Fix failing npm audit in the TypeScript SDK

[jeremy]

Problem

The npm Audit (TypeScript SDK) CI step (npm audit --audit-level=high in typescript/) fails on main:

fast-uri  3.0.0 - 3.1.5
Severity: high
  - GHSA-5jgf-p345-68v8  host confusion via skipped IDN canonicalization
  - GHSA-f65p-4m7j-42xc  SSRF via malformed IPv6 normalization
  - GHSA-fph4-wmhf-6fwf  SSRF via repeated hostname percent-decoding
  - GHSA-jqff-g426-hqxp  host confusion via percent-encoded scheme normalization
node_modules/@redocly/ajv/node_modules/fast-uri
1 high severity vulnerability

• Package: fast-uri, high severity, fixed in 3.1.6.
• Path: transitive, dev-only — openapi-typescript (devDependency) → @redocly/openapi-core → @redocly/ajv → fast-uri. No runtime/published exposure.
• Root cause: the existing overrides entry already pinned fast-uri for security, but its lower bound (>=3.1.5 <4) still permitted the now-vulnerable 3.1.5.

Fix

Raise the existing override bound to >=3.1.7 <4 and regenerate package-lock.json. This stays within the 3.x major (non-breaking), matches how the repo already handles audit exceptions (the overrides block), and touches only the TypeScript package + its lockfile — no other-language SDK output.

Verification (local, Node 24 as in CI)

• npm audit --audit-level=high → found 0 vulnerabilities
• npm run build → pass
• npm run typecheck → pass
• npm test → 1698 passed (87 files)
• Lockfile diff is limited to fast-uri (bumped 3.1.5 → 3.1.7, hoisted/deduped).

---

Summary by cubic

Fixes the failing npm audit step in the TypeScript SDK by raising the fast-uri override bound from >=3.1.5 <4 to >=3.1.7 <4 and regenerating the lockfile, so npm resolves the patched 3.1.7 instead of the vulnerable 3.1.5.

Bug Fixes

• The vulnerable fast-uri reaches the tree transitively via the openapi-typescript devDependency and never ships in runtime output.
• Verified locally on Node 24 that audit reports 0 vulnerabilities and build, typecheck, and all 1698 tests pass.

^{Written for commit fc4b3af. Summary will update on new commits.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T18:12:33.561536Z	fc4b3af	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approval recommended

The override and lockfile consistently resolve the reported vulnerability without runtime code changes.

Pull request overview

Updates the TypeScript SDK’s transitive fast-uri dependency to a secure 3.x release.

Changes:

• Raises the override minimum to 3.1.7.
• Regenerates the lockfile, hoisting and deduplicating the dependency.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File summaries

File	Description
typescript/package.json	Requires the patched dependency version.
typescript/package-lock.json	Locks fast-uri at 3.1.7.

Review details

Files not reviewed (1)

• typescript/package-lock.json: Generated file

• Files reviewed: 1/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[cubic-dev-ai]

No issues found across 2 files

_{You’re at about 93% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.}

_{Re-trigger cubic}