Fix fast-uri cve issues

[dbezic (dbezic)]

Security: force transitive fast-uri to patched 3.1.3

Summary

Pins the transitive dependency fast-uri from the vulnerable 3.1.0 to the patched
3.1.3 using a pnpm overrides entry, remediating two URI-normalization
vulnerabilities. fast-uri is not a direct dependency — it is pulled in through:

@modelcontextprotocol/sdk@1.29.0 → ajv@8.20.0 → fast-uri@3.1.0

Motivation

fast-uri@3.1.0 is affected by two advisories, and the resolved version falls inside the
vulnerable range of both:

1. Authority-delimiter decoding (fast-uri <= 3.1.1, fixed in 3.1.2) —
   percent-encoded authority delimiters (%40 → @, %3A → :) are decoded inside the
   host and re-serialized as raw characters, so http://trusted.com%40evil.com/ normalizes
   to http://trusted.com@evil.com/ (host becomes evil.com). Can defeat host
   allowlist / redirect / SSRF-style checks that normalize before validating.
2. Path-separator / dot-segment decoding (fast-uri <= 3.1.0, fixed in 3.1.1) —
   %2F and %2E are decoded before dot-segment removal in normalize() / equal(), so
   http://example.com/public/%2e%2e/admin collapses to http://example.com/admin. Can
   defeat path-based policy checks.

ajv uses fast-uri to validate the uri / uri-reference string formats, which is the
exact normalization surface described above.

What changed

File	Change
pnpm-workspace.yaml	Added a documented fast-uri: "^3.1.2" entry to the overrides: block.
package.json	Added "fast-uri": "^3.1.2" to pnpm.overrides (the block pnpm actually consumes in this repo — see note below).
pnpm-lock.yaml	fast-uri 3.1.0 → 3.1.3 (resolution + integrity + both snapshot references) and the override recorded in the lockfile overrides: block.

Net diff for the manifests + lockfile is 14 insertions / 4 deletions — no unrelated
packages touched.

Approach & rationale (chosen for maintainability)

• Why an override (not just a re-resolve): both transitive parents
  (@modelcontextprotocol/sdk@1.29.0, ajv@8.20.0) are already at their latest published
  versions, and the latest ajv still declares fast-uri: ^3.0.1. There is no parent bump
  available, so a version floor is required. The override is a documented guardrail that
  prevents any future resolution from sliding back below the patched release. This matches
  the repository's existing convention for the @isaacs/brace-expansion override.
• Why ^3.1.2: 3.1.2 is the fix boundary that covers both advisories. The caret
  stays inside ajv@8's fast-uri: ^3.0.1 requirement (so 4.x is intentionally excluded)
  and currently resolves to the newest in-range patch, 3.1.3.
• Override placed in both manifests: the lockfile's overrides: block reflects
  package.json's pnpm.overrides in this repo (it contains hono, which only exists in
  package.json, and omits @isaacs/brace-expansion, which only exists in
  pnpm-workspace.yaml). To guarantee the fix is effective and stay consistent with the
  existing dual-declared overrides (zod, uuid, @types/uuid are already in both), the
  entry was added to both files. The pnpm-workspace.yaml entry also carries the
  explanatory comment for future maintainers.
• Lockfile updated surgically (by hand): a normal pnpm install in the build
  environment rewrites every tarball URL/integrity to an internal Azure Artifacts mirror
  (*.pkgs.visualstudio.com, sha1), which must not land in this public repo. Only the four
  fast-uri entries were changed, preserving the public registry.npmjs.org + sha512
  format for all other packages. The 3.1.3 sha512 integrity was verified by hashing the
  package tarball and cross-checking its sha1 against the registry value.

Verification

• fast-uri@3.1.0 no longer appears anywhere in pnpm-lock.yaml; it resolves to 3.1.3.
• Lockfile diff is limited to the four fast-uri lines + the override entry (no
  internal-feed URL leakage, no unrelated churn).
• pnpm install --frozen-lockfile --lockfile-only → exit 0 in ~350 ms, i.e. the
  lockfile is consistent with the manifests and CI's frozen install will pass.
• 3.1.3 sha512 integrity independently reproduced from the tarball bytes
  (sha1 cross-check matched the registry hash exactly).

Reviewer sanity check:

grep "fast-uri" pnpm-lock.yaml          # all references show 3.1.3 + override ^3.1.2
pnpm install --frozen-lockfile          # should succeed with no lockfile changes
pnpm audit                              # fast-uri advisories no longer reported

Risk & compatibility

• Low. The pin stays within ajv's declared ^3.0.1 range; only patch-level behavior
  of fast-uri changes. No API surface change.
• No production source code changes — dependency metadata only.

Rollback / follow-up

• Rollback: revert this PR (restores fast-uri@3.1.0 in the lockfile and removes the
  override entries).
• Follow-up: once @modelcontextprotocol/sdk / ajv ship releases that already resolve
  a patched fast-uri, the override can be removed and the lockfile re-resolved.
• Not suppressed via auditConfig.ignoreCves / ignoreGhsas — a real patched release
  exists, so upgrading is the correct action.

Checklist

• Vulnerable version removed from the lockfile
• Override pinned within the parent's compatible range (^3.0.1)
• Lockfile consistent with manifests (--frozen-lockfile passes)
• No unrelated lockfile churn / no internal-feed URLs introduced
• Integrity hash independently verified
• pnpm audit re-run in CI to confirm the advisories clear

[Copilot]

Pull request overview

This PR remediates fast-uri CVE issues by forcing the transitive fast-uri dependency to resolve to a patched 3.x version via pnpm overrides, and by updating the lockfile so ajv@8.20.0 uses fast-uri@3.1.3.

Changes:

• Added fast-uri: "^3.1.2" to pnpm overrides in both pnpm-workspace.yaml and package.json.
• Updated pnpm-lock.yaml to record the override and resolve fast-uri from 3.1.0 to 3.1.3 (including snapshot references).

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
pnpm-workspace.yaml	Adds a documented pnpm override to enforce a patched fast-uri version.
package.json	Adds fast-uri to pnpm.overrides (the repo’s consumed override source).
pnpm-lock.yaml	Records the override and updates resolution/snapshots to fast-uri@3.1.3.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file