fix(deps): re-resolve svgo + fast-xml-parser + fast-uri to clear osv-scanner (#638)

[isadeks]

What & why

osv-scanner (required check Secrets, deps, and workflow scan → Dependency scan (osv-scanner)) fails on main's yarn.lock, which ejects every PR from the merge queue — the merge_group re-scan runs against the latest main and fails any queued PR. Observed on #612 and #616 (both otherwise green + a nit-complete).

Same class as #637 (astro/brace-expansion), just newly-published advisories on other pre-existing deps. These landed after the affected PRs' PR-open scans, so PR-level checks were green while the merge_group re-scan is red.

Closes #638.

Changes (lockfile-only — no manifest / source change)

Re-resolved within the existing ranges:

OSV	CVSS	Package	Version	Fixed
GHSA-2p49-hgcm-8545	8.2	svgo	4.0.1	4.0.2
GHSA-8r6m-32jq-jx6q	8.7	fast-xml-parser	5.9.3	5.10.1
GHSA-v2hh-gcrm-f6hx	7.5	fast-uri	3.1.3	3.1.4

• svgo and fast-uri are transitive; fast-xml-parser is a direct dep at ^5.7.0 and 5.10.1 is within that caret — so yarn.lock only, no package.json change.
• All three fix versions are clean in OSV.

Verification

• mise run security:deps (osv-scanner, exact CI command) → No issues found (exit 0).
• yarn install --frozen-lockfile → consistent (no drift; manifests unchanged).
• mise //docs:build → 68 pages built clean under svgo 4.0.2.

[scottschreckengaust]

Verdict

Approve. A clean, correctly-scoped yarn.lock-only re-resolve that clears three real osv-scanner advisories currently ejecting PRs from the merge queue. All resolved versions are verified against osv.dev (CVEs cleared, none poisoned/yanked), integrity hashes match the npm registry, and osv-scanner scan --lockfile yarn.lock exits 0 on the PR head. One minor description-accuracy nit only.

Vision alignment

Advances bounded blast radius & supply-chain hygiene — unblocks the merge queue (merge_group re-scan against latest main) so other reviewable PRs can land. No tenet trade-offs; no ADR needed. Same maintenance class as #637 (astro/brace-expansion). Governance gate satisfied: backing issue #638 carries the approved label; branch/PR reference the issue.

Blocking issues

None.

Non-blocking suggestions / nits

1. Description understates the actual lockfile delta. The PR body lists three packages (svgo, fast-xml-parser, fast-uri), but the lockfile re-resolves eight entries: the three named plus five transitive deps pulled in by the new fast-xml-parser@5.10.1 — @nodable/entities 2.2.0->3.0.0, fast-xml-builder 1.2.1->1.3.0, is-unsafe 1.0.1->2.0.0, path-expression-matcher 1.6.1->1.6.2, xml-naming 0.1.0->0.3.0. This is the correct, expected cascade (all five verified clean on osv.dev, no known vulns), but the body should mention the transitive re-resolution so a future reader isn't surprised by the extra hunks. Non-blocking.

Documentation

N/A. Lockfile-only change; no behavior, contracts, env vars, or commands changed. No docs/guides|design/ sources touched, so no Starlight mirror regeneration required. AGENTS.md routing not affected.

Tests & CI

• CI is green across all required checks, including Secrets, deps, and workflow scan.
• I re-ran the actual dep scan on the PR head: osv-scanner scan --lockfile yarn.lock -> No issues found, exit 0 (1152 packages scanned).
• Verified each resolved version against osv.dev advisories:
  • svgo 4.0.2 clears GHSA-2p49-hgcm-8545 (fixed at 4.0.2 for the 4.x line).
  • fast-xml-parser 5.10.1 clears GHSA-8r6m-32jq-jx6q (fixed 5.10.1).
  • fast-uri 3.1.4 clears GHSA-v2hh-gcrm-f6hx (fixed 3.1.4 for the 3.x line).
• Poisoning/yank cross-check: all eight resolved versions return no vulns on osv.dev, and lockfile integrity sha512 hashes for svgo 4.0.2, fast-xml-parser 5.10.1, and fast-uri 3.1.4 match the npm registry dist.integrity exactly (tarballs authentic).
• fast-xml-parser is a direct dep at ^5.7.0 (root package.json:30); 5.10.1 satisfies the caret, so no manifest change is needed — confirmed no package.json diff. svgo and fast-uri are transitive. No transitive breakage: internally consistent lockfile, scanner clean.
• Bootstrap synth-coverage (ADR-002): not applicable — no CDK constructs/stacks/handlers introducing new CFN resource types changed.
• Shared-type sync: not applicable — cdk/src/handlers/shared/types.ts unchanged.

Review agents run

• /security-review (supply-chain/CVE) — RAN (manually, as the substantive review for a lockfile-only supply-chain bump): osv.dev advisory cross-check of all 8 resolved versions, npm-registry integrity-hash validation of the 3 primaries, and a direct osv-scanner run against the PR-head lockfile. No secrets, IAM, Cedar, network, or webhook/input surface in the diff.
• code-reviewer — OMITTED: no source/style code, generated lockfile only.
• silent-failure-hunter — OMITTED: no error-handling/fallback code.
• type-design-analyzer — OMITTED: no new/changed types.
• comment-analyzer — OMITTED: no code comments in the diff.
• pr-test-analyzer — OMITTED: a dependency re-resolve is validated by the osv-scanner CI gate and frozen-lockfile consistency, not by unit tests; no testable code behavior added.

Human heuristics

• Proportionality — Pass. Minimal footprint: exactly the lockfile hunks needed to clear the advisories, no manifest churn, no over-reach.
• Coherence — Pass. Belongs in the root yarn.lock; mirrors the established #637 remediation pattern for merge-queue-blocking advisories.
• Clarity — Pass. Intent is clear from title/issue; the only clarity gap is the body omitting the transitive cascade (nit 1).
• Appropriateness — Pass. Verified against real upstream sources (osv.dev + npm registry integrity), not self-authored mocks; maintainable and reversible.