chore(deps): move the fast-uri floor to 3.1.6 for four more advisories

[btravers]

Security Audit is red on main here — and therefore on #8 and anything else open — with four advisories published into the same parser since the last bump:

• GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp — ReDoS and parsing confusion in fast-uri below 3.1.6.

Same path this override already existed for: @commitlint/cli → ajv, dev tooling only.

The existing entry's floor moves rather than a second entry being added — two overlapping ranges for one package is how a floor stops applying without anybody noticing (in the sibling repo I tried the second-entry form first and pnpm resolved the older pin, still vulnerable).

3.1.6 published 2026-08-23, so it clears minimumReleaseAge: 10080 comfortably. pnpm audit --audit-level=high → No known vulnerabilities found; node scripts/validate.mjs green.

Merging this unblocks #8.

https://claude.ai/code/session_01GGixjxi5AQ2cNK62bBymfF

Summary by CodeRabbit

• Chores
  • Updated a transitive dependency version to address additional security advisories related to regular-expression denial-of-service and parsing-confusion vulnerabilities.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 1553297b-2316-4d9e-a96e-d5c08b850c39

📥 Commits

Reviewing files that changed from the base of the PR and between 219795e and 14eafca.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

Included review availability: Your plan provides up to 8 included reviews per hour; 4 remain after this review.

---

📝 Walkthrough

Walkthrough

The workspace raises the transitive fast-uri override from 3.1.5 to 3.1.6 and updates the related advisory comments.

Changes

Dependency security update

Layer / File(s)	Summary
Update fast-uri override and advisories pnpm-workspace.yaml	The override floor changes to 3.1.6. The comments document five related advisories and the updated publication date.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 14eaf

This localized dependency-floor and lockfile update addresses the reported fast-uri advisories, with the supplied audit and validation checks passing. No actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the main change: raising the fast-uri dependency floor to version 3.1.6 to address four advisories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/audit-fast-uri

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟢 Approval recommended

The override and lockfile changes consistently remove fast-uri@3.1.5 and enforce 3.1.6 without introducing functional code changes.

Pull request overview

This PR updates the pnpm override “floor” for fast-uri to ensure transitive dev-tooling consumers (via @commitlint/cli → ajv) cannot resolve vulnerable versions affected by newly published advisories.

Changes:

• Raise the fast-uri override range from <3.1.5 to <3.1.6, pinning resolutions to 3.1.6.
• Regenerate/update pnpm-lock.yaml to reflect fast-uri@3.1.6 in both package entries and ajv’s resolved dependency snapshot.

File summaries

File	Description
pnpm-workspace.yaml	Moves the fast-uri override floor to <3.1.6 and updates the advisory context comment.
pnpm-lock.yaml	Updates the lockfile override and resolved dependency graph to use fast-uri@3.1.6.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.