From 86bbabfecdedad6ac112dc599fd3dc247e950d46 Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Sat, 12 Sep 2026 22:46:36 -0500
Subject: [PATCH] Patch isolated reporting URI dependency and enforce Node
 policy

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 tests/runner-e2e/reporting-runtime/README.md  |  5 +++
 .../reporting-runtime/package-lock.json       | 35 ++++++++++---------
 .../runner-e2e/reporting-runtime/package.json |  5 ++-
 .../runner-e2e/workflow-trusted-lock.test.ts  |  5 +++
 4 files changed, 33 insertions(+), 17 deletions(-)

diff --git a/tests/runner-e2e/reporting-runtime/README.md b/tests/runner-e2e/reporting-runtime/README.md
index 93199d8666..c0701b9c3d 100644
--- a/tests/runner-e2e/reporting-runtime/README.md
+++ b/tests/runner-e2e/reporting-runtime/README.md
@@ -23,3 +23,8 @@ Review every changed package version/integrity, then run the workflow boundary
 tests and the report/publisher smoke with local evidence and a fake AWS CLI.
 Never run that update command in the reporting workflow. Do not edit the
 CI-owned root pnpm lock for this package.
+
+The exact `fast-uri` override uses the patched 3.1.6 line for the URI parsing
+advisories, including [GHSA-f65p-4m7j-42xc](https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc).
+Do not inherit an older vulnerable version solely because it appears in the
+workspace lock. The standalone runtime follows the repository Node engine policy.
diff --git a/tests/runner-e2e/reporting-runtime/package-lock.json b/tests/runner-e2e/reporting-runtime/package-lock.json
index 9f55508132..497830e455 100644
--- a/tests/runner-e2e/reporting-runtime/package-lock.json
+++ b/tests/runner-e2e/reporting-runtime/package-lock.json
@@ -12,6 +12,9 @@
         "ajv": "8.20.0",
         "tsx": "4.23.12",
         "zod": "4.4.3"
+      },
+      "engines": {
+        "node": ">=24.11.0"
       }
     },
     "node_modules/@esbuild/aix-ppc64": {
@@ -461,22 +464,6 @@
         "url": "https://github.com/sponsors/epoberezkin"
       }
     },
-    "node_modules/ajv/node_modules/fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "BSD-3-Clause"
-    },
     "node_modules/esbuild": {
       "version": "0.28.2",
       "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.2.tgz",
@@ -524,6 +511,22 @@
       "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
       "license": "MIT"
     },
+    "node_modules/fast-uri": {
+      "version": "3.1.6",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.6.tgz",
+      "integrity": "sha512-7Ical1vFEMr0onbVzEDIreM22I4khW+fzyQPwvAFWBp1iwdshSZRsL4jjRvPG9JP1uiqMHRto+YU6R2/CzDz5Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
     "node_modules/fsevents": {
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
diff --git a/tests/runner-e2e/reporting-runtime/package.json b/tests/runner-e2e/reporting-runtime/package.json
index bfca34bb53..b4e05ab5ec 100644
--- a/tests/runner-e2e/reporting-runtime/package.json
+++ b/tests/runner-e2e/reporting-runtime/package.json
@@ -11,6 +11,9 @@
     "zod": "4.4.3"
   },
   "overrides": {
-    "fast-uri": "3.1.2"
+    "fast-uri": "3.1.6"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/tests/runner-e2e/workflow-trusted-lock.test.ts b/tests/runner-e2e/workflow-trusted-lock.test.ts
index dc11990262..3f0971de5a 100644
--- a/tests/runner-e2e/workflow-trusted-lock.test.ts
+++ b/tests/runner-e2e/workflow-trusted-lock.test.ts
@@ -13,6 +13,11 @@ it("locks every reporting registry artifact with integrity and exact direct vers
   const manifest = JSON.parse(readFileSync(path.join(root, runtime, "package.json"), "utf8"));
   const lock = JSON.parse(readFileSync(path.join(root, runtime, "package-lock.json"), "utf8"));
   expect(manifest.private).toBe(true);
+  expect(manifest.engines).toEqual({ node: ">=24.11.0" });
+  expect(lock.packages[""].engines).toEqual(manifest.engines);
+  // 3.1.6 fixes the six URI parsing advisories affecting the inherited 3.1.2 lock.
+  expect(manifest.overrides["fast-uri"]).toBe("3.1.6");
+  expect(lock.packages["node_modules/fast-uri"].version).toBe("3.1.6");
   expect(manifest.scripts).toBeUndefined();
   expect(lock.lockfileVersion).toBe(3);
   expect(lock.packages[""].dependencies).toEqual(manifest.dependencies);