fix(deps): bump fast-uri override to 3.1.7 to unblock the audit gate

[NicholasRBowers]

Problem / Motivation

The required Dependency Audit / Audit Production Dependencies gate is red on every PR merge ref since ~2026-09-02 16:30 UTC: four high-severity GHSA advisories (GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp — SSRF and host-confusion defects in URI normalization) were published today against fast-uri <= 3.1.5, which website/electron/package-lock.json pins.

Why it matters

Every open PR is blocked at a required gate regardless of its own diff (first observed on #7918, which touches no dependencies). Until this lands, nothing can reach readiness.

What changed (motivation → approach → change)

fast-uri is a transitive dependency (via ajv@^3.0.1), but website/electron/package.json pins it with an exact overrides entry: "fast-uri": "3.1.5". That override — not registry state or lockfile staleness — is why npm update fast-uri and npm audit fix both no-op here: every re-resolution snaps back to the pin.

Change: bump the override to 3.1.7 (the advisories are patched in 3.1.6; 3.1.7 is the current three dist-tag, published today) and regenerate the lockfile entry under it. Two files, four lines of real delta: the override value plus the lockfile's version/resolved/integrity triplet. The neighboring js-yaml override is untouched.

Tests

N/A — lockfile-only dependency bump; no code paths in this repo change. The gate itself is the regression test: the Dependency Audit check on this PR runs the exact audit currently failing fleet-wide.

Manual verification

• npm ci --ignore-scripts in website/electron installs the regenerated lockfile cleanly (308 packages).
• npm audit --omit dev reports 0 vulnerabilities (was 4 high).

Screenshots / video

Why no screenshot: dependency lockfile bump; no rendered surface exists.

Closes #7925

Pattern harvest

Not generalizable: operational one-off — an exact overrides version pin froze
a transitive dependency on a version that later grew advisories, and the pin
silently defeats npm update / npm audit fix. Process note rather than a
code rule: an exact overrides pin should carry a comment naming why it
exists and what unblocks removing it.

[github-actions]

UX Review (Fable 5) — ⏭️ skipped

Revision 53df1a8ef10e489f7958720607183f22969a560b touches no user-facing surface (no changes under website/ or committed screenshots), so the UX review was skipped. Advisory — does not block merge.

[github-actions]

Opus 4.8 Review — ✅ no blocking findings

Reviewed 53df1a8ef10e489f7958720607183f22969a560b — this comment is updated in place on each push.

Review details

No findings.

[OPUS-REVIEWED] 53df1a8

Verdict parsed from the review's SHA-scoped output markers for commit 53df1a8ef10e489f7958720607183f22969a560b.

False positive or not applicable? A repository writer can comment:
/ai-review override fable 53df1a8ef10e489f7958720607183f22969a560b: <one-sentence reason>

[github-actions]

Design Review (Fable 5) — ✅ PASS

Design-level review of 53df1a8ef10e489f7958720607183f22969a560b — updated in place on each push. A BLOCK verdict blocks PR readiness; PASS/CONCERNS are advisory.

Design-Verdict: PASS

Minimal root-cause fix: bumps the exact overrides pin that was defeating npm audit fix, four lines of real delta, no new surface.

Suggestions

• The exact pin remains, so this outage recurs at the next fast-uri advisory; loosen the override to ^3.1.7 or add the comment your own pattern-harvest prescribes (why the pin exists, what unblocks removing it) in a follow-up.

[DESIGN-REVIEWED] 53df1a8

[github-actions]

GPT 5.6 Review — ✅ no blocking findings

GPT 5.6 completed its review of 53df1a8ef10e489f7958720607183f22969a560b and found no blocking issues.

This comment is updated in place on each push.

Review details

No findings.
[GPT-REVIEWED] 53df1a8

False positive or not applicable? A repository writer can comment:
/ai-review override gpt 53df1a8ef10e489f7958720607183f22969a560b: <one-sentence reason>

[github-actions]

First Principles Review (Fable 5) — ⏭️ skipped

Revision 53df1a8ef10e489f7958720607183f22969a560b ships no reviewable capability (docs, tests or generated files only), so there is nothing to inventory. Advisory — does not block merge.

[iamwhatever]

Closing as already fixed on main — thanks for the fix, and sorry for the duplicate effort.

PR #7936 ("fix(deps): unpin fast-uri so the patched 3.1.7 can resolve") merged at 17:52Z and lands the same change: website/electron/package.json now overrides fast-uri at 3.1.7, and website/electron/package-lock.json resolves it to 3.1.7. Since the 3.x line is patched at 3.1.6, that clears all four advisories (GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp), and scripts/check_npm_audit.py now reports Production dependency audit passed: 3 lockfiles, 0 governed exception(s).

This PR's diff is byte-for-byte the same 3.1.5 → 3.1.7 bump in the same two files, so there is nothing left for it to add. Nothing is wrong with the change — it was simply raised in parallel with #7936.

Note that #7936 shipped without a closing keyword, so the tracking issue stayed open after the merge; closing it now alongside this PR.