fix(deps): pin fast-uri to patched ^3.1.4 to clear host-confusion advisories

[StephenTangCook]

Summary

Downstream consumer block-kitchen's Audit (pnpm) CI job (PR #160, failing run) fails pnpm audit --audit-level=high on two high-severity fast-uri advisories. The vulnerable package reaches it only through this validator:

. > @tightknitai/slack-block-kit-validator > ajv > fast-uri

ajv@8.20.0 declares fast-uri: ^3.0.1, which resolved to the vulnerable 3.1.2 in our lockfile. This pins fast-uri to the patched ^3.1.4 at the source, using the same pnpm.overrides mechanism the repo already uses for ws and fast-json-patch security bumps.

Advisories addressed:

• GHSA-v2hh-gcrm-f6hx — host confusion via literal backslash authority delimiter (vulnerable >=3.0.0 <=3.1.3, patched >=3.1.4)
• GHSA-4c8g-83qw-93j6 — host confusion via failed IDN canonicalization (vulnerable >=3.0.0 <3.1.3, patched >=3.1.3)

The override is bounded to ^3.1.4 (the highest 3.x) deliberately — fast-uri@4.x is a breaking major that falls outside ajv's ^3.0.1 range.

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing behavior to change)
• Schema update (changes to src/slack-block-kit.schema.json)
• Docs / chore (no runtime change)

Changes

• Added "fast-uri@<3.1.4": "^3.1.4" to pnpm.overrides in package.json.
• Regenerated pnpm-lock.yaml: fast-uri 3.1.2 → 3.1.4 (single resolved copy, shared by ajv).

Testing

• pnpm test passes (499 tests, Node + Bun)
• pnpm typecheck passes
• pnpm lint passes
• pnpm validate-schema passes (if the schema changed) — N/A, schema unchanged
• Added or updated tests under test/ covering the change — N/A, dependency-only change; existing suite exercises ajv/fast-uri via validation
• pnpm audit --audit-level=high no longer reports fast-uri; pnpm build + worker smoke bundle succeed with the patched version

Schema changes

• N/A

Checklist

• Commit messages follow Conventional Commits (required for release-please)
• Public API changes are reflected in README.md — N/A, no public API change
• No secrets, tokens, or sample tenant data committed

---

Note on propagation: pnpm.overrides apply to this repo's own install (and the bundled standalone-validator.js), but they are not inherited by consumers. Once this merges and release-please cuts the patch release, block-kitchen's audit goes green when it bumps @tightknitai/slack-block-kit-validator to the new version — bumping the dependency forces pnpm to re-resolve ajv's fast-uri to 3.1.4. I can open that follow-up bump in block-kitchen if you'd like.

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	slack-block-kit-validator	f5eac39	Commit Preview URL Branch Preview URL	Jul 22 2026, 06:31 PM