fix(deps): update fast-uri to 3.1.6

[mohanagy]

Summary

The inherited fast-uri 3.1.5 development dependency makes the Ubuntu/Node 22 security audit fail on next, blocking PRs #742 and #747. Update its locked version to 3.1.6, the patched 3.x release for all four recorded advisories.

Only the version, resolved, and integrity values in the single node_modules/fast-uri lock entry change. Byte comparison confirms every other byte is preserved, including Ajv ranges, dev: true, license and funding.

Testing

• Clean install completed on Node 22.22.3; both Ajv dependency paths resolve fast-uri 3.1.6.
• npm audit --audit-level=high: zero vulnerabilities.
• Qualification validator: all 21 frozen files intact.
• Focused existing qualification-contract and MCP registry tests: 55 passed across both files.
• git diff --check and clean candidate verification passed on 0c7c100630e962c25e687badd49197c3322d897b.
• Fresh independent FINAL review: GO-748 on the exact candidate; packet-only review with no tool calls. PREQUAL used a separate fresh reviewer.
• Local launch timeouts and process samples are retained with the execution evidence; no product changes or audit suppression were used to address them.

CI run 34081270107 passed all six OS/Node lanes on attempt 1 at 0c7c100630e962c25e687badd49197c3322d897b. Ubuntu/Node 22 passed the security audit, demo generation and enforced eval thresholds. GitHub test-merge tree equals the reviewed candidate tree. CodeRabbit reviewed this head and reported no actionable findings.

The demo report-only grounded-match value is 116.7%; it is outside the enforced thresholds and is not used as evidence of answer quality. This dependency repair makes no real-repository quality claim.

• npm run test:run — full CI matrix
• npm run typecheck — CI
• npm run build — CI
• npm pack --dry-run — Ubuntu/Node 20 CI

Checklist

• Docs assessed: no user-visible interface change
• Tests assessed: existing Ajv consumer validation is used; no literal dependency-version test added
• This PR does not include private corpora, secrets, credentials, proprietary prompts, sensitive raw logs, or accidental generated artifacts
• I kept this PR focused on a single change or tightly related set of changes

Related issues

Refs #748. Integration of PRs #742 and #747 remains blocked until this repair is merged and verified afterward. #740 remains open.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: f39f0069-3ca4-4242-afb2-845f90b1200c

📥 Commits

Reviewing files that changed from the base of the PR and between 72ecb4a and 0c7c100.

📒 Files selected for processing (1)

• package-lock.json

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

The lockfile updates the pinned fast-uri dependency from version 3.1.5 to 3.1.6, including its registry URL and integrity hash.

Changes

Dependency lock update

Layer / File(s)	Summary
Update fast-uri lock entry package-lock.json	The lockfile now resolves fast-uri at version 3.1.6 with the matching registry URL and integrity hash.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 0c7c1

This updates the locked fast-uri dependency to 3.1.6 with matching package metadata; no current merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely identifies the dependency update from fast-uri 3.1.5 to 3.1.6.
Description check	✅ Passed	The description includes the required Summary, Testing, Checklist, and Related issues sections. It explains the security motivation, records validation results, and marks the applicable checklist item…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/748-fast-uri-audit

---

_{Comment @coderabbitai help to get the list of available commands.}