fix(deps): pin fast-uri to ^3.1.7 to clear seven high-severity advisories

[asachs01]

Adopted from the downstream Tekscape-finance/connectwise-manage-mcp fork (Apache-2.0), with the version floor corrected.

What was already handled

Their fork carried three overrides. Two are already moot here:

Package	Their override	Our lockfile on main	Action
brace-expansion	^2	5.0.9 — outside every affected range	none needed
postcss	^8.5.23	8.5.26 — outside every affected range	none needed
fast-uri	>=3.1.5	3.1.0 — affected	pinned ^3.1.7

What this PR fixes

fast-uri reaches us as @modelcontextprotocol/sdk → ajv → fast-uri. ajv validates tool input schemas on the request path, so this is a reachable runtime dependency, not build-only.

3.1.0 is affected by seven high-severity advisories:

• GHSA-v2hh-gcrm-f6hx — host confusion via literal backslash authority delimiter (patched 3.1.4)
• GHSA-q3j6-qgpj-74h6 — path traversal via percent-encoded dot segments (patched 3.1.1)
• GHSA-v39h-62p7-jpjc — host confusion via percent-encoded authority delimiters (patched 3.1.2)
• GHSA-4c8g-83qw-93j6 — host confusion via failed IDN canonicalization (patched 3.1.3)
• GHSA-7p8r-x3mc-p8w7 — host confusion via backslash authority introducer (patched 3.1.5)
• GHSA-f65p-4m7j-42xc — SSRF via malformed IPv6 normalization (patched 3.1.6)
• GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization (patched 3.1.6)

Why ^3.1.7 and not their >=3.1.5: the last two above, plus GHSA-5jgf-p345-68v8, are only patched in 3.1.6. A >=3.1.5 floor would still resolve a vulnerable tree. ^3.1.7 picks up the current 3.x and stays inside the major ajv expects.

An overrides entry is the only lever available: the SDK pins ajv, and ajv pins fast-uri. The lockfile diff is 3 lines.

Known remaining, deliberately not in this PR

npm audit --omit=dev still reports 7 findings, all transitive through @modelcontextprotocol/sdk's Express/Hono server helpers (hono, @hono/node-server, express-rate-limit, body-parser, path-to-regexp, qs, ip-address). This server does not import those helpers — src/index.ts uses node:http createServer plus StreamableHTTPServerTransport directly, and src/worker.ts uses the Web Standard transport. Pinning seven floors inside a vendored SDK's own dependency tree is churn that will conflict with the next SDK bump, so that belongs in an SDK upgrade rather than here. Flagging it so the decision is explicit rather than forgotten.

Verification

$ npm ls fast-uri --all
@wyre-ai/connectwise-manage-mcp@1.4.0
└─┬ @modelcontextprotocol/sdk@1.30.0
  └─┬ ajv@8.18.0
    └── fast-uri@3.1.7

$ npm run build      # tsc, exit 0
$ npm run lint       # eslint src, no findings
$ npm test
 Test Files  10 passed (10)
      Tests  98 passed (98)

npm audit no longer reports fast-uri.

Attribution

Vulnerability surfaced by @Tekscape-finance in their Apache-2.0 fork. Their brace-expansion and postcss overrides were checked and found unnecessary against our current lockfile; their fast-uri floor was raised from >=3.1.5 to ^3.1.7.

https://claude.ai/code/session_017zLZUG2AxhqhSFL4CTiUAb

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Security

  • Updated a transitive dependency to address seven high-severity security advisories.

• New Features

  • Added support for interactive ticket cards through MCP Apps.
  • Added package publishing to the GitHub Packages npm registry.

• Documentation

  • Clarified the cloud deployment flows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 432e88a3-987c-4be2-90a7-ee7af252285a

📥 Commits

Reviewing files that changed from the base of the PR and between c97f568 and 13f6467.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (2)

• CHANGELOG.md
• package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The project pins the transitive fast-uri dependency to ^3.1.7 through npm overrides. The changelog documents the prior vulnerable resolution and the security remediation.

Changes

Security dependency update

Layer / File(s)	Summary
Pin fast-uri and document remediation package.json, CHANGELOG.md	package.json adds an npm override for fast-uri at ^3.1.7. CHANGELOG.md records the seven high-severity advisories affecting the previous 3.1.0 resolution.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix · Severity of issue fixed: High

Suggested reviewers: arutherford

Merge Risk: ⚪ Minimal · up to 13f64

The security dependency update is ready to merge with no remaining actionable risk identified.

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: pinning the transitive fast-uri dependency to version ^3.1.7 to address seven high-severity advisories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Changelog Entry	✅ Passed	The PR edits CHANGELOG.md beneath the root ## [Unreleased] heading. It adds a ### Security entry for the fast-uri override and related advisories. This satisfies the changelog check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependency-security-overrides

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/dependency-security-overrides

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}