[bdelanghe]

Closes #49

This raises the existing rung-3 import-map override from npm:fast-uri@^3.1.6 to ^3.1.9, which clears the 7 fast-uri 3.1.6 advisories osv-scan reports. I regenerated the lock with deno install; only the fast-uri entries moved, and the lock stays at version 5.

osv-scan will still be red after this PR. Two findings remain, each tracked on its own:

• zod 3.25.76 → 4.x (GHSA-mrhx-c7xc-m3w5): a real migration that adds 25 type errors, so it's in zod 3 -> 4 migration (GHSA-mrhx-c7xc-m3w5, CVSS 8.2) #50
• markdown-it 14.1.1 (4 advisories): lume v3.2.5 is still the newest release and pins it exactly. No upgrade exists, and no ignore was added, so it's in markdown-it 14.1.1 advisories via lume's exact pin: decide accept or vendor #51 for Bobby's decision

1. Independent PR — no bundled or speculative changes
   • Verified: deno.json fast-uri specifier and its deno.lock entries only
2. Changed codepaths verified — targeted unit and full integration tests
   • Verified: deno test -A (SITE_URL set) gives 98 passed / 15 failed both on main and on this branch, the same set (local deno 2.9.7 vs CI 2.6.6; the failures predate this change); deno check src/ unchanged
3. Root cause identified — every failure traced to source
   • New advisories against the locked fast-uri 3.1.6; no CI or tool defect
4. No duplication — refactoring preferred over copy/paste
   • Reuses the existing override entry
5. No unrelated changes — housekeeping isolated to its own branch
   • N/A; zod in zod 3 -> 4 migration (GHSA-mrhx-c7xc-m3w5, CVSS 8.2) #50, markdown-it in markdown-it 14.1.1 advisories via lume's exact pin: decide accept or vendor #51

🤖 Generated with Claude Code

https://claude.ai/code/session_0117AAnztxdG2tNqQSCsQB7q