security(web): require fast-uri 3.1.7 or later

CHANGELOG.md

@@ -9,6 +9,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Security
 
+- The web dashboard and marketing site no longer resolve `fast-uri` 3.1.6,
+  which GHSA-qw65-cvwx-89v3 and GHSA-58mr-gqgx-xq4g (authority injection
+  through an unvalidated port) affect. Both now require 3.1.7 or later; the
+  marketing site had no floor at all.
+
 - The dependency audit accepts far fewer exceptions and re-checks the ones it
   keeps. Three accepted advisories turned out to be ours to fix and are gone:
   `rand` was already on patched versions, `rustls-pemfile` was used by one

web/app/package.json

@@ -37,7 +37,7 @@
   },
   "pnpm": {
     "overrides": {
-      "fast-uri": "^3.1.6",
+      "fast-uri": "^3.1.7",
       "nanoid": "^3.3.17",
       "js-yaml": "^4.3.2",
       "svgo": "^4.1.0",

web/marketing/package.json

@@ -22,6 +22,7 @@
   },
   "pnpm": {
     "overrides": {
+      "fast-uri": "^3.1.7",
       "nanoid": "^3.3.17",
       "js-yaml": "^4.3.2",
       "svgo": "^4.1.0",