From 21319ffc753c4f7972341add86c8fddd9ca0b1b0 Mon Sep 17 00:00:00 2001
From: Black Sun <18490995+BlandineRdl@users.noreply.github.com>
Date: Thu, 10 Sep 2026 17:15:57 +0200
Subject: [PATCH] fix(cli): pin fast-uri to the patched Ajv-compatible v3 range

The >=3.1.2 floor is open-ended, so the lockfile resolved fast-uri@4.0.0
on the production Ajv path - outside the ^3.0.1 range ajv@8 declares.
Constrain it to >=3.1.6 <4: the smallest range that keeps Ajv 8
compatibility and excludes every reported vulnerable v3 release.

Closes #463

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BZF7CTRvfq3FWDqaCWhkCJ
---
 cli/pnpm-lock.yaml      | 12 ++++++------
 cli/pnpm-workspace.yaml |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/cli/pnpm-lock.yaml b/cli/pnpm-lock.yaml
index 7c5fa503c..72854543a 100644
--- a/cli/pnpm-lock.yaml
+++ b/cli/pnpm-lock.yaml
@@ -106,7 +106,7 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
-  fast-uri: '>=3.1.2'
+  fast-uri: '>=3.1.6 <4'
   picomatch: '>=4.0.4'
   postcss: '>=8.5.10'
   qs: '>=6.15.2'
@@ -1819,8 +1819,8 @@ packages:
   fast-string-width@3.0.2:
     resolution: {integrity: sha512-gX8LrtNEI5hq8DVUfRQMbr5lpaS4nMIWV+7XEbXk2b8kiQIizgnlr12B4dA3ZEx3308ze0O4Q1R+cHts8kyUJg==}
 
-  fast-uri@4.0.0:
-    resolution: {integrity: sha512-l90y339r2DkZs/ldcWQXcwTjkbp/NbuJDGYoQ3awBgaT3GXOFkm3OkVpz6Z86TywYcya0eVP2r1kTV90f3krGQ==}
+  fast-uri@3.1.7:
+    resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==}
 
   fast-wrap-ansi@0.2.2:
     resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==}
@@ -3827,14 +3827,14 @@ snapshots:
   ajv@8.18.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 4.0.0
+      fast-uri: 3.1.7
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
   ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 4.0.0
+      fast-uri: 3.1.7
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
@@ -4128,7 +4128,7 @@ snapshots:
     dependencies:
       fast-string-truncated-width: 3.0.3
 
-  fast-uri@4.0.0: {}
+  fast-uri@3.1.7: {}
 
   fast-wrap-ansi@0.2.2:
     dependencies:
diff --git a/cli/pnpm-workspace.yaml b/cli/pnpm-workspace.yaml
index b03326216..d59cf5c71 100644
--- a/cli/pnpm-workspace.yaml
+++ b/cli/pnpm-workspace.yaml
@@ -11,7 +11,7 @@ packages: []
 # security floors were silently ignored while the lockfile still recorded them, which is
 # the ERR_PNPM_LOCKFILE_CONFIG_MISMATCH every `cli` install answered with.
 overrides:
-  fast-uri: '>=3.1.2'
+  fast-uri: '>=3.1.6 <4'
   picomatch: '>=4.0.4'
   postcss: '>=8.5.10'
   qs: '>=6.15.2'