From 14eafca3bad2dca0dbba3ce93a5645f7ad02f1cc Mon Sep 17 00:00:00 2001
From: Benoit TRAVERS <benoit.travers.fr@gmail.com>
Date: Wed, 2 Sep 2026 21:48:10 +0200
Subject: [PATCH] chore(deps): move the fast-uri floor to 3.1.6 for four more
 advisories
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`Security Audit` is red on `main`, and on every open PR with it: four
advisories landed in the same parser after the last bump — GHSA-5jgf-p345-68v8,
GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf and GHSA-jqff-g426-hqxp, all ReDoS or
parsing confusion in fast-uri below 3.1.6.

The existing entry's floor moves rather than a second one being added: two
overlapping ranges for one package is how a floor stops applying without
anybody noticing. Same path as before — `@commitlint/cli` > `ajv`, dev tooling
only — and 3.1.6 published 2026-08-23, well past `minimumReleaseAge`.

Claude-Session: https://claude.ai/code/session_01GGixjxi5AQ2cNK62bBymfF
---
 pnpm-lock.yaml      | 10 +++++-----
 pnpm-workspace.yaml | 12 ++++++++----
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 00ab12c..6616bf2 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -26,7 +26,7 @@ catalogs:
       version: 1.73.0
 
 overrides:
-  fast-uri@<3.1.5: 3.1.5
+  fast-uri@<3.1.6: 3.1.6
 
 importers:
 
@@ -639,8 +639,8 @@ packages:
     resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==}
     engines: {node: '>=8.6.0'}
 
-  fast-uri@3.1.5:
-    resolution: {integrity: sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==}
+  fast-uri@3.1.6:
+    resolution: {integrity: sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==}
 
   fastq@1.20.1:
     resolution: {integrity: sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==}
@@ -1472,7 +1472,7 @@ snapshots:
   ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.5
+      fast-uri: 3.1.6
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
@@ -1581,7 +1581,7 @@ snapshots:
       merge2: 1.4.1
       micromatch: 4.0.8
 
-  fast-uri@3.1.5: {}
+  fast-uri@3.1.6: {}
 
   fastq@1.20.1:
     dependencies:
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index c932f56..5eaeed1 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -20,10 +20,14 @@ allowBuilds:
   lefthook: true
 
 overrides:
-  # GHSA-7p8r-x3mc-p8w7 (High, supersedes GHSA-v2hh-gcrm-f6hx): fast-uri,
-  # patched in 3.1.5. Transitive only (via @commitlint/cli > ajv); dev-tooling
-  # only. 3.1.5 published 2026-07-31, past the 7-day cutoff.
-  "fast-uri@<3.1.5": "3.1.5"
+  # GHSA-7p8r-x3mc-p8w7 (High, supersedes GHSA-v2hh-gcrm-f6hx), then four more
+  # in the same parser — GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc,
+  # GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp — all ReDoS or parsing confusion
+  # below 3.1.6. Transitive only (via @commitlint/cli > ajv); dev-tooling only.
+  # The floor moves rather than a second entry being added: two overlapping
+  # ranges for one package is how a floor stops applying unnoticed. 3.1.6
+  # published 2026-08-23, past the 7-day cutoff.
+  "fast-uri@<3.1.6": "3.1.6"
 
 # Supply-chain maturity delay: mirror the consumer repos. Don't adopt a freshly
 # published version until it has been on the registry for 7 days (10080 minutes).