[release-1.10] chore(orchestrator): upgrade fast-uri in orchestrator to >= 3.1.6

[JessicaJHee]

Hey, I just made a Pull Request!

Fixes multiple fast-uri security vulnerabilities in orchestrator by upgrading to version 3.1.7, which patches all six CVEs affecting the package.

Fast-URI Vulnerabilities Fixed:

• CVE-2026-76172 (GHSA-jqff-g426-hqxp): Host confusion via percent-encoded scheme normalization
• CVE-2026-75899 (GHSA-fph4-wmhf-6fwf): Server-Side Request Forgery via repeated hostname percent-decoding
• CVE-2026-6322 (GHSA-v39h-62p7-jpjc): Host confusion via percent-encoded authority delimiters
• CVE-2026-75931 (GHSA-5jgf-p345-68v8): Host confusion via skipped IDN canonicalization
• CVE-2026-84394: Host confusion via unbalanced URI brackets can bypass security policies
• CVE-2026-84292: Authority Injection via Unvalidated Port Serialization

Version: fast-uri 3.1.3 → 3.1.7

Fixed with simple yarn up -R fast-uri.

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release-1.10/orchestrator@5fdb48f). Learn more about missing BASE report.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                     Coverage Diff                      @@
##             release-1.10/orchestrator    #4576   +/-   ##
============================================================
  Coverage                             ?   59.57%           
============================================================
  Files                                ?     2097           
  Lines                                ?    65234           
  Branches                             ?    16986           
============================================================
  Hits                                 ?    38862           
  Misses                               ?    25977           
  Partials                             ?      395           

Flag	Coverage Δ		*Carryforward flag
adoption-insights	83.58% <ø> (?)		Carriedforward from 18023a1
ai-integrations	70.03% <ø> (?)		Carriedforward from 18023a1
app-defaults	69.60% <ø> (?)		Carriedforward from 18023a1
augment	69.36% <ø> (?)		Carriedforward from 18023a1
bulk-import	72.86% <ø> (?)		Carriedforward from 18023a1
cost-management	16.49% <ø> (?)		Carriedforward from 18023a1
dcm	32.85% <ø> (?)		Carriedforward from 18023a1
extensions	61.79% <ø> (?)		Carriedforward from 18023a1
global-floating-action-button	74.30% <ø> (?)		Carriedforward from 18023a1
global-header	61.68% <ø> (?)		Carriedforward from 18023a1
homepage	50.95% <ø> (?)		Carriedforward from 18023a1
konflux	91.01% <ø> (?)		Carriedforward from 18023a1
lightspeed	68.34% <ø> (?)		Carriedforward from 18023a1
mcp-integrations	81.59% <ø> (?)		Carriedforward from 18023a1
orchestrator	37.54% <ø> (?)
quickstart	62.64% <ø> (?)		Carriedforward from 18023a1
sandbox	79.56% <ø> (?)		Carriedforward from 18023a1
scorecard	83.58% <ø> (?)		Carriedforward from 18023a1
theme	64.54% <ø> (?)		Carriedforward from 18023a1
translations	8.49% <ø> (?)		Carriedforward from 18023a1
x2a	57.33% <ø> (?)		Carriedforward from 18023a1

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5fdb48f...3f3937d. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud