chore(deps): simplify fast-uri dependency and update Ajv resolver

[dependabot]

Summary

Update the URI resolver actually used by the SDK's schema validators and remove an unused direct dependency.

Changes

• Remove the direct fast-uri dependency: SDK source and build scripts do not import it.
• Update the SDK lockfile's Ajv 8.18.0 and 8.20.0 resolutions from fast-uri 3.1.6 to 3.1.7, within their declared ^3.0.1 range.
• Use the upstream v3.1.7 security backport. Installing a separate direct v4 copy left both Ajv consumers on v3.1.6.

Testing

• Frozen-lockfile installation with pnpm 11.19.0.
• 150 focused Bun tests passed across contract validation, project configuration, custom validation, findings import, deduplication, and patch-risk contracts.
• pnpm run types, pnpm run format, and pnpm run build:ci passed.
• pnpm pack --pack-destination ../../dist passed; check-package.mjs validated all 488 archive entries.
• Node 22.13.0 smoke check confirmed Ajv loads fast-uri 3.1.7 and resolves relative external schema references correctly.
• Reviewed upstream release notes and exact shipped source/types for 3.1.6, 4.1.4, and 3.1.7. The final 3.1.7 update retains the 3.1.6 public types.

Risk and rollout

The change retains Ajv's supported dependency major and the SDK's existing Node support. URI parsing gains the published port and bracket fixes. Normal dependency installation applies the lockfile update; no configuration migration is required. Existing schema, credential, path, and scan-integrity protections remain in place.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-11T20:05:37.581934Z	d767bc4	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

Reviewed the dependency consumers and upstream source. Removing the unused direct pin while updating Ajv's supported v3 resolver leaves one fast-uri version in the SDK lockfile. All current-head CI checks pass. Type, build and package checks also pass with the TypeScript 7 upgrades already on main.