fix(api): qualify qs and fast-uri advisory patches (0.55.64)

CHANGELOG.md

@@ -7,6 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### 0.55.64 reviewed-master integration (2026-10-29)
+
+- Normally integrate reviewed master `287ea671` after #259 and #260 merged.
+  Preserve every original advisory commit and both preparation histories.
+  Retain qs 6.16.1, fast-uri 4.2.3, the four API root override contexts and
+  merged web Seroval 1.6.11 / Undici 7.30.1. No new runtime implementation.
+- Parent #260 passed 28/28 protected Validate gates and seven exact-head
+  checks, with independent technical review. Those results are provenance,
+  not substitutes for this integration's protected gates or hosted CI.
+- Both roots remain at the already reserved 0.55.64. Confirm the
+  coordinated lock graph in clean CI without local lock regeneration.
+  No new test/gate improvement identified: existing installed-owner,
+  complete-inventory and graph-union checks cover the integration.
+  Design accepted: ordinary history-preserving merge, no new abstraction.
+  No deployment, full advisory clearance or performance admission.
+
+### 0.55.64 preparation - compatible API advisory pins, stacked on draft #260
+
+- Reserve 0.55.64 after checking existing branches, pull requests and releases.
+  Keep the exact #260 ancestry; do not merge or retarget either draft.
+- Select qs 6.16.1 and fast-uri 4.2.3 to address five of the six assessed
+  advisory records. Leave `@hono/node-server` 1.19.15 unchanged because
+  compatibility with the actual Prisma development lifecycle is unproved.
+- Add 19 actual-consumer and advisory-boundary regressions: pre-manifest RED is 11
+  failures / three passes. Existing Ajv compiler, Express parser, Superagent
+  serializer and body-parser stream behavior already pass at baseline.
+- [Public changes, actual ownership, advisory boundaries and execution RCA](docs/API_ADVISORY_CONSUMER_COMPATIBILITY.md).
+  Authenticated CI run 40923567650 changes exactly two API entries and no
+  non-root web entry; approved-feed bytes match locked SHA-512. Clean restore
+  keeps both lock hashes identical and full API npm inventory exits 0.
+  Final restored focus: 57/57 in three suites, up from 38 parent checks.
+  Bootstrap units 6,229/214 suites and HTTP 2,514/118 passing suites retain
+  42 existing skipped tests and two skipped suites. Final broad protected
+  Validate counts are recorded in the handoff after execution;
+  no deployed release claim.
+
 ### 0.55.63 reviewed-master integration (2026-10-29)
 
 - Normally integrate web #259's merged master `0a9b3d04` into the preserved

DEPLOYMENT.md

@@ -1,6 +1,6 @@
 # SCIMServer Deployment Options
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.63`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.64`
 
 > Updated: 2026-10-16 - Scope: production + local deployment paths
 

README.md

@@ -1,6 +1,6 @@
 # SCIMServer
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.63`
+> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.64`
 
 > Production-ready, multi-tenant SCIM 2.0 server for Microsoft Entra ID provisioning and any RFC 7643/7644-compliant identity client.
 
@@ -9,9 +9,14 @@ cover 0.55.58 correction preparation, merged 0.55.57 source, the deployed 0.55.5
 cumulative changes since 0.55.20, migration/rollback steps and known limits.
 See [CHANGELOG.md](CHANGELOG.md) for detailed engineering history.
 
-**Pending source-only inventory correction:** [API override-context validity](docs/API_OVERRIDE_CONTEXT_VALIDITY.md)
-describes proposed 0.55.63 and the complete-tree npm regression. It changes
-no application behavior and does not qualify a deployment or clear the
+**Pending API advisory integration:** [Consumer compatibility and remaining Hono blocker](docs/API_ADVISORY_CONSUMER_COMPATIBILITY.md)
+describes proposed 0.55.64 integrating reviewed master after #259 and #260
+merged. Five assessed advisory records are targeted; this proposal is not
+a deployed release or full advisory-clearance claim.
+
+**Merged source-only inventory correction:** [API override-context validity](docs/API_OVERRIDE_CONTEXT_VALIDITY.md)
+describes merged 0.55.63 source and the complete-tree npm regression. It
+changes no application behavior and does not qualify a deployment or clear the
 separately tracked API security advisories.
 
 For actual supported shapes and integration limits, see
@@ -20,7 +25,7 @@ For actual supported shapes and integration limits, see
 Keep strict validation enabled for Entra; diagnose the request and effective
 schema before applying a targeted compatibility setting.
 
-[![Version](https://img.shields.io/badge/version-0.55.63-blue)]()
+[![Version](https://img.shields.io/badge/version-0.55.64-blue)]()
 [![Node.js](https://img.shields.io/badge/Node.js-24-green)]()
 [![NestJS](https://img.shields.io/badge/NestJS-11.1-red)]()
 [![PostgreSQL](https://img.shields.io/badge/PostgreSQL-17-blue)]()

Session_starter.md

@@ -2,7 +2,47 @@
 
 **Last verified:** 2026-10-29
 
-### Current reviewed-master integration (2026-10-29)
+### Current advisory integration (2026-10-29)
+
+PR #260 merged normally at `287ea671abf1619d7b172c495310769078bd685b`
+after 28/28 protected Validate gates, seven successful exact-head checks and
+separate technical review. API units were 6,229, HTTP 2,514 plus 42 existing
+skips, and web 1,661 across 125 files. PR #259 is also merged.
+
+The existing 0.55.64 branch now normally integrates that reviewed master,
+preserving all constituent commits. Its qs 6.16.1 and fast-uri 4.2.3 changes
+remain separate from the Hono correction and performance tooling. Both
+historical preparation sections below are retained, not current status.
+Installed-graph verification, coordinated clean-CI lock confirmation,
+protected Validate, refreshed review and exact-head CI still own this head.
+Parent-union manifests/locks pass with zero non-root drift; clean API restore
+preserves both lock hashes and both complete npm inventories exit 0.
+No application, auth, UI, schema, deployment or release-admission change.
+All performance, data/restore, live/browser and operator-visual holds remain.
+
+| Date | Summary |
+|---|---|
+| 2026-10-29 | Normally merge reviewed API #260 at 0.55.63, then integrate its master into preserved advisory #261 at 0.55.64; new-head proof remains required. |
+
+### Historical stacked API advisory remediation (2026-10-29)
+
+Proposed 0.55.64 starts from exact draft #260 head
+`6eb1b59cb1a8ea324bb1a32b17355fabc605279d` on
+`fix/api-advisory-pins-20261029`. Only qs 6.16.1 and fast-uri 4.2.3
+are selected. Actual consumers are three qs owners and nested Ajv 8.20.0;
+its pre-existing forced major remains explicitly outside `^3.0.1`.
+Corrected RED before manifest edits: 11 failed, three passed, 14 tests.
+[Compatibility, advisory boundaries and RCA](docs/API_ADVISORY_CONSUMER_COMPATIBILITY.md)
+records why Hono 2.1.3 remains blocked by unproved actual Prisma lifecycle
+compatibility. No service is started and no other worktree is owned.
+CI-only run 40923567650, artifact 12918583682, changes exactly two API entries
+and no non-root web entry. Approved-feed bytes match authenticated SHA-512;
+clean API/web restores keep both lock hashes identical. Initial restored
+focus is 57/57 in three suites including 19 new checks; complete npm
+inventory exits 0 without problems. Final protected Validate remains required.
+PR #259/#260 are unmerged, #251 and every existing hold remain unchanged.
+
+### Historical reviewed-master integration for 0.55.63 (2026-10-29)
 
 PR #259 merged normally as `0a9b3d04535dc51dcfc58e9a2360c1c9e112a41a`
 after successful exact-head CI and a separate read-only technical review.

api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimserver-api",
-  "version": "0.55.63",
+  "version": "0.55.64",
   "description": "SCIMServer backend service providing SCIM 2.0 endpoints and logging for troubleshooting.",
   "license": "MIT",
   "main": "dist/main.js",
@@ -84,7 +84,7 @@
     "@hono/node-server": "1.19.15",
     "defu": "6.1.5",
     "effect": "3.20.0",
-    "fast-uri": "4.1.5",
+    "fast-uri": "4.2.3",
     "hono": "4.13.11",
     "multer": "2.5.0",
     "deepmerge-ts": "8.0.0",
@@ -110,7 +110,7 @@
     "js-yaml": "3.15.2",
     "node-releases": "2.0.57",
     "proxy-addr": "2.0.8",
-    "qs": "6.16.0",
+    "qs": "6.16.1",
     "valibot": "1.4.2"
   }
 }