fix(deps): unstick the fast-uri override from a version that is itself vulnerable

[multicam]

Problem and value

npm audit on current main reports 2 high-severity vulnerabilities through ajv > fast-uri:

fast-uri  3.0.0 - 3.1.5   (high)
  GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp
node_modules/ajv/node_modules/fast-uri
  ajv  → depends on vulnerable versions of fast-uri

The override added in #209 did the right thing at the time, but it pins an exact version. That froze the tree at 3.1.5, and four advisories published since cover 3.0.0 - 3.1.5 — so the mechanism that was meant to keep fast-uri patched is now the reason it is not. Every future advisory in that line needs another manual bump.

This supersedes the stale #141, which is conflicting, has an unfilled description, and also touches archify.zip, bin/archify.mjs, and test/cli.test.mjs.

Scope

• What changed: archify/package.json override "fast-uri": "3.1.5" → "fast-uri": "^3.1.7", and the resulting archify/package-lock.json. Two files, 18 insertions, 18 deletions.
• What deliberately did not change: no source, no renderer, no schema, no test, no generated artifact, no release identity or version. ajv itself stays at 8.20.0.
• No unrelated changes: confirmed — git diff --stat is exactly the two dependency files.

Deliberately ^3.1.7 rather than an exact 3.1.7: a caret keeps the security floor the override exists to provide while letting the resolver take future patches on its own. It also sits inside ajv's own declared ^3.0.1, so nothing is forced out of range — npm ls fast-uri no longer reports the dependency as overridden. 4.x was not used; it would force a major outside that range for no security benefit.

Stability impact

• Compatibility and migration risk: none for consumers. fast-uri is reached only through ajv, a devDependency used by scripts/generate-validators.mjs; it is not in any published runtime path. 3.1.5 → 3.1.7 is a patch bump within the same major.
• Renderer, validator, package, or generated-artifact risk: the generated validators are the one surface that could move, and npm run check:validators (part of npm test) passes, so the checked-in output is unchanged.
• Failure behavior and rollback path: revert the single commit; npm ci restores 3.1.5. Nothing is written outside node_modules and the lockfile.

Tests run

Node.js v26.8.1, macOS. Run from archify/.

npm ci
npm test
→ ℹ tests 1051 / ℹ pass 1020 / ℹ fail 0 / ℹ skipped 31   (exit 0)

npm audit
→ found 0 vulnerabilities

npm ls fast-uri
→ archify@2.17.0-dev.1
  └─┬ ajv@8.20.0
    └── fast-uri@3.1.7

The same suite was run on unmodified main (920543b) in a separate clean clone as a baseline: 1051 / 1020 pass / 0 fail / 31 skipped, identical. No test changed state.

All 31 skips are environmental and identical on both sides — 25 gated on ARCHIFY_CHROME, 5 on canonical ZIP builds require Node 22, 1 on ARCHIFY_MCO_REPO_ROOT. Per CONTRIBUTING, those are reported as skipped, not passed; none of them exercises dependency resolution.

Visual evidence

Not applicable — no rendering, layout, or viewer behavior is touched.

Generated artifacts

None regenerated. check:brand-marks, check:validators, and check:release-identity all pass against the checked-in artifacts, which is the evidence that their inputs did not change. archify.zip is deliberately untouched: no host-visible plugin or Skill bytes change here, and CONTRIBUTING asks that release identity stay out of an ordinary PR.

Checklist

• I used a minimal focused change and preserved existing typed JSON behavior unless the issue requires a contract change.
• I ran the relevant targeted tests and npm test in archify/.
• I added or updated a regression test for behavioral changes. — not applicable; no behavior changes. npm audit is the check that fails before this change and passes after.
• I checked generated artifacts and package freshness when their sources changed.
• I removed secrets, private repository content, and customer data from fixtures and screenshots.

Maintainer integration update

Candidate f110d0dae85f08d3477e133d81255850e04b9967 includes main 3d972342c52127b0fd81e9c4d8f4237d2e9f848b. Local official Node 22.23.2: npm ci succeeds, check:validators passes, and npm audit reports 0 vulnerabilities.

Correction to the original artifact assessment: the package stager retains package.json overrides, so the canonical ZIP must also change. Rebuilt it with official Node 22; the archive entry list is identical and its only changed entry is archify/package.json, whose only changed field is the fast-uri override. Renderer and Viewer bytes are unchanged. The initial integration CI caught the stale ZIP; the corrected final-head CI is required before merge.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 73b55ceb-2302-4f83-b37d-09cf970d812d

📥 Commits

Reviewing files that changed from the base of the PR and between 3d97234 and f110d0d.

⛔ Files ignored due to path filters (2)

• archify.zip is excluded by !**/*.zip
• archify/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• archify/package.json

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Summary

Reviewed base a52c09007234613d8ad0ee3a1f6ed525f141d40c and head f110d0dae85f08d3477e133d81255850e04b9967. The supplied diff showed no changes, so the reported fast-uri override update is not confirmed at this revision. Author-reported tests and npm audit results remain unverified. No CI results were supplied for the reviewed revision.

Walkthrough

The fast-uri override changes from exact version 3.1.5 to the compatible range ^3.1.7.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to f110d

The dependency override and lockfile are aligned, with no established merge-blocking issue.

🚥 Pre-merge checks | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Contribution Scope	⚠️ Warning	The change is otherwise a focused dependency-security delivery slice, and the description covers the user problem, compatibility impact, and rollback. However, the latest description incorrectly state…	Update the PR description to list archify.zip as regenerated or refreshed, remove the claims that it was untouched and that only two files changed, and explain that the archive change is limited to the packaged archify/package.json depe…
Validation Evidence	⚠️ Warning	The dependency evidence is mostly consistent, but the latest PR body contains material inaccurate claims. The evaluated head is f110d0dae85f08d3477e133d81255850e04b9967, against base `3d972342c52127…	Update the PR body to list archify.zip as a regenerated changed file and correct the file-count and generated-artifact statements. Identify the exact revision for each reported dependency check, or rerun the checks on `f110d0dae85f08d3477…

Full details: Contribution Scope

Explanation

The change is otherwise a focused dependency-security delivery slice, and the description covers the user problem, compatibility impact, and rollback. However, the latest description incorrectly states that archify.zip was untouched and that only two files changed. The review-scoped diff includes a third changed file, archify.zip; its only changed ZIP entry is archify/package.json, which carries the new fast-uri override. The generated-artifact section therefore does not explain the actual delivery.

Resolution

Update the PR description to list archify.zip as regenerated or refreshed, remove the claims that it was untouched and that only two files changed, and explain that the archive change is limited to the packaged archify/package.json dependency override. No new issue or broad scope decision is needed because this remains a narrow fix with a concrete npm audit reproduction.

Full details: Validation Evidence

Explanation

The dependency evidence is mostly consistent, but the latest PR body contains material inaccurate claims. The evaluated head is f110d0dae85f08d3477e133d81255850e04b9967, against base 3d972342c52127b0fd81e9c4d8f4237d2e9f848b. The scoped diff changes three files, including archify.zip; the archive content changes at archify/package.json. The head lockfile resolves fast-uri to 3.1.7, and the packaged manifest matches the staged head manifest with the ^3.1.7 override. However, the body says that only two files changed and that archify.zip was deliberately untouched. It also does not identify the candidate revision for the reported npm ci, npm test, npm audit, and npm ls results. The reported baseline revision is identified, but the candidate test revision is not. CONTRIBUTING.md requires affected regenerated files and ZIP freshness evidence. The body does not report a ZIP rebuild and comparison, although the archive did change.

Resolution

Update the PR body to list archify.zip as a regenerated changed file and correct the file-count and generated-artifact statements. Identify the exact revision for each reported dependency check, or rerun the checks on f110d0dae85f08d3477e133d81255850e04b9967. Provide Node 22 ZIP freshness evidence using scripts/build-zip.sh and an exact comparison with the committed archive; report the extracted-package smoke result if that check is used.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}