fix(deps): move zod to ^4.6.6 and clear the lockfile's high and critical advisories (#25657)

<!-- claude-projects-attribution: {"github_login":"os-elon-musk"} -->
_Requested by **Elon** · [project
thread](https://claude.ai/code/project/chan_01WedDzV26nniwxv7jC88B9D?thread=cmsg_01WedDzV26nniwxv7jC88B9DWGGKysRudWM9W6GPewxH8S)_
Fixes #25631
Clause-②: no
Metadata-protocol: none

Every manifest that declares `zod` now asks for `^4.6.6`, past
GHSA-mrhx-c7xc-m3w5, and the workspace resolves one zod, 4.6.7. Every
other advisory `pnpm audit` matched on `main` moves to its patched
release, except `@azure/msal-node`, which has no upstream path yet
(below).

## `pnpm audit`, before and after

Measured with pnpm 10.31.0 against the lockfile, `main` at `49653f9` vs
this branch.

| | critical | high | moderate | low |
|:--|--:|--:|--:|--:|
| `pnpm audit --prod`, main | 5 | 10 | 8 | 3 |
| `pnpm audit` (all), main | 5 | 11 | 10 | 3 |
| `pnpm audit` (all), this branch | 0 | 1 | 0 | 0 |

## What moved

| Package | Was | Now | Advisories | How |
|:--|:--|:--|:--|:--|
| zod | 4.6.1, 4.6.5 | 4.6.7 (one copy) | GHSA-mrhx-c7xc-m3w5 (high) |
`^4.6.6` in the 12 manifests that declared `^4.6.5` and in apps/docs
(`^4.6.1`) |
| next | 16.3.8 | 16.4.1 | GHSA-2464-fhr4-w9xw, GHSA-673q-mjm6-r5xr
(critical), GHSA-p3m5-59mp-jv5r (high) | apps/docs exact pin moved;
better-auth's optional `next` peer followed it |
| dompurify | 3.4.16 | 3.4.17 | GHSA-cg2g-xh64-v4q7 (critical),
GHSA-mrv2-3pqr-j5jr (high), 1 low | override target `^3.4.17` (mermaid
`^3.3.3` admits it) |
| body-parser | 2.3.0 | 2.4.0 | GHSA-27r3-jxmh-p828 (high) | new
override over the 2.x major → `^2.4.0` (express 5.2.1 `^2.2.1` admits
it) |
| happy-dom | 20.10.2 | not installed | GHSA-834v-8h66-3h79 (high) | new
override from the advisory's 17.0.0 floor up to the 22.0.0 major
boundary → `^21.0.4`; see Acceptance notes |
| postal-mime | 4.0.5 | 4.1.4 | GHSA-f2hq-32vh-53cc (high) |
service-mailbox `^4.0.5` → `^4.0.8` |
| undici | 7.30.0, 8.11.2 | 7.30.1, 8.12.3 | GHSA-xjj6-f33q-929c (high),
2 moderate, on both lines | override targets `^7.30.1` and `^8.12.2`,
selectors unchanged |
| nodemailer | 10.0.13 | 10.2.1 | 3 moderate | plugin-email `^10.0.2` →
`^10.1.4` |
| fast-uri | 3.1.8 | 3.1.9 | 2 moderate, 2 low | override target
`^3.1.9` |
| ip-address | 10.7.2 | 10.7.4 | 1 moderate | override target `^10.7.4`
|

The lockfile is regenerated by `pnpm install`, never edited by hand. The
resolved package set changes only in the rows above, the `@next/*`
binaries that move with next, and happy-dom with its four private
dependencies leaving. Each new or moved override carries its reason in
`pnpm-workspace.yaml`, in the block dated 2026-10-24.

## Not cleared: `@azure/msal-node` GHSA-xcx6-jx8p-x3h5 (high)

5.4.1 comes from `@azure/identity` 4.13.1 (`^5.1.0`) under tedious
18.6.2, driver-sql's optional mssql peer. The fix is only in msal-node
7.1.0. No `@azure/identity` release admits it: 4.14.0 (latest) and
4.15.0-beta.1 both declare `^6.0.0`. Clearing it here would mean forcing
two majors past identity's declared range on an Azure AD sign-in path
that no test in this workspace runs, so it is reported as a finding and
not pinned. This PR does not make it worse: the OSV verdict on a pull
request is base-relative, and `main` already carries it.

## Generated surfaces

`pnpm --filter @objectstack/spec build`, then `pnpm --filter
@objectstack/spec check:generated`: all 14 generated artifacts are up to
date under zod 4.6.7 (JSON schemas, API surface, export origins,
declaration map, docs). Nothing was regenerated, so there is nothing to
commit.

The vendored Console keeps one zod: objectui at the pinned
`2958f17e9c6a` already resolves zod 4.6.7, which satisfies the spec's
new `^4.6.6` range.

## Verification

Local, at head `5396e799bb`:

- `pnpm build`: 76 of 76 tasks.
- Workspace typecheck (`turbo run typecheck`, 4096 MB heap, the runner's
V8 default): 152 of 152 tasks. Under this container's 2096 MB default,
`@objectstack/plugin-hono-server`'s `tsc --noEmit` runs out of heap.
That is not this change: the same program reports 4,167,189K memory used
on `main`'s dependency set and 4,166,613K on this branch (`tsc
--extendedDiagnostics`).
- Tests, every package whose manifest moved: spec 21725, core 2757,
objectql 8700, runtime 7035, metadata 905, metadata-core 796,
metadata-protocol 21474, rest 6400, mcp 533, driver-turso 2492,
plugin-email 689, service-mailbox 152, lint 7244, cli `--project unit`
4816 tests. All pass.
- `dispatch-gates --commands`: 101 derived families run, 101 exit 0,
reconciled by `--ran` (0 unrun, 0 not measured). Two needed full history
first: `check-engine-split-ratio` and `check-plugin-teardown-shape
--self-test` refuse a shallow clone.
- `pnpm check:override-consistency`, `pnpm
check:vendor-export-contract-resolve`, `node
scripts/check-osv-exemptions.mjs`, `node
scripts/check-commit-card-trailers.mjs --range origin/main..HEAD`: exit
0.

CI on the same head: all 44 check runs are success or skipped, including
Validate Package Dependencies (OSV base-relative), Build Docs (next
16.4.1), Build Core, Test Core 1 to 6, TypeScript Type Check and Lint &
Repo Gates. Console Pin Gate runs neither on a pull request nor in the
merge queue (its `if:` excludes both), so its first verdict comes after
landing; the pinned objectui resolves zod 4.6.7, inside the spec's new
`^4.6.6`, which is the range its build asserts against.

## Acceptance notes

- **`@azure/msal-node`** stays, for the reason above. It needs either an
`@azure/identity` release that accepts msal-node 7.1.0 or a maintainer
decision to force it.
- **happy-dom no longer resolves at all.** It was only vitest's optional
`happy-dom: *` peer, auto-installed; no manifest declares it and no
vitest config selects that environment. With the peer rewritten to
`^21.0.4`, pnpm does not install it. `check:override-consistency` lists
the entry as having 0 consumers, which is a report, not a failure; the
entry stays as the floor a future declaration lands on.
- **The moderate and low advisories ride along.** The card asks for high
and critical. The rest are target lifts in the same file and two
declared ranges, and `main`'s scheduled OSV scan fails on every
severity.
- **Serial constraint:** #25639 edits the cli, hono and plugin-dev
manifests and may move `pnpm-lock.yaml`. Whichever lands second
regenerates the lockfile with pnpm.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_016n6CWTNgTQKqAHM3ga7ZRt

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/25631-dependency-advisories.md

@@ -0,0 +1,26 @@
+---
+'@objectstack/spec': patch
+'@objectstack/core': patch
+'@objectstack/cli': patch
+'@objectstack/runtime': patch
+'@objectstack/objectql': patch
+'@objectstack/metadata': patch
+'@objectstack/metadata-core': patch
+'@objectstack/metadata-protocol': patch
+'@objectstack/rest': patch
+'@objectstack/mcp': patch
+'@objectstack/driver-turso': patch
+'@objectstack/plugin-email': patch
+'@objectstack/service-mailbox': patch
+---
+
+fix(deps): the declared `zod` floor moves to `^4.6.6`, past GHSA-mrhx-c7xc-m3w5, and `postal-mime` and `nodemailer` move to their patched releases
+
+Clause-②: no
+Metadata-protocol: none
+
+- **`zod` `^4.6.5` → `^4.6.6`** in every package that depends on it. zod 4.6.5 and earlier can exhaust memory validating an oversized array against an array schema with no length limit ([GHSA-mrhx-c7xc-m3w5](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5)). 4.6.6 also changed zod's `v4/core` type declarations, so a project that had already moved its own zod to 4.6.6 or later could get a second, older zod under these packages whose types do not assign to its own; with both ranges at `^4.6.6` the two can resolve to one copy. If your project pins zod below 4.6.6, raise it to `^4.6.6`.
+- **`@objectstack/service-mailbox`: `postal-mime` `^4.0.5` → `^4.0.8`.** Decoding a header made of many joined RFC 2047 encoded words took quadratic time, so one crafted message could block the event loop for seconds ([GHSA-f2hq-32vh-53cc](https://github.com/advisories/GHSA-f2hq-32vh-53cc)).
+- **`@objectstack/plugin-email`: `nodemailer` `^10.0.2` → `^10.1.4`**, for three moderate advisories fixed in 10.1.4 (GHSA-8c8m-p3m8-cjg8, GHSA-m943-m63m-w62w, GHSA-85x2-q946-cp5h).
+
+No API, schema or behaviour of these packages changes. The generated spec artifacts (JSON schemas, API surface, declaration map) are identical under zod 4.6.7.

apps/docs/package.json

@@ -18,7 +18,7 @@
     "fumadocs-ui": "16.14.4",
     "lucide-react": "^1.31.0",
     "mermaid": "^11.16.0",
-    "next": "16.3.8",
+    "next": "16.4.1",
     "next-themes": "^0.4.6",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
@@ -37,7 +37,7 @@
     "postcss": "^8.5.28",
     "tailwindcss": "^4.3.3",
     "typescript": "^6.0.3",
-    "zod": "^4.6.1"
+    "zod": "^4.6.6"
   },
   "engines": {
     "node": ">=22.0.0"

packages/cli/package.json

@@ -115,7 +115,7 @@
     "ts-morph": "^28.0.0",
     "tsx": "^4.23.15",
     "yaml": "^2.9.1",
-    "zod": "^4.6.5"
+    "zod": "^4.6.6"
   },
   "peerDependencies": {
     "@objectstack/driver-turso": "workspace:^"

packages/core/package.json

@@ -38,7 +38,7 @@
   "dependencies": {
     "@objectstack/spec": "workspace:*",
     "@objectstack/types": "workspace:*",
-    "zod": "^4.6.5"
+    "zod": "^4.6.6"
   },
   "keywords": [
     "objectstack",

packages/drivers/driver-turso/package.json

@@ -34,7 +34,7 @@
     "@objectstack/driver-sql": "workspace:*",
     "@objectstack/spec": "workspace:*",
     "nanoid": "^6.0.1",
-    "zod": "^4.6.5"
+    "zod": "^4.6.6"
   },
   "peerDependencies": {
     "better-sqlite3": "^13.0.3"

packages/lint/package.json

@@ -60,7 +60,7 @@
   "devDependencies": {
     "@types/node": "^26.6.3",
     "vitest": "^4.1.11",
-    "zod": "^4.6.5"
+    "zod": "^4.6.6"
   },
   "keywords": [
     "objectstack",

packages/mcp/package.json

@@ -31,7 +31,7 @@
     "@objectstack/formula": "workspace:*",
     "@objectstack/spec": "workspace:*",
     "@objectstack/types": "workspace:*",
-    "zod": "^4.6.5"
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "@objectstack/lint": "workspace:*",

packages/metadata-core/package.json

@@ -43,7 +43,7 @@
   ],
   "dependencies": {
     "@objectstack/spec": "workspace:*",
-    "zod": "^4.6.5"
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "@types/node": "^26.6.3",

packages/metadata-protocol/package.json

@@ -46,7 +46,7 @@
     "@objectstack/sdui-parser": "workspace:*",
     "@objectstack/spec": "workspace:*",
     "@objectstack/types": "workspace:*",
-    "zod": "^4.6.5"
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "@types/node": "^26.6.3",

packages/metadata/package.json

@@ -98,7 +98,7 @@
     "chokidar": "^5.0.0",
     "glob": "^13.0.6",
     "js-yaml": "^5.4.1",
-    "zod": "^4.6.5"
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "@objectstack/driver-sqlite-wasm": "workspace:*",