#87 chore(deps): fast-uri 3.1.8 (2 high advisories), vitest 5.0.2, typescript 7.0.2

What

This PR changes manifests and the lockfile only. There are three commits, one per change, so any of them can be reverted on its own.

Commit	Package	main	this PR	Why
e68de9f	fast-uri (transitive, via conf → ajv)	3.1.6	3.1.8	GHSA-qw65-cvwx-89v3 (high, authority injection via an unvalidated port), GHSA-58mr-gqgx-xq4g (high, host confusion via an unclosed bracket) and GHSA-hrr3-gc8f-f4qj (moderate), all published 2026-09-28/29. npm audit fix, no --force.
ecf8c36	vitest (dev)	^4.0.16 → 4.1.11	^5.0.2 → 5.0.2	npm latest (5.0.2, published 2026-09-25). Major, kept because every test passes unchanged.
5ceb2a2	typescript (dev)	^5.9.3 → 5.9.3	^7.0.2 → 7.0.2	npm latest (7.0.2, published 2026-07-08). Major, kept because tsc --noEmit passes.

Versions and dates come from the npm registry, queried 2026-09-30. Advisory severities and dates come from gh api /advisories/<id>.

npm audit: 1 high, 1 low → 1 low. The remaining finding is esbuild GHSA-g7r4-m6w7-qqqr, which only affects the esbuild dev server on Windows. It comes in through tsup@8.5.1, which pins esbuild ^0.27.0.

Why this is safe

• TS 7 and the build. tsup.config.ts has no dts option, so npm run build is esbuild-only. The TS 7 rollup-plugin-dts crash seen in the sdk repo's trial can't happen here. tsc is used only for npm run type-check.
• vitest 5 and node 20. vitest 5 declares engines.node ^22.12.0 || ^24.0.0 || >=26.0.0. The unit job runs tests on node 22. smoke-install also runs on node 20, but only for npm ci, build and pack. On node 20 those print an EBADENGINE warning and still succeed. chalk@6 (already on main) prints the same warning today.
• Dependabot #83 carries the same fast-uri change. Close it if this merges first.

Receipts (local; GitHub Actions currently ends every run in startup_failure, runner=null)

Fresh clone of main at 9d7ee87. Node v22.23.3 / npm 10.9.9 unless noted.

Step	main	this branch
npm ci	rc=0	rc=0 (clean install from the committed lockfile)
npm run type-check	rc=0 (tsc 5.9.3)	rc=0 (tsc 7.0.2)
npm run build	rc=0	rc=0
npm test	14 files, 139 passed (vitest 4.1.11)	14 files, 139 passed (vitest 5.0.2)
node dist/index.js --version	n/a	1.0.10
node v20.20.2: npm ci --include=dev, npm run build, npm pack	n/a	rc=0 / rc=0 / rc=0

I also ran vitest 5 and TS 7 as separate trials before committing, and each passed on its own. npm run lint fails on both main and this branch with eslint: command not found: eslint isn't a devDependency, and no workflow runs lint (see the note in _release-verify.yml). This PR leaves that alone.

Not in this PR

• inquirer 14, open 11, ora 9 and zod 4 are runtime majors, outside the key-dependency sweep.
• Open PRs #84 and #86 also touch package.json/package-lock.json. Whichever merges second needs npm install to regenerate the lockfile.

This PR is part of a go-live sweep of key dependencies across the WAVE repositories.

Not merged. Opened for review.

🤖 Generated with Claude Code

---

[!NOTE]
Medium Risk
Major dev-tool upgrades can surface new type errors or test-runner behavior on some Node versions; vitest 5’s engine requirement is stricter than package.json’s >=18, though CI reportedly runs Node 22 for tests.

Overview
Bumps dev tooling and refreshes the lockfile to address security and major-version updates, with no application source changes.

package.json raises TypeScript from ^5.9.3 to ^7.0.2 and Vitest from ^4.0.16 to ^5.0.2. The lockfile follows with TS 7’s platform-specific optional packages, Vitest 5’s slimmer dependency graph (fewer @vitest/* subpackages), and transitive bumps including fast-uri 3.1.8 (security advisories), rolldown/vite/postcss, and related build-tool peers marked "peer": true.

Runtime dependencies and CLI behavior are unchanged; impact is limited to npm run type-check, npm test, and CI install/build gates.

^{Reviewed by Cursor Bugbot for commit 5ceb2a2bbd23d3dc5848a08fd3b3c4afc3b7f7e7. Bugbot is set up for automated code reviews on this repo. Configure here.}