# Continuity ledger (per-branch)

## Human intent (must not be overwritten)

- Resolve Dependabot alerts:
  - https://github.com/giselles-ai/giselle/security/dependabot/182 (CVE-2026-6321 / GHSA-q3j6-qgpj-74h6) — fast-uri path traversal via percent-encoded dot segments.
  - https://github.com/giselles-ai/giselle/security/dependabot/186 (CVE-2026-6322 / GHSA-v39h-62p7-jpjc) — fast-uri host confusion via percent-encoded authority delimiters.

## Goal (incl. success criteria)

- Bump transitive `fast-uri` to >= 3.1.2 so both alerts close.
- Keep the change minimal and consistent with prior CVE bumps tracked under `pnpm.overrides`.

## Constraints/Assumptions

- `fast-uri` enters the tree transitively via `ajv@8.18.0`.
- Direct override is the simplest fix; no app/package consumes `fast-uri` directly.

## Key decisions

- Add `"fast-uri": "3.1.2"` to `pnpm.overrides`. 3.1.2 is the latest release and covers both #182 (>=3.1.1) and #186 (>=3.1.2).

## State

- `package.json` `pnpm.overrides.fast-uri` set to `3.1.2`.
- `pnpm install` resolved `fast-uri@3.1.2`.

## Done

- Added override.
- Ran `pnpm install`, `pnpm format`, `pnpm build-sdk`, `pnpm check-types`, `pnpm test`.

## Now

- Commit and open PR referencing both alerts.

## Next

- Wait for review/merge.

## Open questions (UNCONFIRMED if needed)

- None.

## Working set (files/ids/commands)

- `package.json` (pnpm.overrides)
- `pnpm-lock.yaml`
- Dependabot alerts #182, #186
