From a97699e2896ea75c8535420341894ce9dcac342f Mon Sep 17 00:00:00 2001
From: Sean Fisher <srtfisher@gmail.com>
Date: Fri, 12 Jun 2026 16:14:44 -0400
Subject: [PATCH] Fix high-severity npm audit failure (fast-uri)

The CI Node Tests step runs `npm audit --audit-level=high --omit=dev`,
which failed on fast-uri <=3.1.1 (path traversal GHSA-q3j6-qgpj-74h6 and
host confusion GHSA-v39h-62p7-jpjc), pulled in transitively via ajv and
the @wordpress/* packages.

Add an npm override pinning fast-uri to ^3.1.2 (the patched 3.x release,
compatible with ajv's ^3.0.1 constraint). Resolves the only high-severity
advisory; the remaining moderates are tolerated by --audit-level=high,
consistent with #536.
---
 package-lock.json | 6 +++---
 package.json      | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index f825cd38..9e76237e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -23031,9 +23031,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.0.6.tgz",
-      "integrity": "sha512-Atfo14OibSv5wAp4VWNsFYE1AchQRTv9cBGWET4pZWHzYshFSS9NQI6I57rdKn9croWVMbYFbLhJ+yJvmZIIHw==",
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
+      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
       "devOptional": true,
       "funding": [
         {
diff --git a/package.json b/package.json
index 64c170e9..22b4878f 100644
--- a/package.json
+++ b/package.json
@@ -51,5 +51,8 @@
     "ts-jest": "^29.4.5",
     "typescript": "^5.9.3",
     "webpack-cli": "^6.0.1"
+  },
+  "overrides": {
+    "fast-uri": "^3.1.2"
   }
 }