From 15dece87f8b6d66a0198f2810c756bdb7221a7ee Mon Sep 17 00:00:00 2001
From: kkdev92 <112151103+kkdev92@users.noreply.github.com>
Date: Sat, 24 Oct 2026 11:35:05 +0900
Subject: [PATCH] chore(deps-dev): take zod 4.6.7 (GHSA-mrhx-c7xc-m3w5)

zod 4.6.5 and earlier keep every issue of every failing element when they
validate an array against a schema without a length limit, so a large
enough array can exhaust memory (GHSA-mrhx-c7xc-m3w5). 4.6.6 fixes it.

Here zod comes only through knip, a development dependency that validates
its configuration with it. The package has no runtime dependencies, so
nothing published depends on zod.

npm update zod --package-lock-only moves that one entry to 4.6.7, inside
knip's ^4.6.5. Verified from npm ci: format:check, typecheck, lint, the
unit tests (1136) and knip.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 239e903..1477c56 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6062,9 +6062,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "4.6.5",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.5.tgz",
-      "integrity": "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==",
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
       "dev": true,
       "license": "MIT",
       "funding": {