[roomote-roomote]

​Created by Roomote. View the session or mention @roomote-roomote for follow-up asks.

Related issue

Runtime Dependabot security maintenance: 29 eligible alerts across the workspace and packaged API dependency trees.

Why this PR exists

• A maintainer explicitly invited this PR in the linked issue or discussion
• I am a maintainer / this is internal Roomote work

The selected releases address Zod validation memory exhaustion, MSAL authorization-flow parameter disclosure, undici denial-of-service/integrity issues, and URI parsing/normalization vulnerabilities. All 29 targets were rechecked as open, with no existing open PR covering the bundle.

What changed

Dependency	Previous resolutions → patched version	Dependabot coverage
Zod	3.25.76 / 4.3.6 / 4.4.3 → 4.6.6	20 alerts: #279, #280, #282–#291, #293–#300
@azure/msal-node	5.2.3 / 5.5.0 → 7.1.0	#281, #309
undici	7.29.1 → 7.30.1	#306–#308
fast-uri	3.1.8 → 3.1.9	#302–#305

• Align direct Zod declarations and transitive resolutions; regenerate both lockfiles through pnpm. Preserve the seven-day minimumReleaseAge: 10080 policy and its exclusions byte-for-byte. Every newly resolved package version was checked against npm publication time.
• Migrate Zod consumers: explicit record keys, partial enum records for model roles and capability milestones, error APIs, generics, descriptions, and native JSON Schema generation. Use GUID validation to retain Zod 3's accepted UUID-shaped inputs instead of unexpectedly requiring RFC variant bits.
• Adapt recursive MCP nullable-optionals handling to Zod 4 pipes and schema definitions, preserving nested constraints, descriptions, discriminated unions, transport coercion, and per-parse default factories. Add focused regressions and update tests that depended on Zod 3's default error wording or schema representation.
• Preserve existing behavior while adopting the Zod 4 migration changes. The MSAL v7 browser-loopback changes do not apply to Snowflake's DefaultAzureCredential path; its client-credential integration was exercised with the new MSAL. Upstream security details: undici 7.30.1, fast-uri 3.1.9.

No intended product behavior change. The proposed graph contains no targeted vulnerable resolution in either lockfile, and every Zod workspace declaration and installed workspace Zod version is aligned. GitHub alert closure remains pending merge and dependency rescan; no alerts were dismissed.

Deferred: body-parser alert #301 remains on 2.3.0. Its 2.4.0 patch becomes age-eligible October 29, 2026 at 11:39:39 UTC; this PR does not bypass or wait out the policy.

How it was tested

• Frozen workspace install, forced clean refresh, and standalone API production frozen install; exact resolution/declaration checks and publication-age checks passed. Coverage-check script.
• Broad lint, all workspace fast typechecks, Knip, and the unmodified pre-commit/pre-push hooks passed. API and web production builds passed; web emitted existing tracing/deprecation warnings.
• Exercised the workspace test matrix, including schema/auth/provider/MCP suites. Web server: 248 files / 2,252 tests passed. All 64 web client shards: 352 files / 3,247 tests passed. API live-listener, credential-egress, BullMQ build-artifact and controller monitoring checks passed in isolated reruns after concurrent-run timeouts/shared-state conflicts.
• Known baseline exception: the worker agent-home and cloud-agents opencode-runtime Kimi catalog expectations fail because they omit two models already present in develop. Both failures were independently reproduced in a detached, unchanged checkout using the original frozen lockfile. The workspace matrix excluded only that named expectation; those unrelated tests and model definitions were not changed. Web suites ran without that exclusion.
• Packaged Snowflake runtime load and Zod parity passed. Both workspace and packaged Azure identity clients completed the real MSAL 7 client-credential flow over a controlled HTTP transport; undici fetch/Agent completed a real local HTTP round trip. Replay script runs from the repository root after both installs. These checks use fixture credentials, not a live external account.
• Real local development login, home rendering, and environment YAML validation were exercised without network/DOM mocks. No task or environment was created. Final screenshots were opened and inspected; the committed diff matches the proof snapshot exactly.

Screenshots

Authenticated home rendering after the dependency upgrades; this does not prove task execution or external-provider authentication:

Real environment form rejects an empty name with the migrated validator; no environment was saved:

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• If this change should appear in the changelog, I ran pnpm changeset

This is one cohesive security bundle; the Zod major-version compatibility work necessarily spans shared schema consumers. Normal repository fast lint/type gates were used rather than the formatting-inclusive aliases. No changeset was added.

[roomote-community]

No code issues found. See session

Reviewed the dependency/lockfile updates and Zod 4 migration, including MCP nullable inputs, defaults, record schemas, UUID compatibility, and structured-output conversion. A small runtime probe confirmed null/default handling, transport coercion, and nested constraints.

CI lint, type checking, Knip, and the app Docker build passed. The Test job fails on the unchanged Kimi model-catalog expectation in apps/worker/src/run-task/agent-home.test.ts, matching the baseline exception documented in this PR; this does not establish that the remaining CI test matrix passed. Repository validation suites were left to CI. No approval submitted.

_{Reviewed 896aaf7}