chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Bumped fast-uri to 3.1.7 (satisfies the patched range >=3.1.6) to resolve 4 high severity vulnerabilities

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#55	fast-uri	high	Bumped to 3.1.7 via resolutions entry
#56	fast-uri	high	Bumped to 3.1.7 via resolutions entry
#57	fast-uri	high	Bumped to 3.1.7 via resolutions entry
#58	fast-uri	high	Bumped to 3.1.7 via resolutions entry

Test plan

• yarn install regenerates lockfile with fast-uri@3.1.7
• yarn test passes (52/52 as-pect tests)
• yarn lint fails, but identically on main before this change (pre-existing decorator parsing issue unrelated to this dependency bump, and not run in CI)

[Copilot]

🟡 Changes recommended

The PR description’s stated fast-uri bump mechanism/version does not match the actual package.json resolution change, and should be reconciled for accuracy.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates the dependency graph to address Dependabot security alerts by forcing a patched fast-uri version via Yarn resolution and lockfile update.

Changes:

• Updated package.json resolutions.fast-uri from ^3.1.5 to ^3.1.6 (patched range).
• Regenerated yarn.lock so fast-uri resolves to 3.1.7.

File summaries

File	Description
package.json	Raises the enforced fast-uri resolution range to a patched minimum version.
yarn.lock	Locks fast-uri to 3.1.7 to ensure installs use a patched release.

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.