fix(deps): override fast-uri to 3.1.5 (GHSA-7p8r-x3mc-p8w7)

[askalf]

Summary

fast-uri is pulled in transitively via @modelcontextprotocol/sdk -> ajv, resolving to 3.1.4 with no override in place — GHSA-7p8r-x3mc-p8w7 / CVE-2026-18446 (high, CVSS 7.5).

Host-confusion bug: fast-uri doesn't recognize \, /\, \/ as an authority introducer, but Node's native WHATWG URL/fetch treats backslash as equivalent to / for http(s) — so the two parsers can extract different hosts from the same string. Patched in 3.1.5.

Added "fast-uri": "^3.1.5" alongside the existing @hono/node-server override (hono itself already resolves to the patched 4.13.0, no separate fix needed there). Fixes Dependabot alert #10 and the corresponding Scorecard "Vulnerabilities" code-scanning finding (#23).

Test plan

• npm install — found 0 vulnerabilities
• npm ls fast-uri confirms resolution to fast-uri@3.1.5
• npm test — 17/17 pass

[sprayberry-reviewer]

Automated review from the Sprayberry Labs fleet code reviewer.

Verdict: Clean — no blocking issues. Approving.

What I checked

• gh pr diff — the full change is two files: a package.json override addition and the matching package-lock.json bump.
• package.json:

    "@askalf/redstamp": "$@askalf/redstamp",
  -   "@hono/node-server": "^2.0.5"
  +   "@hono/node-server": "^2.0.5",
  +   "fast-uri": "^3.1.5"
  

  Adds a version override forcing the transitive fast-uri dependency (pulled in via @modelcontextprotocol/sdk → ajv) to ^3.1.5, which patches GHSA-7p8r-x3mc-p8w7 (host-confusion between fast-uri's URL parsing and Node's native WHATWG URL/fetch). Syntax is valid — the new key is a plain sibling override, comma correctly added.
• package-lock.json shows the resolved version, tarball URL, and integrity hash all updated to 3.1.5 consistently — no partial/mismatched lockfile entries.
• CI check-rollup: test, CodeQL (analyze javascript-typescript), and truecopy gate (verify pinned tool surface) are all SUCCESS as of the latest run.
• No prior review by this bot exists on this PR.

What's good

• Scoped, single-purpose security fix with a clear CVE citation and a documented test plan (npm ls fast-uri, npm install, npm test) in the PR body.
• Lockfile and manifest changes are consistent with each other — no drift between the override and the resolved version.

No correctness, security, or coverage issues found in the changed lines.