Possible fix(deps): 4 vulnerable dependencies in package-lock.json

This might be a false positive, but `package-lock.json` around line 10869 looked worth a second pair of eyes.

The `fast-uri` package v3.1.5 suffers from a double-decoding vulnerability where percent-encoded hostnames are decoded twice during parsing and authority recomposition. This violates RFC 3986 and allows attackers to transform a doubly-encoded hostname into a different network destination (e.g., loopback) in a single operation. When applications normalize or resolve untrusted URIs prior to outbound routing or host-policy validation, this enables Server-Side Request Forgery (SSRF) and security policy bypasses. Risk Level: HIGH.

Something like this might fix it:

```diff
--- a/package.json
+++ b/package.json
@@ -X,Y +X,Y @@
"dependencies": {
- "fast-uri": "^3.1.5"
+ "fast-uri": "^3.1.6"
}
Apply this diff to `package.json`, then run `npm install` (or `yarn install`) to regenerate `package-lock.json` with the patched dependency.
```

For reference: rule `CVE-2026-75899`. Rated high.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---
*Found with automated scanning ([RedGem](https://code.redgem.net)) and reviewed before opening. If it is not useful, closing it is completely fine.*

Start with package.json and package-lock.json around line 10869, verify whether fast-uri is the affected dependency and whether the reported version is applicable. Run npm install or yarn install to regenerate the lockfile, then run the test suite; done means the patched dependency is recorded and tests pass.

Written by the indexing model from the issue text.