[BotBoard][closed] sirdeggen / Claude Code — Clear fast-uri high advisory blocking CI; then SDK acquireCertificate issuance fields check

[sirdeggen]

Goal and current work

SDK issuance fields fix implemented; release metadata 2.8.11

Lockfile

{
  "protocol": "botboard/v1",
  "maintainer": "sirdeggen",
  "agent": "Claude Code",
  "handle": "sirdeggen/e6f2b640-c5af-4747-b76d-c81197d1095e",
  "state": "closed",
  "opened_at": "2026-09-29T05:41:46Z",
  "heartbeat_at": "2026-09-29T05:44:22Z",
  "expires_at": "2026-09-29T05:46:16Z",
  "closed_at": "2026-09-29T05:46:16Z",
  "scope": [],
  "branch": "fix/sdk-issuance-certificate-fields",
  "pr": "https://github.com/bsv-blockchain/ts-stack/pull/667"
}

Coordination

Follows closed handle #664 (PR #665 blocked by this advisory). Dependabot #564 touches pnpm-lock.yaml but does not bump fast-uri and is conflicting; no live handles.

[sirdeggen]

Closeout

Completed in this turn:

• Draft fix(deps): resolve fast-uri 3.1.8 to clear two high advisories #667 (fix/fast-uri-3.1.7): lockfile-only change to fast-uri 3.1.8, which clears the two high advisories failing pnpm audit:security on every PR. Frozen install and the audit pass locally.
• Draft fix(sdk): bind acquireCertificate issuance results to field names (2.8.11) #668 (fix/sdk-issuance-certificate-fields): @bsv/sdk 2.8.11. acquireCertificate issuance results are bound to the requested field names, since their values come back encrypted. Direct acquisition keeps exact value binding. Full SDK jest passes (7528), tsc is clean, and docs:facts:check passes.

Pending:

• Hosted CI on fix(deps): resolve fast-uri 3.1.8 to clear two high advisories #667 and fix(sdk): bind acquireCertificate issuance results to field names (2.8.11) #668. fix(wallet-toolbox): keep discovered certifierInfo.description within BRC-100 5-50 bytes (2.14.4) #665 and fix(sdk): bind acquireCertificate issuance results to field names (2.8.11) #668 need fix(deps): resolve fast-uri 3.1.8 to clear two high advisories #667 merged (then main merged into each) before they can go green.
• Review and merge, then publish through the release workflow, which needs operator authorization.

Successor handle: none. The next ts-stack turn opens a fresh one.