[takashi-matsuyama]

Summary

Move @basou/core's zod from ^4.6.5 to ^4.6.7. The lockfile changes for zod alone (10 lines), and CHANGELOG.md gains an ## Unreleased entry.

Why

zod before 4.6.6 can exhaust memory while validating oversized constrained collections (GHSA-mrhx-c7xc-m3w5, high). The advisory was updated on 2026-10-23 at 18:26 UTC and now covers the 4.6.5 that the lockfile resolves, so the required "Dependency vulnerability audit" (pnpm audit --audit-level=moderate --prod) fails on main and on every open pull request whose lockfile still resolves 4.6.5; the last main run before the update passed.

4.6.7 is the latest patch. A fresh install of the published 0.74.1 already resolves to a fixed version, since ^4.6.5 admits it; the declared floor now says so.

This supersedes Dependabot's #374, which moves zod to the same version but also re-resolves unrelated packages of the development tree (a second rollup with its platform packages, postcss 8.5.31, picomatch, tinyglobby and others, +293/-23 lockfile lines). Dependabot should close #374 by itself once zod 4.6.7 is on main.

What was checked, on a copy of main at f08e08f with this commit (pnpm 9.12.0, as pinned on main):

Check	Result
pnpm install --frozen-lockfile	passes
lockfile zod@4.6.7 integrity	matches npm view zod@4.6.7 dist.integrity
pnpm -r run build, pnpm typecheck	pass
pnpm lint	passes (the same 5 warnings and 1 info as on main)
pnpm lint:lang, pnpm lint:paths, pnpm test:scripts	pass
pnpm test	core 2980 passed + 1 skipped, sdk 67, cli 1616 (all pass)
pnpm audit --audit-level=moderate --prod	"No known vulnerabilities found"
pnpm --filter @basou/core gen:schemas	the committed JSON Schema artifacts are unchanged

Checklist

• Branch is rebased on main.
• One commit per topic (split unrelated fixes into separate PRs).
• Tests cover the change: no source changes; the existing suite and the schema regeneration run against zod 4.6.7 (table above).
• pnpm lint, pnpm typecheck, and pnpm test are all green locally.
• CHANGELOG.md ## Unreleased updated (or this PR is pure internals with no user-visible change -- say so below).
• CLI stderr stays pathless: no CLI change.

Related

• Supersedes Update(deps): bump zod from 4.6.5 to 4.6.7 #374.
• Pin pnpm 10.32.1 so a pnpm minimum release age applies in this repository #393 is blocked by the same audit failure and will be rebased once this lands.