fix(deps): patch fast-uri and humanfs security alerts

[John Kennedy (jkennedyvz)]

Description

Patch the two vulnerable transitive dependencies behind all five currently open Dependabot alerts. No application code changes or alert dismissals.

• fast-uri: 3.1.5 → 3.1.6, including the existing npm override. Used through electron-store → conf → AJV.
• @humanfs/node: 0.16.7 → 0.16.8, used by ESLint. Includes required @humanfs/core 0.19.2 and @humanfs/types 0.15.0 dependencies.
• Only package.json and package-lock.json change. Lockfile regenerated with targeted npm update, not manually edited.

Related Issue

Alert	Advisory	Patched resolution
#83	GHSA-5jgf-p345-68v8	fast-uri 3.1.6
#84	GHSA-fph4-wmhf-6fwf	fast-uri 3.1.6
#85	GHSA-p498-v437-472g	@humanfs/node 0.16.8
#86	GHSA-f65p-4m7j-42xc	fast-uri 3.1.6
#87	GHSA-jqff-g426-hqxp	fast-uri 3.1.6

Dependency presence is verified; this does not assert that the application exposes the advisories' full exploit paths. Available narrow patches are preferable to speculative non-exploitability dismissals. Alerts remain open until merged and rescanned.

Type of Change

• Bug fix (non-breaking change that fixes an issue)

Checklist

• I have read the Contributing Guide
• I have tested my changes locally
• Required dependency releases are published

Test Plan

Validated on Linux, Node 24.18.1 / npm 11.16.0. CI uses Node 20; remote CI results are separate.

• Socket checks for all four changed/new package resolutions
• sfw npm ci --ignore-scripts --no-audit --no-fund
• sfw npm audit --json: zero vulnerabilities
• Automated comparison of every installed target version with all five GitHub advisory ranges and first-patched versions
• Automated lockfile diff check: only the four intended dependency nodes changed
• npm run lint: zero errors, three formatting warnings in unchanged renderer files
• npm run typecheck
• npm run build: succeeds, with a dynamic/static-import warning in unchanged DB code
• git diff --check

Additional Notes

Install scripts were disabled locally; Electron GUI startup was not tested. Existing metadata/config warnings: npm reports an unknown node-linker setting; npm ls reports ESLint 10 outside the React plugins' peer ranges. These dependency versions and source files are unchanged. CI and CONTRIBUTING use npm and the repository tracks only package-lock.json, despite its pnpm packageManager field; that inconsistency is left out of scope. The existing .gitignore lacks common secret-file patterns; no secret files were staged and no unrelated ignore changes are included.