Update commitlint and fast-uri dependencies

[leonardomendix]

Pull request type

Dependency changes (any modification to dependencies in package.json)

---

Description

This PR tries to resolve a vulnerable transitive dependency: https://security.snyk.io/vuln/SNYK-JS-FASTURI-18021349

Updating commitlint alone does not remove the vulnerable transitive, because latest commitlint currently still depends on ajv@8.20.0.
The effective fix here is the root pnpm override to fast-uri@3.1.4, which is semver-compatible with ajv’s ^3.0.1 range and removes the vulnerable 3.1.3.

[github-actions]

AI Code Review

⚠️ Approved with suggestions — low-severity items only, safe to merge

---

What was reviewed

File	Change
automation/scripts/package.json	commitlint bumped ^19.8.1 → ^21.2.1 / ^21.2.0 (major version jump, skipping v20)
package.json	fast-uri: 3.1.4 exact-pin override added to root pnpm overrides

Skipped (out of scope): pnpm-lock.yaml

⚠️ Note: CI checks could not be retrieved automatically — please confirm the commitlint hook passes on a test commit before merging.

---

Findings

⚠️ Low — PR title missing conventional-commit prefix

File: PR metadata
Note: The title "Update commitlint and fast-uri dependencies" does not follow the conventional commits format enforced by commitlint itself (ironic). Prefer chore: update commitlint and fast-uri dependencies to satisfy the hook and match repo conventions.

---

⚠️ Low — fast-uri override is exact-pinned rather than a range

File: package.json line 74
Note: "fast-uri": "3.1.4" is an exact pin. If a future patch (3.1.5+) fixes another CVE, this override will silently block it. The other overrides in this file use ranges (>=, ^). Consider:

"fast-uri": ">=3.1.4"

This still excludes the vulnerable 3.1.3 while allowing forward-compatible patches. Exact pinning is not wrong here, but it requires a manual follow-up PR for every future fast-uri patch.

---

Positives

• The PR description precisely explains the two-layer fix (commitlint bump + override) and why upgrading commitlint alone is insufficient — excellent context for future readers.
• Deprecated git-raw-commits (which was already deprecated upstream) is fully removed by the commitlint v21 transitive graph — good cleanup side-effect with no action required.
• Multiple heavy lodash utilities (lodash.kebabcase, lodash.snakecase, lodash.startcase, lodash.mergewith, etc.) are replaced by es-toolkit, a smaller, tree-shakeable modern alternative.
• xlsx CDN tarball now gains an integrity SHA512 hash in the lockfile (sha512-oLDq3...), improving supply chain security for a package that previously had no integrity check.
• The fix correctly targets the right layer: pnpm.overrides forces resolution of the vulnerable transitive without patching upstream packages.