[jennifer-takagi]

Description of change

UXP-3896 fixed. UXP-4024 stays open, see below.

Bumps fast-uri 3.1.7 to 3.1.8 in the lockfile, closing one of the two audit
findings this repo can currently close.

What is wrong. npm audit reports 13 findings. One of them, fast-uri
under GHSA-hrr3-gc8f-f4qj, has a patched release available and nothing was
pulling it in. The other 12 all descend from a single root: braces at 3.0.3,
reached through @types/shelljs to fast-glob to micromatch. That is
Dependabot alert 85 and UXP-4024.

What this changes. One line in package-lock.json. npm audit fix applied
it, no range change in package.json, no new overrides.

Why the other 12 are still here. The braces advisory
GHSA-vfj7-8cjw-p6xm, stack exhaustion through deeply nested patterns, has a
patched range of <=3.0.3, which is to say every published version is affected
and no fix exists upstream yet. An overrides pin has nothing to pin to.
npm audit fix --force claims it can help, but its plan is four major
downgrades, and it says so itself in the same breath:

npm warn audit fix braces@3.0.3 It cannot be fixed automatically.
npm warn audit Updating @types/shelljs to 0.8.17, which is a SemVer major change.
npm warn audit Updating shelljs to 0.8.5, which is a SemVer major change.
npm warn audit Updating @ryansonshine/cz-conventional-changelog to 3.3.1, which is a SemVer major change.
npm warn audit Updating react-scanner to 1.1.0, which is a SemVer major change.

Downgrading react-scanner 1.2.0 to 1.1.0 would roll back the scanner this
repo exists to run, and it would not remove braces anyway. I left it.

Audit delta. 12 high and 1 moderate before, 11 high after. Nothing regressed.

Pruned overrides. None. The one entry, react-scanner > picomatch ^2.3.2,
is untouched. It is not one of the advisories in play, and I could not tell
from package.json alone whether it is a security pin or a compatibility one.

Coordinated PRs. None. This repo has no open Dependabot PRs.

Pull-Request Checklist

• Code is up-to-date with the main branch
• npm run lint passes with this change — N/A, no lint script. npx biome check ./src/ fails, identically on main, on a formatting error in src/. Pre-existing, untouched here.
• npm run test passes with this change — 3 tests, plus typecheck and build pass, and the husky pre-commit hook ran clean
• This pull request links relevant issues as Fixes #0000 — N/A, tracked in Jira, linked above
• There are new or updated unit tests validating the change — N/A, lockfile only
• Documentation has been updated to reflect this change — N/A
• The new commits follow conventions outlined in the conventional commit spec

How to review. The diff is one line. The claim worth a second opinion is
that braces is genuinely unfixable right now rather than something I gave up
on. Check the advisory's patched range yourself if you want to be sure.

🤖 Generated with Claude Code