[MaheshtheDev]

Security: zod bundled into dist

Advisory	Package	Change	Exposure
GHSA-mrhx-c7xc-m3w5 / CVE-2023-54404 (memory exhaustion validating a large array schema without a length constraint, CVSS 8.2)	zod	4.1.8 -> 4.6.6	Runtime, bundled. The package publishes with no dependencies; bun build inlines zod (via tool() from @opencode-ai/plugin) into dist/index.js, dist/server.js and dist/v2/index.js. @opencode-ai/plugin and @opencode/plugin pin zod to exactly 4.1.8, so a lockfile bump is not possible and an overrides entry is used.

Change: "overrides": {"zod": "4.6.6"} in package.json plus the matching bun.lock edit (zod entry and integrity from the registry; bun also re-keyed some nested effect entries, +14/-14 lines total). bun install --frozen-lockfile passes, bun run typecheck, bun test (33 pass) and bun run build pass.

Other first-pass findings are not fixed here, all dev-only: seroval (via solid-js peer), toml-node and undici (via @opencode-ai/plugin -> effect), http-cache-semantics and undici 6.x (via @opencode/util -> pacote/node-gyp). I built dist and confirmed none of them end up in the bundle; the published package has no runtime dependencies.

Release consequence of merging to main

.github/workflows/release.yml runs on push to main when package.json changes (this PR does). It publishes to npm only if the package.json version differs from the version on npm. The version here is 2.0.17, already published, so merging will not publish. Users get the fixed zod only after a version bump is merged (a separate decision; I did not bump the version).