Security: 1 high/critical advisory(ies) in dependencies

[github-actions]

• fast-uri (high, transitive)
  • fix: yes
  • fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative references
  • fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
  • fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
  • fast-uri vulnerable to host confusion via percent-encoded scheme normalization

---

Found by Security Audit. Updated automatically; closes itself when npm audit --audit-level=high is clean.

If a fix needs a transitive pin Dependabot cannot express, add an overrides entry to package.json.