[autter-dev]

Draft adaptation for a third-party vendor API change detected by Autter.

Vendor change

• Service: dependencies (production)
• Signature: Update Autter-dev/lanes

CVEs added in this project

• undici@7.29.1 HIGH — Autter-dev/lanes · GHSA-2m5v-pch6-74hx · update to 6.29.1
• undici@7.29.1 HIGH — Autter-dev/lanes · GHSA-qrxm-fqhp-jwvm · update to 6.29.1
• undici@7.29.1 HIGH — Autter-dev/lanes · GHSA-xjj6-f33q-929c · update to 6.29.1
• undici@7.29.1 MEDIUM — Autter-dev/lanes · GHSA-4qv8-2p9j-2685 · update to 6.29.1
• undici@7.29.1 MEDIUM — Autter-dev/lanes · GHSA-9fm3-97px-rjf6 · update to 6.29.1
• undici@7.29.1 HIGH — Autter-dev/lanes · GHSA-4w7w-5xrc-9h26 · update to 7.30.1
• undici@7.29.1 MEDIUM — Autter-dev/lanes · GHSA-55wc-3pg8-jfw6 · update to 7.30.1
• undici@7.29.1 MEDIUM — Autter-dev/lanes · GHSA-f72v-6w45-q472 · update to 7.30.1
• fast-uri@3.1.8 MEDIUM — Autter-dev/lanes · GHSA-w74x-v6f9-j3xg · update to 2.4.8
• fast-uri@3.1.8 MEDIUM — Autter-dev/lanes · GHSA-wjr9-j795-jxcr · update to 2.4.8

Why this repo is hit

Scheduled repository update for vendor API changes and known CVEs.

What this PR changes

Bumped vulnerable transitive npm deps in the lockfiles. undici 7.29.1 -> 6.29.1 in services/install-count/package-lock.json (the miniflare dependency record and the resolved node_modules/undici entry, with matching integrity, tarball URL and engines). fast-uri 3.1.8 -> 2.4.8 in site/package-lock.json (the ajv dependency record and the resolved node_modules/fast-uri entry, with matching integrity, tarball URL and license). No source call sites import undici or fast-uri directly; these are dependency-manifest-only changes. Both lockfiles still install cleanly (npm ci --include=dev succeeds; installed undici 6.29.1 and fast-uri 2.4.8). Added a vitest reproduction test in services/install-count/test/deps.test.ts asserting the lockfile pins undici to 6.29.1; verified it fails against the original lockfile and passes with the change. The site has no test harness, so no fast-uri test was added there (noted in the summary). Added a Security entry to CHANGELOG.md under Unreleased (2026-10-30).

Remediation safety and rollback

Actual changed files: CHANGELOG.md, services/install-count/package-lock.json, services/install-count/test/deps.test.ts, site/package-lock.json

code fix: Apply every listed update in one change on branch autter/fix-updates. Do not open a separate pull request. Do not add packages that are not already dependencies. You may edit the lockfile only for: undici, fast-uri.

• Verify the diagnosis against the current repository and prepare a draft PR with the smallest correct change.

Blast radius (unknown): The available analysis has not established the impact on shared callers, users, or data. Prepare the draft automatically; a human must assess these before merge or production rollout.

The actual draft also changes 3 file(s) outside the assessed scope: CHANGELOG.md, services/install-count/package-lock.json, site/package-lock.json. Their downstream impact is unknown and requires human rollout review.
Affected: CHANGELOG.md, services/install-count/package-lock.json, services/install-count/test/deps.test.ts, site/package-lock.json, dependencies

Rollback strategy: Before merge, close the draft PR and discard its branch. If deployed later, revert the fix commit through a reviewed PR and redeploy the previous compatible release. Confirm data/schema compatibility before reverting and verify recovery using the original failure signal.

If this draft is abandoned, close the PR. If deployed later, revert the complete patch, including the additional files, through a reviewed PR; check data/schema compatibility and verify the original failure signal recovers.

Validation required:

• Reproduce the original failure, run the relevant regression tests and CI, and verify affected callers. After an operator deploys, compare error rate and latency against the pre-change baseline.
• Review downstream callers and regression coverage for all files changed beyond the original RCA scope.

Verification

Fix tier: Proposal only. build (root), tests (root) failed with the fix.

Reproduction (services/install-count/test/deps.test.ts, run with (cd services/install-count && npx vitest run 'test/deps.test.ts')):

• Before the fix: failed
• With the fix: passed
• Red without the fix, green with it.

Check	Result	Detail
install dependencies	failed	Installing the repository's dependencies failed, so checks below may fail or be skipped for that reason.
typecheck	skipped	No separate typecheck command was found for the changed code; the build below compiles it.
lint (changed lines)	passed
build (site) (npm run build)	passed
build (root) (cargo build)	failed	info: syncing channel updates for stable-x86_64-unknown-linux-gnu error: could not create temp file /root/.rustup/tmp/ii3tgo5sb_lex0_u_file: Permission denied (os error 13)
tests (lanes-install-count) (npm run test)	passed
tests (root) (cargo test)	failed	the command failed (exit code 1), but its output didn't say which test failed, so Autter couldn't read the result. info: syncing channel updates for stable-x86_64-unknown-linux-gnu error: could not create temp file /root/.rustup/tmp/bkcw4nvbvfkp732d_file: Permission denied (os error 13)
adversarial review (completeness)	failed	Incomplete, no regression found: The diff only covers the security pins. The finding's root cause also names vendor API changes, and nothing in the diff addresses those. The fix also makes risky major-version downgrades that are not verified. undici goes 7.29.1 to 6.29.1 and fast-uri goes 3.1.8 to 2

Skipped: typecheck (No separate typecheck command was found for the changed code; the build below compiles it.).

These results come from Autter's runner, not from the fixer's own report.

Keeps services/install-count/test/deps.test.ts in this PR: it fails without this change and passes with it.

---

Opened as a draft by Autter. Deprecated packages, breaking API changes, newer API versions, and CVE bumps for this repository land together on autter/fix-updates. The next day adds a commit to this pull request. Review carefully before merging.