and
+  individuals track new GitHub security reports and may flag them for their
+  customers.
+- Security reports should never be created and triaged by the same person. A
+  second Security Team member must triage a report submitted by a team member
+  or on their behalf. If in doubt, invite more Fastify collaborators to help
+  review the report.
+- **Do not** attempt to demonstrate CI/CD vulnerabilities by creating pull
+  requests in Fastify organization repositories. Doing so will result in a
+  [content report][content-report] to GitHub as an unsolicited exploit. Create
+  a separate repository configured like the affected repository and provide
+  the proof of concept there instead.
+
+[content-report]: https://docs.github.com/en/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam#reporting-an-issue-or-pull-request
+
+### Vulnerabilities found outside this process
+
+The Fastify project does not support vulnerability reporting outside the
+process described in this document.
+
+## Handling vulnerability reports
+
+When a potential vulnerability is reported, the following actions are taken.
+
+### Triage
+
+**Delay:** 4 business days
+
+Within 4 business days, a member of the Security Team provides a first response
+to the reporter. The possible responses are:
+
+- **Acceptance:** The report is considered a new vulnerability.
+- **Rejection:** The report is not considered a new vulnerability.
+- **Need more information:** The Security Team needs more information to
+  evaluate the report.
+
+Triaging should include updating these issue fields:
+
+- Asset: set or create the module affected by the report
+- Severity: TBD, initially left empty
+
+### Correction follow-up
+
+**Delay:** 90 days
+
+When a vulnerability is confirmed, a member of the Security Team volunteers to
+follow up on the report.
+
+With the reporter's help, they contact the maintainers of the vulnerable
+package and may invite them as participants in the report. Together, they
+define a publication date. Ideally, publication should not happen before the
+package has been patched.
+
+The report's vulnerable-version upper limit should be set to:
+
+- `*` if no fixed version is available when the report is published
+- the last vulnerable version, such as `<=1.2.3`, if the fix is released in
+  `1.2.4`
+
+### Publication
+
+**Delay:** 90 days
+
+Within 90 days after triage, the vulnerability must be made public.
+
+Vulnerability severity is assessed using
+[CVSS v3](https://www.first.org/cvss/user-guide).
+
+If package maintainers are actively developing a patch, the Security Team and
+the reporter may approve an additional delay.
+
+### Secondary contact
+
+If you do not receive an acknowledgment within 6 business days, or cannot find
+a private security contact, contact the OpenJS Foundation CNA at
+<https://cna.openjsf.org/> or `security@lists.openjsf.org` for assistance.
+
+The CNA can help ensure that reports are acknowledged, coordinate disclosure
+timelines, and assign CVEs when necessary.
+
+## The Fastify Security Team
+
+The core team manages the security program, policy, and process.
+
+Team members must keep all privileged information private. This includes the
+existence of undisclosed issues, expected release dates, and upcoming patches.
+
+### Members
+
+- [Matteo Collina](https://github.com/mcollina)
+- [Tomas Della Vedova](https://github.com/delvedor)
+- [Vincent Le Goff](https://github.com/zekth)
+- [KaKa Ng](https://github.com/climba03003)
+- [James Sumners](https://github.com/jsumners)

package/node_modules/fast-uri/benchmark/encoder.mjs

@@ -0,0 +1,54 @@
+import { Bench } from 'tinybench'
+import { fastUri } from '../index.js'
+
+const { serialize, normalize, parse } = fastUri
+
+const asciiPath = '/users/profile/settings/account'
+const asciiPathWithSpaces = '/users/john doe/profile page'
+const cjkPath = '/ユーザー/プロフィール/設定'
+const mixedPath = '/users/日本/profile-📱-emoji/設定'
+const emojiPath = '/🚀/🌍/🎉/end'
+const longAsciiPath = '/' + 'a/b/c/d/e/f/g/h/'.repeat(20)
+const longUtf8Path = '/' + '日本/中文/한국/'.repeat(20)
+
+const bench = new Bench({ name: 'encoder bench', time: 1000 })
+
+bench.add('serialize ascii path', () => {
+  serialize({ scheme: 'http', host: 'example.com', path: asciiPath })
+})
+
+bench.add('serialize ascii path with spaces', () => {
+  serialize({ scheme: 'http', host: 'example.com', path: asciiPathWithSpaces })
+})
+
+bench.add('serialize cjk path', () => {
+  serialize({ scheme: 'http', host: 'example.com', path: cjkPath })
+})
+
+bench.add('serialize mixed path', () => {
+  serialize({ scheme: 'http', host: 'example.com', path: mixedPath })
+})
+
+bench.add('serialize emoji path', () => {
+  serialize({ scheme: 'http', host: 'example.com', path: emojiPath })
+})
+
+bench.add('serialize long ascii path', () => {
+  serialize({ scheme: 'http', host: 'example.com', path: longAsciiPath })
+})
+
+bench.add('serialize long utf8 path', () => {
+  serialize({ scheme: 'http', host: 'example.com', path: longUtf8Path })
+})
+
+bench.add('normalize utf8 uri', () => {
+  normalize('http://example.com/日本/profile')
+})
+
+bench.add('parse utf8 uri', () => {
+  parse('http://example.com/日本/profile')
+})
+
+await bench.run()
+console.log(bench.name)
+console.table(bench.table())

package/node_modules/fast-uri/index.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require('./lib/utils')
+const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, normalizeQueryFragmentEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require('./lib/utils')
 const { SCHEMES, getSchemeHandler } = require('./lib/schemes')
 
 /**
@@ -26,7 +26,12 @@ function normalize (uri, options) {
  */
 function resolve (baseURI, relativeURI, options) {
   const schemelessOptions = options ? Object.assign({ scheme: 'null' }, options) : { scheme: 'null' }
-  const resolved = resolveComponent(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true)
+  const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions)
+  const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions)
+  if (baseMalformed || relativeMalformed) {
+    throw new Error(baseParsed.error || relativeParsed.error || 'URI is malformed.')
+  }
+  const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true)
   schemelessOptions.skipEscape = true
   return serialize(resolved, schemelessOptions)
 }
@@ -202,6 +207,19 @@ function serialize (cmpts, opts) {
 
 const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u
 
+// Captures the authority component (between "//" and the next "/", "?" or "#"),
+// with or without a scheme prefix, for the literal-backslash rejection below.
+const AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/
+
+// Captures the leading authority-introducer region after an optional scheme: a
+// run of forward slashes, backslashes, and the characters the WHATWG URL parser
+// removes before parsing (TAB U+0009, LF U+000A, CR U+000D). A valid introducer
+// is exactly "//". Node treats "\" as "/" on special schemes and strips those
+// characters first, so forms like "\\", "/\", "\/", "/<TAB>/", or a leading
+// "<TAB>//" reach an authority in Node while fast-uri's URI_PARSE folds them into
+// the path group (host confusion / SSRF / redirect bypass).
+const AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/
+
 /**
  * @param {import('./types/index').URIComponent} parsed
  * @param {RegExpMatchArray} matches
@@ -248,11 +266,46 @@ function parseWithStatus (uri, opts) {
     }
   }
 
+  // A literal backslash (U+005C) is not a valid RFC 3986 URI character and is
+  // not an authority delimiter. Reject it in the authority rather than
+  // rewriting it: normalizing "\" -> "/" (WHATWG error recovery) could silently
+  // change the resource identified by an otherwise-invalid input, and lets "\"
+  // act as a host delimiter here while Node's native URL parses a different
+  // host (SSRF / redirect / origin-allowlist bypass). Percent-encoded %5C is
+  // untouched and remains valid encoded data.
+  const authorityMatch = uri.match(AUTHORITY_PREFIX)
+  if (authorityMatch !== null && authorityMatch[1].indexOf('\\') !== -1) {
+    parsed.error = 'URI authority must not contain a literal backslash.'
+    malformedAuthorityOrPort = true
+  }
+
+  // Reject a malformed or whitespace-smuggled authority introducer. fast-uri
+  // only recognizes a literal "//"; anything else in the leading separator run
+  // (a backslash, or a "//" that appears only after removing the TAB/LF/CR that
+  // Node strips) means the authority fast-uri parses differs from the one Node's
+  // URL resolves. Reject rather than rewrite, mirroring the literal-backslash
+  // guard above. Percent-encoded forms (%5C, %09) are untouched, valid data.
+  const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION)
+  if (introducerMatch !== null) {
+    const region = introducerMatch[1]
+    const normalizedRegion = region.replace(/[\t\n\r]/g, '')
+    // Two or more leading separators introduce an authority.
+    if (normalizedRegion.length >= 2) {
+      if (normalizedRegion.slice(0, 2) !== '//') {
+        parsed.error = parsed.error || 'URI authority must not contain a literal backslash.'
+        malformedAuthorityOrPort = true
+      } else if (region.length !== normalizedRegion.length) {
+        parsed.error = parsed.error || 'URI authority introducer must not contain whitespace.'
+        malformedAuthorityOrPort = true
+      }
+    }
+  }
+
   const matches = uri.match(URI_PARSE)
 
   if (matches) {
     // store each component
-    parsed.scheme = matches[1]
+    parsed.scheme = matches[1] === undefined ? undefined : matches[1].toLowerCase()
     parsed.userinfo = matches[3]
     parsed.host = matches[4]
     parsed.port = parseInt(matches[5], 10)
@@ -305,7 +358,7 @@ function parseWithStatus (uri, opts) {
       if (parsed.host && (options.domainHost || (schemeHandler && schemeHandler.domainHost)) && isIP === false && nonSimpleDomain(parsed.host)) {
         // convert Unicode IDN -> ASCII IDN
         try {
-          parsed.host = URL.domainToASCII(parsed.host.toLowerCase())
+          parsed.host = new URL('http://' + parsed.host).hostname
         } catch (e) {
           parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e
         }
@@ -325,12 +378,11 @@ function parseWithStatus (uri, opts) {
       if (parsed.path) {
         parsed.path = normalizePathEncoding(parsed.path)
       }
+      if (parsed.query) {
+        parsed.query = normalizeQueryFragmentEncoding(parsed.query)
+      }
       if (parsed.fragment) {
-        try {
-          parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment))
-        } catch {
-          parsed.error = parsed.error || 'URI malformed'
-        }
+        parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment)
       }
     }