diff --git a/JobTrackerApi.MariaDb.Tests/packages.lock.json b/JobTrackerApi.MariaDb.Tests/packages.lock.json index c546d4e..c1fbb54 100644 --- a/JobTrackerApi.MariaDb.Tests/packages.lock.json +++ b/JobTrackerApi.MariaDb.Tests/packages.lock.json @@ -479,8 +479,8 @@ }, "System.Security.Cryptography.Pkcs": { "type": "Transitive", - "resolved": "8.0.1", - "contentHash": "CoCRHFym33aUSf/NtWSVSZa99dkd0Hm7OCZUxORBjRB16LNhIEOf8THPqzIYlvKM0nNDAPTRBa1FxEECrgaxxA==" + "resolved": "8.0.2", + "contentHash": "VWACYq0JGxi9sw3TonSSV4B2MfhYk5nhgOtp9wbrt5NFOtUetFqHkMZylcCwPX+117cBJH5EnIzIy6X4OKn/kA==" }, "System.Security.Cryptography.ProtectedData": { "type": "Transitive", @@ -546,7 +546,8 @@ "QRCoder": "[1.8.0, )", "SQLitePCLRaw.lib.e_sqlite3": "[2.1.12, )", "Stripe.net": "[52.2.0, )", - "System.IdentityModel.Tokens.Jwt": "[8.14.0, )" + "System.IdentityModel.Tokens.Jwt": "[8.14.0, )", + "System.Security.Cryptography.Pkcs": "[8.0.2, )" } } } diff --git a/JobTrackerApi.Tests/packages.lock.json b/JobTrackerApi.Tests/packages.lock.json index e957580..5ac43a9 100644 --- a/JobTrackerApi.Tests/packages.lock.json +++ b/JobTrackerApi.Tests/packages.lock.json @@ -505,8 +505,8 @@ }, "System.Security.Cryptography.Pkcs": { "type": "Transitive", - "resolved": "8.0.1", - "contentHash": "CoCRHFym33aUSf/NtWSVSZa99dkd0Hm7OCZUxORBjRB16LNhIEOf8THPqzIYlvKM0nNDAPTRBa1FxEECrgaxxA==" + "resolved": "8.0.2", + "contentHash": "VWACYq0JGxi9sw3TonSSV4B2MfhYk5nhgOtp9wbrt5NFOtUetFqHkMZylcCwPX+117cBJH5EnIzIy6X4OKn/kA==" }, "System.Security.Cryptography.ProtectedData": { "type": "Transitive", @@ -567,7 +567,8 @@ "QRCoder": "[1.8.0, )", "SQLitePCLRaw.lib.e_sqlite3": "[2.1.12, )", "Stripe.net": "[52.2.0, )", - "System.IdentityModel.Tokens.Jwt": "[8.14.0, )" + "System.IdentityModel.Tokens.Jwt": "[8.14.0, )", + "System.Security.Cryptography.Pkcs": "[8.0.2, )" } } } diff --git a/JobTrackerApi/JobTrackerApi.csproj b/JobTrackerApi/JobTrackerApi.csproj index 0c49fd3..4d9982d 100644 --- a/JobTrackerApi/JobTrackerApi.csproj +++ b/JobTrackerApi/JobTrackerApi.csproj @@ -25,6 +25,8 @@ + + diff --git a/JobTrackerApi/packages.lock.json b/JobTrackerApi/packages.lock.json index c0d9cc1..aa78c13 100644 --- a/JobTrackerApi/packages.lock.json +++ b/JobTrackerApi/packages.lock.json @@ -138,6 +138,12 @@ "Microsoft.IdentityModel.Tokens": "8.14.0" } }, + "System.Security.Cryptography.Pkcs": { + "type": "Direct", + "requested": "[8.0.2, )", + "resolved": "8.0.2", + "contentHash": "VWACYq0JGxi9sw3TonSSV4B2MfhYk5nhgOtp9wbrt5NFOtUetFqHkMZylcCwPX+117cBJH5EnIzIy6X4OKn/kA==" + }, "BouncyCastle.Cryptography": { "type": "Transitive", "resolved": "2.6.2", @@ -600,11 +606,6 @@ "resolved": "6.0.0", "contentHash": "/iUeP3tq1S0XdNNoMz5C9twLSrM/TH+qElHkXWaPvuNOt+99G75NrV0OS2EqHx5wMN7popYjpc8oTjC1y16DLg==" }, - "System.Security.Cryptography.Pkcs": { - "type": "Transitive", - "resolved": "8.0.1", - "contentHash": "CoCRHFym33aUSf/NtWSVSZa99dkd0Hm7OCZUxORBjRB16LNhIEOf8THPqzIYlvKM0nNDAPTRBa1FxEECrgaxxA==" - }, "System.Security.Cryptography.ProtectedData": { "type": "Transitive", "resolved": "9.0.0", diff --git a/docs/redesign/phase-9/p9-requal-01/PLAN.md b/docs/redesign/phase-9/p9-requal-01/PLAN.md index ae0ab76..26d5f5c 100644 --- a/docs/redesign/phase-9/p9-requal-01/PLAN.md +++ b/docs/redesign/phase-9/p9-requal-01/PLAN.md @@ -26,3 +26,6 @@ Production-only gates do not automatically veto Phase9. Conditional Phase10 requ - Ruling: use the clean existing checkout on the explicitly requested dedicated branch; retain installed tooling and historical raw evidence, without creating another checkout or asking for routine confirmation. - Pre-flight: CI transport changes may affect fixture guards; keep default loopback protection and require verified private lifecycle before adding any CI-service endpoint. Performance source is separate; execute its workload without other qualification workloads. - Task1: started. Task2: started. Task3: started. Task4/5: pending. +- Task2: complete safe workflow checkpoint `75cd04c`; fresh hosted847 explicitly BLOCKED at first isolation gate. Merged host socket/network are unknown infrastructure, not permission to execute Docker. +- Ruling: live audits reproduced vulnerable Pkcs/Next/Zod locks; apply compatible narrow pins and refresh locked graphs, then supersede affected pre-pin results. No application flow/API/schema change or policy bypass. +- Post-pin checkpoint: NuGet/npm audits clear, backend1123, frontend934/105suites, MariaDB32, types/lint/static build pass. Frozen1042 runtime inputs recorded before full browser lanes. Independent review found missing P9-V02 register row; repaired, with56 unique findings including3 new security items. diff --git a/docs/redesign/phase-9/p9-requal-01/SECURITY.md b/docs/redesign/phase-9/p9-requal-01/SECURITY.md new file mode 100644 index 0000000..8bdde54 --- /dev/null +++ b/docs/redesign/phase-9/p9-requal-01/SECURITY.md @@ -0,0 +1,39 @@ +# Dependency advisory refresh and bounded remediation — 24 October 2026 + +The live NuGet and npm audits were refreshed against the actual locked graph. Original failing +results remain under `.artifacts/p9-requal-01/security-before-pins/`; successor results are under +`.artifacts/p9-requal-01/security/`. These are package-presence findings, not a reproduced exploit +or proof of application reachability. No production package, service or image was changed. + +| Finding | Before | Minimal correction | Successor | +| --- | --- | --- | --- | +| P9-REQUAL-SEC01 | MimeKit4.17.0 resolves Pkcs8.0.1; high and moderate denial-of-service advisories | Direct Pkcs8.0.2 security floor, preserving supported8.x API; refresh API and both test-project locks | Live API NuGet graph reports no vulnerable packages | +| P9-REQUAL-SEC02 | Next16.3.8 matches critical/high advisories | Pin Next and matching ESLint config16.4.1; matching Next compiler/environment packages change together | Live npm policy passes, zero reported vulnerabilities | +| P9-REQUAL-SEC03 | Dev-only ESLint hooks chain resolves Zod4.5.4 | Override4.6.6, within existing compatible4.x range | Live npm policy passes; no exception bypass | + +The current static export does not run the Next server's image optimizer, Server Actions or +`use cache`. Existing Sharp0.35.5 also satisfies the published image-optimizer workaround. Those +facts bound exposure; they do not erase the package advisory or justify keeping a vulnerable +development-server dependency. No hostile denial-of-service or RCE payload was executed. + +Primary advisory records: + +- [Pkcs signature verification CPU exhaustion](https://github.com/advisories/GHSA-846f-f764-76mx) + and [Windows envelope decoding](https://github.com/advisories/GHSA-2fmv-rv2c-59x7):8.0.2 is patched. +- [Next image optimization](https://github.com/advisories/GHSA-2464-fhr4-w9xw), + [Server Actions](https://github.com/advisories/GHSA-p3m5-59mp-jv5r) and + [typed-array cache result](https://github.com/advisories/GHSA-673q-mjm6-r5xr). +- [Zod collection validation](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5):4.6.6 is patched. + +No unrelated package versions changed. Installation used the existing lock with lifecycle scripts +disabled; production static build, full types/lint, backend1,123/1,123, frontend934/934 in105 suites +and MariaDB32/32 pass after the pins. Complete browser/PDF successors and the final source/report +manifest remain separately accounted in the final validation ledger. Earlier pre-pin passing runs +are retained as superseded evidence rather than added to these totals. + +Existing offline supply-chain/evaluator/browser-runtime/ingress/SMTP/dependency-policy/extension +guards pass. Tracked-secret scanning and SBOM generation pass. Those checks are narrower than an +application security certification. The inherited temporary dev-advisory policy expires on +1November2026UTC; it was neither broadened nor extended, and the current npm audit uses no exception. +Production still requires independent ingress, deployed identity, storage/recovery, provider, +monitoring and human release qualifications. diff --git a/job-tracker-ui/package-lock.json b/job-tracker-ui/package-lock.json index 0d2c423..3ac4d6b 100644 --- a/job-tracker-ui/package-lock.json +++ b/job-tracker-ui/package-lock.json @@ -26,7 +26,7 @@ "@types/react-dom": "^19.2.3", "axios": "^1.20.0", "date-fns": "^4.1.0", - "next": "^16.3.8", + "next": "16.4.1", "react": "^19.2.4", "react-dom": "^19.2.4", "react-router-dom": "^7.18.2", @@ -42,7 +42,7 @@ "@types/jest": "^30.0.0", "babel-jest": "^30.4.1", "eslint": "^9.39.5", - "eslint-config-next": "^16.3.8", + "eslint-config-next": "16.4.1", "identity-obj-proxy": "^3.0.0", "jest": "^30.4.2", "jest-environment-jsdom": "^30.4.1" @@ -4102,15 +4102,15 @@ } }, "node_modules/@next/env": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/env/-/env-16.3.8.tgz", - "integrity": "sha512-Al9zqHVV7TJv0eFuOU4U7Lvv74PTih4Ch63sk2xCIpSTkE3udFnaOcnzP2lQVymiL7yS9Cj2iClUXlR3EQ5sEw==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/env/-/env-16.4.1.tgz", + "integrity": "sha512-5sUUrrSvs/2/2LnLoesybMGx12EtPB46fdZ6RhAw0XDGSPxU2LFyQBB7yuEiOFFJPKmBY6+q2jTr1/AMbnp0/g==", "license": "MIT" }, "node_modules/@next/eslint-plugin-next": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-16.3.8.tgz", - "integrity": "sha512-eCR9RcLTZrVS+K3+VOhi0xMdUUGNuriCHHhU1ZoABC/QQ/Gp0OWbLKQxV2/9DkmihYdYRcQWFmZXW8M1AMUXYw==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/eslint-plugin-next/-/eslint-plugin-next-16.4.1.tgz", + "integrity": "sha512-2io6M+wAqe7nT5mt2gEVy6FOzye2DmwhjaYCpSvHfrIKL11SXNTwSARxpPHJacRmfgSBSDnNmnEXSp0DaJ23BQ==", "dev": true, "license": "MIT", "dependencies": { @@ -4151,9 +4151,9 @@ } }, "node_modules/@next/swc-darwin-arm64": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.3.8.tgz", - "integrity": "sha512-2JPRMh2nmQG5CiL7cXGL9AGwnPWJQ//cTtAUCT+w511QHk79SYz3LGv/pc5X643B/WEO0rvu3Yww0hqwt3kgeA==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-darwin-arm64/-/swc-darwin-arm64-16.4.1.tgz", + "integrity": "sha512-U+hQ5Gj3fpzf4fveTIF3dpUFYhaSW8vHhdAnbiIomzXzg7boreYFgBqprepXFtW4sw+aTttiNmg0gew/iFNhbg==", "cpu": [ "arm64" ], @@ -4167,9 +4167,9 @@ } }, "node_modules/@next/swc-darwin-x64": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.3.8.tgz", - "integrity": "sha512-GZtCCOBKJ4leVIT/Th0llWKhD1ca92lzbQiS5R5ON9QkoiFnilFsebDae1JU2a3HWoKMEmEZWGs1AGLavVM72Q==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-darwin-x64/-/swc-darwin-x64-16.4.1.tgz", + "integrity": "sha512-/hqC3V1XLUjhMASf/WridKdO9FXoEgN3HBWmtKbj00MPgnltutfraWJ3bYTpCRIgEIpbjJyOVLpYgAhh/BkdcQ==", "cpu": [ "x64" ], @@ -4183,9 +4183,9 @@ } }, "node_modules/@next/swc-linux-arm64-gnu": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.3.8.tgz", - "integrity": "sha512-O659ygeQYqneJ1fBKMpFxIFqYkYswu8IAS1OCKK/4f3ZgJJm1dRz4fVJZRi/kLLWjnBKnebOePA4WNv+sV1pVA==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-gnu/-/swc-linux-arm64-gnu-16.4.1.tgz", + "integrity": "sha512-GHzncHbcaS9g95kcvTNtKQW3aCLoR+xc3Jm7qrkpk1R+D2BjMHIPyvQGRPKCdMX95BsH/421jBUK06q9tEwzjw==", "cpu": [ "arm64" ], @@ -4202,9 +4202,9 @@ } }, "node_modules/@next/swc-linux-arm64-musl": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.3.8.tgz", - "integrity": "sha512-dSjKSyWpzxoO1d3DIZZcP4XJcNaKeLmxQMFOiYl5vuBRMmweIqnAhty8tAmRsvTss779cK1FtYnDMj40e4TQlg==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-linux-arm64-musl/-/swc-linux-arm64-musl-16.4.1.tgz", + "integrity": "sha512-1SuJyDxW/PR9dHJat/ZRgcYLhuSZ+1psP4DlKb2tKIuXbjygqpLrJWRSq+onZQBv8LcmU67EIrmb6c3XTaJLjw==", "cpu": [ "arm64" ], @@ -4221,9 +4221,9 @@ } }, "node_modules/@next/swc-linux-x64-gnu": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.3.8.tgz", - "integrity": "sha512-lbqOuz3RPRcv+o9msNsJw5x4+Y1ZwPTs6vmL6DCf7i0fZfvng/F59wyeDwqHIvV0mK//RBy/jJkZ+nCKsSMXjQ==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-gnu/-/swc-linux-x64-gnu-16.4.1.tgz", + "integrity": "sha512-Istng1hMGp9TGO4lUqeKLd70MPN/OOkucVTP2Nmj+gLkwBgmPqUw8CJYBCC7nbl/B/23bBCcjCI5Hsh6hazC1A==", "cpu": [ "x64" ], @@ -4240,9 +4240,9 @@ } }, "node_modules/@next/swc-linux-x64-musl": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.3.8.tgz", - "integrity": "sha512-+316WswI8ScVgZeUd+1KGaXkHhaYQzCjvH/05TZSpJ8zBizb1a4G7DtO7F12jcBIqMOtsz9ji1t48fmKtzqsGA==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-linux-x64-musl/-/swc-linux-x64-musl-16.4.1.tgz", + "integrity": "sha512-aSC9wMNiZRRFVpPkPWBzRwLQxIGm/CiQcXyFF1XNcgodb+uMxdk7aSSGGpDXCbnvZdf4itjHxpOd5h7i7zaiYw==", "cpu": [ "x64" ], @@ -4259,9 +4259,9 @@ } }, "node_modules/@next/swc-win32-arm64-msvc": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.3.8.tgz", - "integrity": "sha512-ji0gd4kMYUxO+1fJBIbiBVRCjzG/lloiyCccnlebvb1ZJ5qXCPZqYg4Jl1DrrixnWNMKylzgpmMWx0yNDYXlzw==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-win32-arm64-msvc/-/swc-win32-arm64-msvc-16.4.1.tgz", + "integrity": "sha512-t/myvwFDlypMUjRvbBf8qLPyuaB0iXYYdBtwMt6DM6f+60wtGr4bSYholdPqNeV5VUXZhrpMwfza829kmhS3iA==", "cpu": [ "arm64" ], @@ -4275,9 +4275,9 @@ } }, "node_modules/@next/swc-win32-x64-msvc": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.3.8.tgz", - "integrity": "sha512-WcTlaKt/TWkh5kUjdJcUmB1XgZ+1c6fz4Y9fDHL73YNSdGaUWjceeWrrlwF0nv19iABYWC4iAq1oX1w4Bn0vfg==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/@next/swc-win32-x64-msvc/-/swc-win32-x64-msvc-16.4.1.tgz", + "integrity": "sha512-6ICqPo9awCkrtYNPhwkx1uU7rlFWrZRrIboDHS2LU+jv088UBYQtmJ25h6pCp27/+FZjF6BQ4Te4ErugyMeuBg==", "cpu": [ "x64" ], @@ -6949,21 +6949,21 @@ } }, "node_modules/eslint-config-next": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-16.3.8.tgz", - "integrity": "sha512-81vovwMe6NGnoFsl0KUJWzlS+y239i3fdsxs49gSEX3pDQW2cuKy+fxUPXNkQqqx6OCPheYPtBlSufc9aZ0k+w==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/eslint-config-next/-/eslint-config-next-16.4.1.tgz", + "integrity": "sha512-6AsojbCfRdpWkP6BIUnMBv3MH4OvtfmH9p4hSfLh8ZgsW7nfhu7DpUMNBB7leisDyyMz+YYxTc+NAdBOQfovlA==", "dev": true, "license": "MIT", "dependencies": { - "@next/eslint-plugin-next": "16.3.8", + "@next/eslint-plugin-next": "16.4.1", "eslint-import-resolver-node": "^0.3.6", "eslint-import-resolver-typescript": "^3.5.2", "eslint-plugin-import": "^2.32.0", "eslint-plugin-jsx-a11y": "^6.10.0", "eslint-plugin-react": "^7.37.0", - "eslint-plugin-react-hooks": "^7.0.0", + "eslint-plugin-react-hooks": "^7.1.0", "globals": "16.4.0", - "typescript-eslint": "^8.46.0" + "typescript-eslint": "^8.56.0" }, "peerDependencies": { "eslint": ">=9.0.0", @@ -10308,12 +10308,12 @@ "license": "MIT" }, "node_modules/next": { - "version": "16.3.8", - "resolved": "https://registry.npmjs.org/next/-/next-16.3.8.tgz", - "integrity": "sha512-U7QEZaTini6wKrb8A8hqLLqYQyCetegKjCpJOyxk642vWoMoU1x5PyZCJFvgYgiptA8xc5j/9xYlZFO7w9Sjmw==", + "version": "16.4.1", + "resolved": "https://registry.npmjs.org/next/-/next-16.4.1.tgz", + "integrity": "sha512-uc657V62E34fOI6W5NtG9IzwsPcms0Z60grz2MJGtglgD+pTFnNt4Yw2PzaU622tfX4vhrDgLZzicE2YlhI20Q==", "license": "MIT", "dependencies": { - "@next/env": "16.3.8", + "@next/env": "16.4.1", "@swc/helpers": "0.5.23", "baseline-browser-mapping": "^2.9.19", "caniuse-lite": "^1.0.30001579", @@ -10327,15 +10327,15 @@ "node": ">=20.9.0" }, "optionalDependencies": { - "@next/swc-darwin-arm64": "16.3.8", - "@next/swc-darwin-x64": "16.3.8", - "@next/swc-linux-arm64-gnu": "16.3.8", - "@next/swc-linux-arm64-musl": "16.3.8", - "@next/swc-linux-x64-gnu": "16.3.8", - "@next/swc-linux-x64-musl": "16.3.8", - "@next/swc-win32-arm64-msvc": "16.3.8", - "@next/swc-win32-x64-msvc": "16.3.8", - "sharp": "^0.35.4" + "@next/swc-darwin-arm64": "16.4.1", + "@next/swc-darwin-x64": "16.4.1", + "@next/swc-linux-arm64-gnu": "16.4.1", + "@next/swc-linux-arm64-musl": "16.4.1", + "@next/swc-linux-x64-gnu": "16.4.1", + "@next/swc-linux-x64-musl": "16.4.1", + "@next/swc-win32-arm64-msvc": "16.4.1", + "@next/swc-win32-x64-msvc": "16.4.1", + "sharp": "^0.35.5" }, "peerDependencies": { "@opentelemetry/api": "^1.1.0", @@ -13093,9 +13093,9 @@ } }, "node_modules/zod": { - "version": "4.5.4", - "resolved": "https://registry.npmjs.org/zod/-/zod-4.5.4.tgz", - "integrity": "sha512-sC95tT5iHHH9gtpj6A81kh+NEaRAUFN+qlUPDUbRfOMvNf5QCBqsb3WgvnpVtK5Y+4UfA6KqufotuTvMGiTlsA==", + "version": "4.6.6", + "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.6.tgz", + "integrity": "sha512-4UmzQUF5fxvfcYHlbjBmejU+w+hbDnWFx4aS8kBx7nPBHcO2SqPbpAG8snbdg+Xse4pRefR98hgjFgIMCI/UhA==", "dev": true, "license": "MIT", "funding": { diff --git a/job-tracker-ui/package.json b/job-tracker-ui/package.json index f1812db..ca6fa42 100644 --- a/job-tracker-ui/package.json +++ b/job-tracker-ui/package.json @@ -21,7 +21,7 @@ "@types/react-dom": "^19.2.3", "axios": "^1.20.0", "date-fns": "^4.1.0", - "next": "^16.3.8", + "next": "16.4.1", "react": "^19.2.4", "react-dom": "^19.2.4", "react-router-dom": "^7.18.2", @@ -62,7 +62,7 @@ "@types/jest": "^30.0.0", "babel-jest": "^30.4.1", "eslint": "^9.39.5", - "eslint-config-next": "^16.3.8", + "eslint-config-next": "16.4.1", "identity-obj-proxy": "^3.0.0", "jest": "^30.4.2", "jest-environment-jsdom": "^30.4.1" @@ -70,6 +70,7 @@ "overrides": { "brace-expansion": "2.1.7", "postcss": "8.5.25", - "sharp": "0.35.5" + "sharp": "0.35.5", + "zod": "4.6.6" } }