chore(deps): bump fast-uri to 3.1.4, tar to 7.5.22, drop 8 exclusions

[github-actions]

Summary

• Bumped fast-uri from 3.1.3 to 3.1.4 to resolve GHSA-v2hh-gcrm-f6hx
• Upgraded tar resolutions to 7.5.22 across swarm-js, yeoman-generator, pacote paths
• Removed 8 stale osv-scanner exclusions that are now fixed by the dependency upgrades

Removed exclusions

GHSA ID	Package	Vulnerability	Fix Version
GHSA-v2hh-gcrm-f6hx	fast-uri	Host confusion via literal backslash	3.1.4+
GHSA-8qq5-rm4j-mr97	tar	Symlink/hardlink extraction CVE	7.5.3+
GHSA-r6q2-hw4h-h46w	tar	Extraction CVE	7.5.4+
GHSA-34x7-hfp2-rc4v	tar	Crafted archives CVE	7.5.4+
GHSA-83g3-92jg-28cx	tar	Crafted archives CVE	7.5.4+
GHSA-qffp-2rhf-9h96	tar	Hardlink path traversal	7.5.7+
GHSA-9ppj-qmqm-q256	tar	Extraction CVE	N/A
GHSA-23hp-3jrh-7fpw	tar	Decompression DoS	7.5.19+
GHSA-8x88-c5mf-7j5w	tar	Infinite loop via negative entry size	7.5.18+

Verification

✅ OSV Scanner: All removed exclusions no longer flagged
✅ check-deps: Cross-workspace version consistency verified
✅ Dependencies: All resolutions upgraded successfully

Still blocked

These exclusions remain in place due to compatibility constraints:

• GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74: minimatch ReDoS vulnerabilities - fix requires minimatch 10.2.1+ which breaks lerna v9 API compatibility. Low risk as dev-time tooling with controlled inputs only.
• GHSA-2w8x-224x-785m: sjcl.ecc attack - no upstream fix exists (first_patched_version: null)
• GHSA-96hv-2xvq-fx4p: ws server-side DoS - we use ws as client only
• GHSA-hmw2-7cc7-3qxx: form-data CRLF injection - all field names are code-controlled constants
• GHSA-wcpc-wj8m-hjx6: protobufjs DoS - input from trusted blockchain RPC only
• GHSA-7c78-jf6q-g5cm: tmp path traversal - dev-time only with hard-coded constants

🤖 Generated with Claude Code