fix: pin fast-uri to clear the release audit gate

[stephane-segning]

1. Summary

This PR changes:

• Adds a pnpm overrides entry pinning the transitive dependency fast-uri to ^3.1.4 in pnpm-workspace.yaml.
• Refreshes pnpm-lock.yaml accordingly (fast-uri 3.1.2 → 3.1.4; no other resolution changes).

It solves:

• The 0.9.0 publish run failed at the pnpm audit --audit-level=high --prod gate: github.com/vymalo/opencode-oauth2/actions/runs/30376856510. Two high-severity advisories on fast-uri@3.1.2 — GHSA-v2hh-gcrm-f6hx and GHSA-4c8g-83qw-93j6 (both host-confusion issues, both fixed in 3.1.4) — blocked the entire workflow before any build/test/publish step ran. fast-uri is pulled in transitively via @modelcontextprotocol/sdk → ajv (and ajv-formats → ajv), a dependency of opencode-browser-mcp and opencode-devtools-mcp; the packages don't use fast-uri directly, so no application code changes.

---

2. Intent

The intent of this PR is:

Clear the audit gate so publish.yml can run to completion for the 0.9.0 release line (already merged: #68, #69). gh workflow run publish.yml -f dry_run=false will be re-triggered against main once this merges.

---

3. Scope

In Scope

• pnpm-workspace.yaml: overrides.fast-uri: ^3.1.4.
• pnpm-lock.yaml: regenerated via pnpm install.

Out of Scope

• Any other dependency bump or audit finding (the remaining 5 findings are low/moderate, under the workflow's --audit-level=high threshold, and out of scope for this fix).
• Re-triggering publish.yml — happens as a separate workflow_dispatch after this merges.

Note on package.json vs pnpm-workspace.yaml

I initially added the override under pnpm.overrides in the root package.json (the pre-pnpm-10 convention this repo's own inline comments still reference elsewhere). pnpm install warned that pnpm 11 no longer reads that field — overrides now live in pnpm-workspace.yaml, where I moved it.

---

4. Verification

I verified this change by:

• Running automated tests
• Checking logs
• Running manual tests
• Checking metrics
• Testing error cases
• Testing permissions/security behavior
• Testing rollback or failure behavior, if relevant

Commands run:

pnpm why fast-uri
pnpm audit --audit-level=high --prod
pnpm -r build
pnpm -r typecheck
pnpm coverage
pnpm lint
pnpm format:check

Results:

pnpm why fast-uri: fast-uri@3.1.4 (was 3.1.2) — single resolved version, via ajv > @modelcontextprotocol/sdk
pnpm audit --audit-level=high --prod: 5 vulnerabilities found, Severity: 1 low | 4 moderate — exit 0 (no high/critical)
pnpm -r build: all 10 buildable packages/apps succeeded
pnpm -r typecheck: all packages succeeded
pnpm coverage: all packages passed their per-package thresholds, exit 0
pnpm lint / pnpm format:check: no issues (242 files checked)

---

5. Screenshots / Evidence

Add evidence here:

• Screenshot: N/A
• Logs: failed run 30376856510 (audit step); local re-run of the same pnpm audit --audit-level=high --prod command now exits 0
• Metrics: N/A
• Recording: N/A

---

6. Risk Assessment

Risk level:

• Low

Potential risks:

• An override forces ajv's dependency resolution away from what it originally shipped with — in principle ajv/ajv-formats could behave differently against a newer transitive fast-uri.

Mitigation:

• 3.1.2 → 3.1.4 is a patch-level bump within the same major/minor of fast-uri, both CVE fixes are described as host-confusion parsing fixes (not API changes), and the full build/typecheck/test/coverage suite passed unchanged across all 11 packages after the bump.

---

7. AI Usage Declaration

AI was used for:

• Understanding existing code
• Generating code
• Refactoring
• Generating tests
• Drafting documentation
• Reviewing the diff
• Not used

Human verification:

• I understand every meaningful change in this PR
• I checked generated code manually
• I checked generated tests manually
• I removed unsupported AI assumptions
• I accept responsibility for this PR

---

8. Reviewer Focus

Please focus your review on:

• Correctness
• Architecture
• Security
• Performance
• Tests
• Maintainability
• Product intent
• Edge cases

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4ac6602

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

✅ AI Governance check passed

This PR declares AI usage, references a source of truth, and provides verification evidence. Thank you.