fix(deps): patch fast-uri, qs, uuid to close 7 Dependabot alerts

[SingleSourceStudios]

Summary

Closes the 7 open Dependabot alerts (4 High, 3 Moderate) for transitive dependencies appearing in both package-lock.json (root) and editors/vscode/package-lock.json. Alerts auto-close once the vulnerable versions are gone from the lockfiles on main.

Alert to fix mapping

Package	GHSA	Severity	Manifests	Was	Now
fast-uri	GHSA-q3j6-qgpj-74h6 (path traversal)	High	root + vscode	3.1.0	3.1.2
fast-uri	GHSA-v39h-62p7-jpjc (host confusion)	High	root + vscode	3.1.0	3.1.2
qs	GHSA-q8mj-m7cp-5q26 (stringify DoS)	Moderate	root + vscode	6.15.1	6.15.2
uuid	GHSA-w5hq-g745-h8pq (buffer bounds)	Moderate	vscode	8.3.2	removed

That is 4 High (fast-uri, 2 advisories across 2 manifests) plus 3 Moderate (qs across 2 manifests, uuid in vscode).

Override vs bump, and why

• fast-uri (override). Pulled transitively by ajv in both trees (@logic-md/core -> ajv at root; @vscode/vsce -> @secretlint -> ajv in vscode). ajv depends on fast-uri@^3.x, so pinning ^3.1.2 stays inside its range. No direct parent bump removes it cleanly, so an overrides entry is the least invasive fix.
• qs (override). Pulled by express (root, via @modelcontextprotocol/sdk) and typed-rest-client (vscode, via @vscode/vsce). Both accept qs@^6.x, so ^6.15.2 is in range. Override.
• uuid (no override needed). Pulled by @azure/msal-node@5.1.3 (vscode, via @vscode/vsce -> @azure/identity). The fixed line is 11.1.1, a major jump from 8.x. Regenerating the lockfile resolved @azure/msal-node to 5.2.2, which drops the uuid dependency entirely. No uuid remains in the vscode lockfile, so no override is warranted. msal-node only imports { v4 } from uuid (verified), so nothing downstream relies on the old buffer API.

Overrides live in package.json (root: fast-uri, qs) and editors/vscode/package.json (fast-uri, qs). Both lockfiles were regenerated from a clean install.

Verification

• npm audit: 0 vulnerabilities in root and in editors/vscode; npm audit --audit-level=high clean in both.
• Resolved versions confirmed: fast-uri 3.1.2, qs 6.15.2 in both trees; zero uuid in the vscode lockfile.
• npm run build:core and full npm run build (core, cli, mcp): success.
• npm test: 473 passed, 0 failed.
• npm run typecheck: clean.
• npm run lint: unchanged from baseline (5 errors / 22 warnings, all in untouched vscode/cli/executor files; the two changed package.json files lint clean).
• node spec/fixtures/run-fixtures.mjs: 29 passed, 0 failed.

The clean reinstall also incidentally resolved a brace-expansion Moderate advisory in the vscode tree that was not among the 7 Dependabot alerts.

---

Summary by cubic

Patches transitive dependencies to close 7 Dependabot alerts by overriding fast-uri and qs, and removing vulnerable uuid via a parent update. Both lockfiles were regenerated; security advisories are cleared without code changes.

• Dependencies

  • Added overrides for fast-uri@^3.1.2 and qs@^6.15.2 in root and editors/vscode/package.json.
  • @azure/msal-node resolved to 5.2.2 in the VS Code tree, which drops uuid; no uuid override needed.
  • Regenerated root and editors/vscode lockfiles.

• Verification

  • npm audit: 0 vulnerabilities in root and editors/vscode.
  • Builds and tests pass (build, typecheck, lint baseline unchanged, 473 tests green).

^{Written for commit 83efed8. Summary will update on new commits. Review in cubic}

Summary by CodeRabbit

• Chores
  • Updated dependency versions to maintain stability and compatibility across the project.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 81d9f7a6-eda4-4306-b9f9-fca44220ac92

📥 Commits

Reviewing files that changed from the base of the PR and between 4e5640e and 83efed8.

⛔ Files ignored due to path filters (2)

• editors/vscode/package-lock.json is excluded by !**/package-lock.json
• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• editors/vscode/package.json
• package.json

---

📝 Walkthrough

Walkthrough

This PR adds dependency version overrides to both the root and VS Code extension package manifests, pinning fast-uri to ^3.1.2 and qs to ^6.15.2 across the project.

Changes

Dependency Version Pinning

Layer / File(s)	Summary
Pinned dependency versions package.json, editors/vscode/package.json	Added overrides blocks to pin fast-uri and qs package versions in both root and extension manifests.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 Two packages bound with care,
fast-uri and qs held fair,
Versions pinned both root and ext,
Dependency locks vex not a hex!
Harmony restored, smooth sailing ahead! 🎯

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is comprehensive and includes the required Summary section. However, it lacks the required Linked issue, Spec impact, and Checklist sections from the repository template.	Add the 'Linked issue' section, complete the 'Spec impact' checkboxes, and fill out the 'Checklist' section to verify all tests and build steps pass.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: patching three dependencies to close Dependabot alerts. However, it mentions uuid but the summary shows uuid was removed via lockfile regeneration, not patched directly.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/deps-fast-uri-qs-dependabot

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

No issues found across 4 files

_{Re-trigger cubic}