[lidge-jun]

Summary

Applies the same audit:high pins that landed on dev in #7642 onto main, so Release can republish 2.92.0. The 2.92.0 publish failed at the high-severity dependency audit (release run 40031662901, #7638).

• Direct zod pin: 4.4.3 → exact 4.6.6 (GHSA-mrhx-c7xc-m3w5, patched in >=4.6.6). npm latest is 4.6.7; that tag is only a version-constant bump, so this stays on the advisory floor, matching fix(deps): pin zod 4.6.6 and body-parser 2.4.0 for audit:high #7642.
• Override body-parser: exact 2.4.0 (GHSA-27r3-jxmh-p828), added beside the existing overrides. @hono/node-server, fast-uri, hono, ip-address, and qs are unchanged. body-parser stays transitive through @modelcontextprotocol/sdk → express@5.2.1.
• bun.lock resolves zod@4.6.6, body-parser@2.4.0, nested content-type@2.1.0, and nested iconv-lite@0.7.3. The lockfile hunk matches fix(deps): pin zod 4.6.6 and body-parser 2.4.0 for audit:high #7642. The existing qs: ^6.16.0 override still resolves qs@6.16.0 even though body-parser 2.4.0 declares qs@^6.16.1 (already filed as [Bug]: qs override keeps 6.16.0 under body-parser 2.4.0's ^6.16.1 #7641).
• package.json version stays 2.92.0.
• tests/ci-workflows/install-scripts.test.ts expects the new zod pin, the same one-line expectation update as fix(deps): pin zod 4.6.6 and body-parser 2.4.0 for audit:high #7642.

This pull request targets main because dev is already 2.93.0 and already contains these pins. Republishing 2.92.0 has to move the release branch.

Class C4 (release gate and supply chain). PABCD: the plan copied only the #7642 advisory floors; the resulting bun.lock diff is the same hunk as that commit.

Closes #7638

Already filed, and left unchanged here:

• [Bug]: hono 4.13.8 override is inside GHSA-5r4p-p66f-jhc7 (moderate) #7639 hono 4.13.8, moderate GHSA-5r4p-p66f-jhc7
• [Bug]: ip-address 10.7.1 is inside GHSA-rxp7-6hxx-x8q5 (moderate) #7640 ip-address 10.7.1, moderate GHSA-rxp7-6hxx-x8q5
• [Bug]: qs override keeps 6.16.0 under body-parser 2.4.0's ^6.16.1 #7641 qs override stays at 6.16.0 under body-parser 2.4.0

Verification

• bun run audit:high exit 0. Root: No vulnerabilities found (checked 144 packages, 2 below --audit-level=high). GUI: No vulnerabilities found (checked 82 packages).
• bun run typecheck (bun x tsc --noEmit) exit 0.
• bun test tests/ci-workflows/install-scripts.test.ts: 10 pass, 0 fail.
• Full bun run test was not run. The diff is the two pins, the lockfile, and one expectation string; no src/ change. CI covers the suite.

Head: ef31e2e655d4af66e48517e8bd850bc95ebba646

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. No user-facing docs change: version is unchanged and there is no new CLI or proxy behavior.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. Dependency pin only; no secrets, auth, or default changes. Needs maintainer security review per AGENTS.md because it changes the dependency tree used at publish.

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T23:00:27.322809Z	ef31e2e	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
Automatic draft conversion failed (token cannot change draft status). Please convert this pull request to a draft manually. The required enforce-target check will keep failing until every issue above is resolved.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: cursor/pin-zod-body-parser-2920-f4be
• File: .coderabbit.yaml
• Commit: ef31e2e
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: b4110095-6c22-4a4b-bd99-d865a049ff37

📥 Commits

Reviewing files that changed from the base of the PR and between 3d9ba72 and ef31e2e.

⛔ Files ignored due to path filters: 1

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing: 2

• package.json
• tests/ci-workflows/install-scripts.test.ts

+------------------------------------------------------+
| Unit tests are cute. Integration tests pay the rent. |
+------------------------------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}