From 59d6100712503312243c503a28df950f8a8c7f6c Mon Sep 17 00:00:00 2001
From: Takashi Matsuyama <hello@takashimatsuyama.com>
Date: Sat, 24 Oct 2026 22:29:11 +0900
Subject: [PATCH] fix(deps): move @basou/core to zod 4.6.7

zod before 4.6.6 can exhaust memory while validating oversized
constrained collections (GHSA-mrhx-c7xc-m3w5, high). The advisory now
covers the 4.6.5 that the lockfile resolved, so the required dependency
audit of the production graph fails on main and on every pull request
whose lockfile still resolves 4.6.5.

The declared range moves from ^4.6.5 to ^4.6.7, the latest patch, and the
lockfile changes for zod alone. A fresh install of the published 0.74.1
already resolves to a fixed version, since ^4.6.5 admits it; the declared
floor now says so. No source changes, and regenerating the committed JSON
Schema artifacts with zod 4.6.7 leaves them byte-identical.
---
 CHANGELOG.md               | 12 ++++++++++++
 packages/core/package.json |  2 +-
 pnpm-lock.yaml             | 10 +++++-----
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a627101..fec45a8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,18 @@
 All notable changes to **basou** are recorded here. The project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html) starting with v0.1.0.
 
+## Unreleased
+
+### Changed
+
+- **`@basou/core` now depends on zod 4.6.7 or later, for an advisory against
+  the versions before 4.6.6.** GHSA-mrhx-c7xc-m3w5: zod before 4.6.6 can
+  exhaust memory while validating oversized constrained collections. The
+  declared range already admitted the fixed versions, so a fresh install of
+  `0.74.1` resolves to them; this release makes the declared floor say so.
+  No source changed, and the committed JSON Schema artifacts are
+  byte-identical when regenerated with zod 4.6.7.
+
 ## 0.74.1 — 2026-10-23
 
 ### Fixed
diff --git a/packages/core/package.json b/packages/core/package.json
index 2d22038..c878d9b 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -62,7 +62,7 @@
     "simple-git": "^4.0.2",
     "ulid": "^3.0.2",
     "yaml": "^2.9.1",
-    "zod": "^4.6.5"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "ajv": "^8.17.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ffdb32b..d605e2d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -57,8 +57,8 @@ importers:
         specifier: ^2.9.1
         version: 2.9.1
       zod:
-        specifier: ^4.6.5
-        version: 4.6.5
+        specifier: ^4.6.7
+        version: 4.6.7
     devDependencies:
       ajv:
         specifier: ^8.17.1
@@ -1097,8 +1097,8 @@ packages:
     engines: {node: '>= 14.6'}
     hasBin: true
 
-  zod@4.6.5:
-    resolution: {integrity: sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==}
+  zod@4.6.7:
+    resolution: {integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==}
 
 snapshots:
 
@@ -1887,4 +1887,4 @@ snapshots:
 
   yaml@2.9.1: {}
 
-  zod@4.6.5: {}
+  zod@4.6.7: {}