fix(deps): raise fast-uri floor to 3.1.4

[snowyukitty]

Summary

• raise transitive fast-uri from 3.1.2 to 3.1.4 with a ^3.1.4 override
• clear GHSA-v2hh-gcrm-f6hx
  and GHSA-4c8g-83qw-93j6
• keep the lockfile change to that one package; no source files or other dependency resolutions move

On dev, bun audit reports three vulnerabilities: two high and one moderate. This branch reports
one moderate.

Why an override

fast-uri enters through one path:
@modelcontextprotocol/sdk@1.29.0 → ajv@8.20.0 → fast-uri. Ajv already allows
fast-uri ^3.0.1, but the existing lock resolved the affected 3.1.2. The root override sets a
safe floor within the same major line without forcing a parent upgrade or refreshing unrelated
packages.

The remaining moderate finding,
GHSA-frvp-7c67-39w9, is in
@hono/node-server. The current MCP SDK requires its 1.x line, while the fix starts at 2.0.5.
OpenCodex uses the SDK's client transports; the vulnerable serve-static path belongs to the
server adapter. That upgrade is left for a separate compatibility change.

Verification

• bun install --frozen-lockfile
• bun run test — 3,617 passed, 4 skipped, 0 failed
• bun run typecheck
• bun run privacy:scan
• bun audit — both fast-uri findings cleared; one pre-existing Hono moderate remains
• git diff --check

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. (No user-visible behavior changes.)
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Because this changes dependency resolution, it still requires explicit maintainer security review
before merge.

Summary by CodeRabbit

• Chores
  • Updated a transitive dependency version to improve compatibility and reliability.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c665dad3-89a1-44df-91eb-ef8d615ae7c9

📥 Commits

Reviewing files that changed from the base of the PR and between 02b67b0 and 9bfbdbf.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (1)

• package.json

---

📝 Walkthrough

Walkthrough

package.json adds an overrides entry that forces transitive fast-uri resolution to version ^3.1.4.

Changes

Dependency override

Layer / File(s)	Summary
Pin transitive fast-uri resolution package.json	Lines 66–68 add an overrides block forcing fast-uri to ^3.1.4.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: ingwannu, lidge-jun

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: raising the fast-uri dependency floor to 3.1.4.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

package.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

_{Comment @coderabbitai help to get the list of available commands.}

[Ingwannu]

Reviewed against current dev. The override changes only fast-uri from 3.1.2 to 3.1.4; GitHub advisory metadata confirms 3.1.4 is outside both affected 3.x ranges cited in the PR. I also integrated this lockfile change with the other shortlisted PRs and ran bun install --frozen-lockfile, focused tests, typecheck, privacy scan, docs build, and the full pre-push suite (3,667 passed / 0 failed). No unrelated dependency resolution moved. Approved.