chore(security): patch 3 Dependabot alerts

[PMerlet]

👋 First-level support: see Handling automated security PRs for how to triage and merge this PR.

Summary

3 fixed, 0 ignored, 12 deferred, 0 security pins added, 0 security pins removed, 0 could-not-auto-fix. | label: 🔒 security applied

Fixed

Done	Alert	Gem	Ecosystem	From → To	Severity	What was bumped
- [ ]	#91	fast-uri	npm	3.1.2 → 3.1.5	high	Added root resolutions["fast-uri"] = "^3.1.4" in package.json (transitive via @commitlint/cli → @commitlint/load → @commitlint/config-validator → ajv). Yarn resolved to 3.1.5 (latest 3.x). Transitive-only, dev-tooling ecosystem — root package.json is dev-only and does not ship to gem consumers.
- [ ]	#92	fast-uri	npm	3.1.2 → 3.1.5	high	Same bump as #91 — the ^3.1.4 resolution covers both advisories (patched 3.1.3 and 3.1.4 respectively).
- [ ]	#93	tar (node-tar)	npm	7.5.19 → 7.5.22	medium	Added root resolutions["tar"] = "^7.5.21" in package.json (transitive via semantic-release → @semantic-release/npm → npm → tar/pacote/libnpmdiff/node-gyp). Yarn resolved to 7.5.22 (latest 7.x). Transitive-only, dev-tooling ecosystem — does not ship to gem consumers.

Ignored

None.

Deferred

Skipped by the 7-day age gate (opened < 7 days ago at run time on 2026-08-06); will be picked up by the next scheduled run:

• #95 — ip-address (medium)
• #96 — ip-address (medium)
• #97 — fast-uri (high) (incidentally satisfied by this run's fast-uri 3.1.5 resolve; the alert will close on merge, but it is not tracked here per the age-gate rule)
• #98 — undici (high)
• #99 — undici (medium)
• #100 — undici (medium)
• #101 — undici (medium)
• #102 — undici (medium)
• #103 — undici (medium)
• #104 — undici (medium)
• #105 — undici (medium)
• #106 — ip-address (high)

Security pins added

None.

Security pins removed

None (no # security pin comments found in any Gemfile at audit time).

Could not auto-fix

None.

Risks

• fast-uri 3.1.2 → 3.1.5: patch-level bumps within 3.x. Upstream releases 3.1.3–3.1.5 target authority-parser hardening (backslash / IDN canonicalization / URL parsing corner cases). No API changes touching us — fast-uri is used exclusively by ajv (schema validation inside @commitlint), which we invoke only via commitlint CLI in commit-message linting. No behavior change expected beyond the patched vulnerabilities.
• tar 7.5.19 → 7.5.22: patch-level bumps within 7.5.x. Upstream 7.5.21 fixes the uncontrolled-recursion DoS in mapHas/filesFilter. No API surface change; tar is a transitive dep of semantic-release's npm publish path, exercised only by CI's release step. No behavior change beyond the patched vulnerability.

Manual testing

Covered by CI.

Validation

✅ CI green (Actions + commit statuses; app-based checks not monitored)

[forest-bot]

🎉 This PR is included in version 1.37.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀