[Rick Brighenti (rbrighenti)]

Summary

Bumps the transitive dependency fast-uri from 3.1.3 → 3.1.9 in pnpm-lock.yaml to resolve the open fast-uri Dependabot security alerts (SSRF, host confusion, authority injection, etc.). All of them are fixed in 3.1.9.

fast-uri is pulled in through ajv@8.20.0 (used by @modelcontextprotocol/sdk and ajv-formats). 3.1.9 is within ajv's ^3.x range and the existing fast-uri: ^3.1.2 override, so no other changes are needed.

Scope

• Only pnpm-lock.yaml changes (4 lines: the fast-uri package entry, its integrity/tarball, the ajv snapshot dependency, and the fast-uri snapshot key).
• No package.json, override, or code changes, and no other dependency versions move.
• The integrity hash (sha1-8d66gisdasedovhg6HKmNHDP8gM=) comes from the registry's published shasum for fast-uri 3.1.9 (f1deba822b1d6ac79da2f860e872a63470cff203).

I edited the lockfile by hand because pnpm update fast-uri --recursive --depth Infinity also rewrote tarball host URLs and peer-dependency suffixes on hundreds of unrelated entries.

Validation

• pnpm install --frozen-lockfile (pnpm 10.20.0) succeeded; node_modules/fast-uri is 3.1.9.
• pnpm build passed.
• pnpm test passed (1,421 tests).

[Copilot]

🟢 Approval recommended

No active review issues were identified for the transitive fast-uri update addressing reported security alerts.

Copilot wasn't able to review any files in this pull request.

1 file not reviewed

• pnpm-lock.yaml: Generated file