fix(deps): patch fast-uri production audit advisories (7.9.x)

[tensordreams]

Overview

Backport of #29758 to the 7.9.x release branch.

pnpm audit --prod (the audit CI gates on in test-template.yml) flags two advisories on 7.9.x, both in fast-uri via the shipped dependency path packages/cli > @prisma/dev > @prisma/streams-local > ajv:

• GHSA-4c8g-83qw-93j6 — host confusion via failed IDN canonicalization (patched >=3.1.3)
• GHSA-v2hh-gcrm-f6hx — host confusion via literal backslash authority delimiter (patched >=3.1.4)

The branch still carries fast-uri@<=3.1.1: '>=3.1.2', which resolves to a version inside both advisories' vulnerable ranges.

Changes

Raises the existing override in pnpm-workspace.yaml from fast-uri@<=3.1.1: '>=3.1.2' to fast-uri@<=3.1.3: '>=3.1.4 <4', resolving fast-uri to 3.1.4. The upper bound keeps the resolution within the ^3.x range ajv declares — without it, pnpm resolves to fast-uri@4.x, a major ajv is not tested against.

The override line is byte-identical to the one already on main. Unlike #29758, the lockfile picks up no incidental re-resolution churn here — the diff is 12 lines, confined to fast-uri moving 3.1.2 → 3.1.4 at each call site — because 7.9.x's lockfile was regenerated recently by #29795.

Out of scope

Dev-tooling-only advisories reported by the full pnpm audit are intentionally left untouched, consistent with #29758 and prior audit fixes — they are not part of any published package's runtime dependency tree.

Verification

• pnpm audit --prod → No known vulnerabilities found (exit 0). This is the exact command CI gates on.
• CI=true pnpm install --frozen-lockfile --lockfile-only passes — no lockfile drift.
• fast-uri resolves to a single version, 3.1.4, at every site in the lockfile.

Note: pnpm build was not run locally — the machine ran out of disk during pnpm install, so no node_modules tree could be materialised. fast-uri is a runtime transitive dependency of the published CLI rather than a build input, and this change touches no source, so pnpm audit --prod is the relevant gate; CI will exercise the build regardless.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4e10adc9-1b43-4f24-a99e-f115944f920c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/fast-uri-audit-7.9.x

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/fast-uri-audit-7.9.x

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

size-limit report 📦

Path	Size
packages/client/runtime/index-browser.js	2.29 KB (0%)
packages/client/runtime/index-browser.d.ts	3.37 KB (0%)
packages/cli/build/index.js	110 B (0%)
packages/client/prisma-client-0.0.0.tgz	26.71 MB (0%)
packages/cli/prisma-0.0.0.tgz	14.04 MB (0%)
packages/bundle-size/da-workers-libsql/output.tgz	1.33 MB (0%)
packages/bundle-size/da-workers-neon/output.tgz	1.39 MB (0%)
packages/bundle-size/da-workers-pg/output.tgz	1.39 MB (0%)
packages/bundle-size/da-workers-planetscale/output.tgz	1.33 MB (0%)
packages/bundle-size/da-workers-d1/output.tgz	1.31 MB (0%)