[dependabot]

Bumps the dashboard-security group with 1 update in the /apps/presentation/dashboard directory: zod.

Updates zod from 4.4.3 to 4.6.6

Release notes

Sourced from zod's releases.

v4.6.6

Six malicious commits pushed to main on September 21 with a compromised git credential were reverted the same day in #6620 and have since been removed from the history of main. None were ever published to npm. The npm provenance for 4.6.6 names 284243fb, the pre-rewrite copy of 9c219833 with identical contents.

Commits:

• 0cd3af5e9f50ad11bbcd4407a46a21b8848ba574 docs: load the en locale directly in Zod Mini
• 9d5e60f162997b764b40d45aa02481888db50dea docs: import locales from zod/locales, not z.locales
• 34a626f307871ecbb0123947559328dc52ed5e3e docs: tighten the z.locales tree-shaking note
• 74304ce5b5796b5edb9a88ceb8e170b6ea3e82df release: stage npm versions instead of publishing them (#6622)
• b2ef983e0711ff6517d6020b021071e2e5653efa docs: add Code for Japan to bronze sponsors
• 8fb2faf0584828a6a027d8279db36f6f52784462 docs: crop the Code for Japan logo and list it first in bronze
• bacad518c41610d654658172d325874bf0ee6290 docs: square the Code for Japan logo to match the other bronze tiles
• c42596bd1c87e941d7241d10e012c5c196adcc10 release: hold the run on the release-approval environment until the staged versions are approved (#6638)
• a2ba4a67986a3e6b2b131be30084a2f460d9ea67 fix(types): declare record output and input as members, not base type arguments (#6645)
• a0ebf970f2d752e5f58527cd2942ff48be4f46bd fix(v4): check array, set and map size bounds before parsing elements (#6652)
• 529f78dd9431b07f49647fee3aa0819b3f8b66b7 4.6.6
• 9c219833c3a3764fa1f1ea9c5ecec8254a63c0b1 ci: stage at verbose so a failed OIDC token exchange says why

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)

... (truncated)

Commits

• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
• 529f78d 4.6.6
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (#6652)
• a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
• c42596b release: hold the run on the release-approval environment until the staged ve...
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• b2ef983 docs: add Code for Japan to bronze sponsors
• 74304ce release: stage npm versions instead of publishing them (#6622)
• 34a626f docs: tighten the z.locales tree-shaking note
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[loopx-agent]

Reviewer: model_agent | model=gpt-6.1-sol | provider=OpenAI | runtime_reported | reasoning_effort=max

动机

使用 Dashboard 和 Chat 的用户，以及维护其前端数据校验依赖的开发者。安装当前锁文件仍得到 Zod 4.4.3；本提案把直接依赖及完整性锁定一起更新到 4.6.6，既有页面继续解析相同后端数据。实际安装得到 4.6.6，Dashboard 与 Chat 均构建成功，既有数据路径检查和同输入校验对照通过；错误诊断的变化单独披露。不新增页面、状态、授权或执行入口，不宣称消除全部依赖漏洞、缩小产物或证明长期使用收益。

这是对既有依赖的有界维护请求。没有单独的版本级书面规格；先读了现有 PR、评论、包约束及官方发布说明，再核完整 diff。升级目标清楚，但依赖小版本号本身不能证明兼容，也不能把 security 分组名称当作已证明修复某个特定漏洞。官方 4.6.6 发布说明 和实际 npm 元数据用于核对版本；本次没有声称审计了全部上游代码或供应链。

改动思路

版本选择属于已有前端包清单和锁文件；校验继续由原有各数据 schema 负责，没有引入第二份字段规则或前端执行授权。本次完整边界是两个包文件的版本与完整性更新，并核验既有调用方和构建；没有改写业务 schema、错误处理器或页面布局。

不修改应用 schema、不加版本分支或兼容包装，是当前最小的维护方式。最强反对理由是：从 4.4.3 跨到 4.6.6 涉及多次上游解析器变更，锁文件只有几行也可能使缺省值、拒绝规则或错误处理变化。因此我把现有源 schema 分别绑定到真实的两个 npm 版本，用完全相同输入比较接受结果、完整成功数据和原始错误，再运行实际构建及现有业务检查。继续停留旧版可以避免短期变化，但没有比复用既有包管理边界更小、又能完成本次升级的方案；自建解析器或应用侧 backport 会增加维护面。

具体改动

• apps/presentation/dashboard/package.json 的 dependencies.zod 从 ^4.4.3 更新为 ^4.6.6，其余直接依赖未改。
• apps/presentation/dashboard/package-lock.json 的根依赖和 packages["node_modules/zod"] 同步更新版本、tarball URL 和完整性摘要。npm ci --ignore-scripts 实际安装 4.6.6，摘要与 npm registry 的该版本元数据一致，避免只改约束而继续装旧包。
• 应用代码没有变化；独立检查了 quotaSchema 的缺省值和转换、parseStatusPayload、Chat/request-control/验收等既有 schema，以及 formatStatusError 对 issues 的展示。没有发现按 invalid_union、unrecognized_keys 或英文错误子串决定授权/执行的消费者。

实际验证：npm run build 完成 Dashboard 和 Chat 的 TypeScript 检查及 Vite 构建；smoke:status-projection-contract、smoke:delivery-review、smoke:benchmark-study、smoke:capability-configuration、smoke:bound-conversation 五组均通过。原生 diff 范围 premerge 以 385771e 为基线，4 项直接检查和 3 项选中检查通过，零失败、零 manual hold；提交有 DCO sign-off。依照本次配置，没有查询、轮询或等待远端 CI。

对主干的风险

精确 head 为 471bb7dac632986cf31e228f82a47c00ae77b59d，完整提案只有上述两个文件，+5/-5。对照使用同一份 17 个数据模块、141 个导出 schema 与 100 个合成/公开样例输入，共 14,100 组：接受/拒绝结果一致，2,807 组成功解析的完整数据一致。这是有界输入集合的兼容证据，不是所有输入或线上环境的证明。

错误输出并非逐字兼容：11,292 组原始错误指纹改变。保留完整原始指纹后，仅排除 message 再比较，仍有 65 组差异，全部来自 goalAcceptanceContractSchema 对无效对象的 union 错误变成直接 unrecognized_keys；输入继续被拒绝。现有 formatStatusError 按 issue 的 path/message 展示，能处理两种形状，没有据此开启写入或忽略校验。这些诊断变化是本次依赖升级的已知表现，不能概括为“所有输出完全相同”。

构建有 large-chunk 提示，本次没有比较基线体积，不能声称 bundle 变小或性能改善。若后续真实 payload 暴露兼容问题，应在既有 schema/依赖 owner 修复，或一并回退清单和锁文件并重新构建；没有数据迁移、额外确认、权限变更或新执行器需要恢复。

我的整体评价

APPROVE。版本选择属于已有前端包清单和锁文件；校验继续由原有各数据 schema 负责，没有引入第二份字段规则或前端执行授权。本次完整边界是两个包文件的版本与完整性更新，并核验既有调用方和构建；没有改写业务 schema、错误处理器或页面布局。当前最小包更新已覆盖锁定一致性、实际构建、主要数据路径和拒绝语义；没有发现阻断本提案的问题。零新增必需人工交互，未增加观察器、状态同步或兼容框架，后端授权和长期工作调度保持原 owner。

两个包文件改变解析库，没有修改页面结构、布局或文字组件；核对了实际 schema 消费者和 formatStatusError，故无需新增视口证据。未验证真实安装 App、移动端、线上服务或全部可能输入；浏览器错误文字更详细及无效 union 错误变平已披露。这些限制不被测试数量或公开审批所消除；长期成本、实际 App 采用、全部上游安全性没有在本次验收。评审结论与 merge readiness 分开，批准不授予合并或 admin bypass 权限。

English verdict: APPROVE — 471bb7d. The manifest and lock coherently install Zod 4.6.6. Dashboard/Chat builds, five existing consumer smokes and 4+3 native premerge checks pass. Across 14,100 same-input schema comparisons, decisions and successful data match; richer diagnostics and 65 flattened invalid-union errors are explicitly assessed. Live App adoption, exhaustive inputs and upstream supply-chain safety remain outside this review; CI was not consulted.