fix(security): fix 7 security issues in fast-uri, tronweb, smol-toml and 1 more

[aikido-autofix]

Which Linear task belongs to this PR?

Why did I implement it this way?

Upgrade dependencies to fix critical SSRF/host-bypass vulnerabilities in URI parsing, path normalization, and infinite loop DoS in TOML parsing.

Checklist before requesting a review

• I have performed a self-review of my code
• This pull request is as small as possible and only tackles one problem
• I have added tests that cover the functionality / test the bug
• For new facets: I have checked all points from this list: https://www.notion.so/lifi/New-Facet-Contract-Checklist-157f0ff14ac78095a2b8f999d655622e
• I have updated any required documentation

Checklist for reviewer (DO NOT DEPLOY and contracts BEFORE CHECKING THIS!!!)

• I have checked that any arbitrary calls to external contracts are validated and or restricted
• I have checked that any privileged calls (i.e. storage modifications) are validated and or restricted
• I have ensured that any new contracts have had AT A MINIMUM 1 preliminary audit conducted on by <company/auditor>

Security Impact — CVE vulnerabilities fixed by this PR

✅ 7 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-878106	HIGH	[fast-uri] URI authority parsing fails to treat backslashes as delimiters, allowing different host interpretations compared to Node's WHATWG URL parser, enabling bypass of host allowlists, SSRF filters, and redirect validation checks. The vulnerability permits attackers to circumvent security controls through crafted URIs containing backslashes.
AIKIDO-2026-10784	HIGH	[fast-uri] A path normalization vulnerability allows attackers to bypass security checks by using percent-encoded slashes and dots that are decoded before dot-segment removal, causing distinct URIs to normalize identically and compare equal.
AIKIDO-2026-507986	HIGH	[fast-uri] A security bypass vulnerability exists in host canonicalization for Unicode/IDN values due to inconsistent ASCII/Unicode host handling, which could allow attackers to bypass security checks through improper host normalization.
AIKIDO-2026-236835	HIGH	[fast-uri] A parsing discrepancy allows attackers to bypass host allowlists and SSRF filters by using alternative authority introducers (backslashes, mixed slashes, whitespace) that fast-uri treats as paths but Node's URL parser treats as authority, enabling redirection to unintended destinations.
AIKIDO-2026-768164	HIGH	[smol-toml] A TOML parser vulnerability allows attackers to trigger an infinite loop by crafting malicious input with a comment ending the document without a trailing newline, causing denial of service through CPU exhaustion when processing untrusted input.
CVE-2025-12758	HIGH	[validator] The isLength() function fails to account for Unicode variation selectors, causing incorrect string length calculations. This allows attackers to bypass length validation, potentially leading to data truncation, buffer overflows, or denial-of-service attacks.
CVE-2026-1526	HIGH	[undici] A malicious WebSocket server can send compressed frames that expand to extremely large sizes in memory without limits, causing denial-of-service through memory exhaustion and process crash. The vulnerability stems from unbounded decompression in the permessage-deflate extension without size validation.