chore(deps-dev): bump fast-uri from 3.1.3 to 3.1.5

[dependabot]

Bumps fast-uri from 3.1.3 to 3.1.5.

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

Commits

• 5e179cb Bumped v3.1.5
• 2cad02d Merge commit from fork
• 6aeece6 Bumped v3.1.4
• 2d50fba fix: reject literal backslash in URI authority
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[clestons]

✅ APPROVE — 这是补两个 High 级 advisory，不是例行 bump [2-round]

fast-uri 3.1.3 → 3.1.5 一次性关掉两个 GitHub High 级安全公告（都是 host confusion 类）：

GHSA	严重度	受影响范围	修复版本
GHSA-7p8r-x3mc-p8w7 — host confusion via backslash authority introducer	High	>= 3.0.0, < 3.1.5	3.1.5
GHSA-v2hh-gcrm-f6hx — host confusion via literal backslash authority delimiter	High	>= 3.0.0, <= 3.1.3	3.1.4

3.1.3 两条都中，3.1.5 两条都出。

但请按实际暴露面看，别过度反应：fast-uri 在本仓库是 "dev": true 的传递依赖（经 ajv 进来，package.json 里没有直接声明），不进部署产物 —— 暴露面是构建期工具链，不是线上应用。所以是「该合、但不用半夜爬起来合」。

diff 本身已逐项核对

项	PR 里写的	npm registry 实际
resolved	https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz	完全一致	✅
integrity	sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==	逐字节一致	✅
影响面	单包、devDependency、lockfile-only、无传递漂移		✅
维护者	jsumners / delvedor / matteo.collina / …	未变	✅

---

唯一值得记一笔的：这是本 lockfile 里第一条 npmjs.org 条目

-      "resolved": "https://registry.npmmirror.com/fast-uri/-/fast-uri-3.1.3.tgz",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",

实测本仓库 package-lock.json 现状：npmmirror.com 条目 1269 条，npmjs.org 条目 0 条。也就是说 dependabot 把唯一一条掰到了官方源上。

方向本身是安全的那一侧（npmjs.org 是权威源），而且仓库 .npmrc 里只有 legacy-peer-deps=true、没有 pin registry，npm 默认就走 npmjs.org，加上 integrity 是内容寻址的 —— 所以这条不会让安装失败，不阻塞。

要注意的是它会来回摆：任何一台配了镜像的机器下次 npm install 又会把它写回 npmmirror，于是 lockfile 反复产生与代码无关的 diff。这个仓库没有 .github/dependabot.yml（已核实），所以现在也没有地方能配置这个行为。建议二选一：

• 想统一走官方源 → 让 dependabot 把剩下 1269 条一次性迁完（单开一个 PR），别一条一条掰；
• 想继续用镜像 → 在 .npmrc 里显式 registry=https://registry.npmmirror.com，让所有人的 npm install 产出一致的 lockfile。

顺带一提：Cos72#27 那次同类的 npmmirror→npmjs 翻转当时被漏掉了，所以这已经是第二次。值得一次性定下来，而不是每个 dependabot PR 各自面对一次。

---

_{PK Review v4 · 2 轮（纯 lockfile devDependency 版本号 bump，未触碰 src/contract/auth）：R1a/R1b DeepSeek-v4-flash 两遍并行 → 执行器裁决。R1a 这轮很准，一条 Low 正中 registry 翻转。未跑 Codex PK —— 纯 bump 无可挑战的 finding。机械证据：curl registry.npmjs.org/fast-uri/3.1.5 核对 integrity 与 tarball URL；GitHub Advisory API 取两条 GHSA 的受影响范围与修复版本；grep -c 统计本仓库 lockfile 的 registry 分布（1269 / 0）；.npmrc 与 package.json 原文核实 fast-uri 为传递 devDependency。}