fix(deps): clear the two live npm advisories that turned the release red

The security-audit matrix went red at 72015a57e4 on two lockfiles that were
green thirty minutes earlier at ec45097d01, with no lock change between the
runs. Both are real advisories, not a stale allowlist:

- web: zod GHSA-mrhx-c7xc-m3w5 (HIGH, memory exhaustion while validating
  oversized constrained collections, patched in 4.6.6). @cloudflare/config
  pins zod exactly and even 0.28.0 still pins 4.6.5, so there is no upstream
  fix; the established mechanism here is the package.json overrides block
  (esbuild, nanoid, postcss, sharp, undici, ws, postcss-selector-parser).
  zod is now overridden to 4.6.7.
- web: body-parser GHSA-27r3-jxmh-p828 (HIGH, DoS via trailing bytes after a
  compressed body). [email protected] declares ^2.2.1, so this is an in-range
  lock update, no override: 2.3.0 -> 2.4.0, which also pulls qs 6.16.1.
- crates/tui/extension-host: zod 4.6.5 -> 4.6.7. @modelcontextprotocol/client
  and /core declare ^4.2.0, so `npm update zod` is sufficient; no override.

The admitted-advisory list was not widened. web/docs/DEPENDENCY_SECURITY.md
still admits only the reviewed braces mitigation and its four file hashes.

Verified locally:
- web: npm ci --no-audit (896 packages, postinstall braces patch hashes match
  the reviewed set), npm run audit:dependencies -> upstreamFindings 0,
  mitigated [], blocked [].
- web: node --test scripts/dependency-security.test.mjs -> 7 passed, 0 failed.
- web: npx tsc --noEmit -> exit 0 (zod 4.4.3 -> 4.6.7 changes no web type).
- extension-host: npm audit --json -> 0 total findings (was high 1).
- extension-host: npm run typecheck exit 0; npm test -> 420 tests, 413 pass,
  7 skipped, 0 failed.

Not verified here: hosted security-audit matrix and the remaining eight
lockfiles, which were green at their last run and are unchanged; the web
Next/Wasm build, which the hosted web job owns.

🤖 Written by deepseek-v4.1-flash-1017 (AI agent) on behalf of the maintainers.

crates/tui/extension-host/package-lock.json

@@ -799,9 +799,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "4.6.5",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.5.tgz",
-      "integrity": "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==",
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
       "dev": true,
       "license": "MIT",
       "funding": {

web/package-lock.json

@@ -5927,19 +5927,19 @@
       "license": "MIT"
     },
     "node_modules/body-parser": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
-      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz",
+      "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "bytes": "^3.1.2",
-        "content-type": "^2.0.0",
+        "content-type": "^2.1.0",
         "debug": "^4.4.3",
         "http-errors": "^2.0.1",
-        "iconv-lite": "^0.7.2",
+        "iconv-lite": "^0.7.3",
         "on-finished": "^2.4.1",
-        "qs": "^6.15.2",
+        "qs": "^6.16.1",
         "raw-body": "^3.0.2",
         "type-is": "^2.1.0"
       },
@@ -12829,9 +12829,9 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.16.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
-      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
+      "version": "6.16.1",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.1.tgz",
+      "integrity": "sha512-5Px6J7rfHBAGUhNQ3es4YzcOdBBw0SDcVtThJml4RdnKw4tKs2epA0kPZ+K8X+WiHktT93RHVcQ/3ym5aTCgtg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -15401,9 +15401,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
-      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
       "dev": true,
       "license": "MIT",
       "funding": {

web/package.json

@@ -63,6 +63,7 @@
     "sharp": "0.35.5",
     "ws": "8.21.0",
     "undici": "7.29.1",
-    "postcss-selector-parser": "7.1.6"
+    "postcss-selector-parser": "7.1.6",
+    "zod": "4.6.7"
   }
 }