chore(deps): remove GHSA-v2hh-gcrm-f6hx from osv-scanner.toml

[github-actions]

Summary

• Removed fast-uri GHSA-v2hh-gcrm-f6hx exclusion from osv-scanner.toml
• fast-uri was upgraded to 3.1.5, which includes the fix (vulnerability was fixed in 3.1.4)

GHSA ID	Package	Old → New Version	Advisory Resolved
GHSA-v2hh-gcrm-f6hx	fast-uri	3.1.3 → 3.1.5	CVE-2026-16221 (host confusion via literal backslash authority)

Verification Results

OSV Scanner (HIGH/CRITICAL only)

✅ Passes - fast-uri vulnerability no longer appears in scan results

Dependency Consistency Check

✅ Passes - yarn check-deps completed successfully

Still Blocked

All other exclusions in osv-scanner.toml remain valid due to:

• tar exclusions (9 CVEs): Constrained by swarm-js requiring tar <7.x while fixes are in tar 7.5.x+ versions
• minimatch exclusions (3 ReDoS CVEs): Fixes in minimatch 10.x+ break lerna v9 API compatibility
• sjcl exclusion (GHSA-2w8x-224x-785m): No upstream fix exists (first_patched_version: null)
• ws exclusion (GHSA-96hv-2xvq-fx4p): We use ws exclusively as WebSocket CLIENT, vulnerability affects server usage
• form-data, protobufjs, tmp exclusions: Risk mitigated by controlled usage patterns with trusted inputs only

Test Plan

• OSV scanner no longer flags fast-uri GHSA-v2hh-gcrm-f6hx
• yarn check-deps passes (dependency consistency maintained)
• Lockfile updated to reflect resolution changes
• All other exclusions remain appropriately justified

🤖 Generated with osv-scanner-prune automation

[s84krish]

flush, ci