build(deps): pin fast-uri and qs to patched versions

[markus-azer]

What

Pin fast-uri and qs via pnpm overrides. Drop the stale brace-expansion audit ignore.

Why

Closes 5 of 7 open Dependabot alerts.

How to verify

• pnpm audit --audit-level=high passes

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Team

Run ID: e6cb7f19-2850-4cdb-b78f-7d606948ca31

📥 Commits

Reviewing files that changed from the base of the PR and between df52d95 and d848ab2.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The workspace configuration now overrides fast-uri to 3.1.6 and qs to 6.16.0. It removes the previous GHSA-mh99-v99m-4gvg audit-ignore entry.

Merge Risk: ⚪ Minimal · up to d848a

This updates the resolved fast-uri and qs versions and removes an obsolete audit exception. The dependency-resolution configuration is synchronized and no merge-blocking risk is evident.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary change: pinning fast-uri and qs to patched versions through dependency overrides.
Description check	✅ Passed	The description directly explains the dependency pinning, removal of the stale audit ignore, intended alert reduction, and verification command.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch build/pin-vulnerable-deps

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Code Review ✅ Approved

Pins fast-uri and qs to patched versions via pnpm overrides and drops the stale brace-expansion audit ignore, resolving 5 of 7 Dependabot alerts. No issues found.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with no actionable regressions identified.

The patched overrides are reflected consistently in the lockfile, affected runtime dependency paths remain compatible, and the unrelated-looking lockfile changes are coherent transitive deduplication.

_{Reviews (1): Last reviewed commit: "chore(deps): drop stale brace-expansion ..." | Re-trigger Greptile}

[Copilot]

🟡 Changes recommended

The lockfile includes additional transitive upgrades beyond what the PR description claims, so the scope needs to be clarified or narrowed before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Pins vulnerable transitive dependencies in the pnpm workspace using overrides, and updates the lockfile to match. This aims to reduce open Dependabot alerts by forcing patched versions to be used across the repo.

Changes:

• Add pnpm overrides to pin fast-uri to 3.1.6 and qs to 6.16.0.
• Remove the brace-expansion audit ignore entry from workspace config.
• Update pnpm-lock.yaml to reflect the new overrides and refreshed resolution.

File summaries

File	Description
pnpm-workspace.yaml	Adds overrides for fast-uri and qs, and removes the stale auditConfig ignore block.
pnpm-lock.yaml	Records the new overrides and updates resolved dependency versions accordingly.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 1/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}