[dependabot]

Resolve the 27 currently open dependency alerts and remove the three CodeQL warnings caused by data interpolation in the packaged-startup test fixture.

Update Electron to 44.9.1, DOMPurify to 3.4.17, Zod to 4.6.6, body-parser to 2.4.0, fast-uri to 3.1.9, Hono to 4.13.11, and ip-address to 10.7.4. Keep Undici consumers on their existing major versions, using 6.29.1, 7.30.1, and 8.12.2. Explicit runtime Zod dependencies supply SDK peers; a scoped Expo CLI override removes its remaining vulnerable Zod 3 package.

Expo's plugin/output validators use fixed Zod 4. Its optional MCP command-schema factory uses the same package's public zod/v3 compatibility entry, preserving the legacy tunnel converter's command enum, primitive parameter types, required fields, and strict object constraints. This narrow factory has no collection schemas. The compatibility entry itself is not claimed to contain the Zod 4 collection fix. Patch provenance, limits, and removal criteria are recorded in patches/README.md.

The startup test now passes fixture values into a fixed stub module through a function, preserving real descriptor admission and generation publication without generating JavaScript from those values. No alert suppressions or dismissals are added.

Validation

• Clean frozen pnpm installation; every local patch digest matches the lockfile and actual Expo consumer path.
• Dependency-security regressions: 47 passed, including five new Expo/Zod compatibility and security tests. Reverting the MCP bridge in memory loses the generated JSON Schema constraints and fails the regression assertions.
• Packaged-startup tests: 4 passed; Pi reasoning tests: 5 passed; shared renderer tests: 26 passed.
• Web, Daemon, and Desktop builds, Mobile typecheck, license policy, production dependency policy, Markdown links, public-repository safety, and diff checks passed.
• Registry audit reports only GHSA-86w9-cpqp-85rv for node-forge 1.4.0, already mitigated by the repository's pinned patch and passing malformed-signature/certificate regressions. Version-only audit tools do not recognize that patch; the result is not reported as zero advisories.
• Full CI and CodeQL on this updated head must pass before merge. GitHub alert closure requires a default-branch rescan after merge.

Review

Static and in-host adversarial review found no remaining issues. Test assertions and execution gates remain intact; the startup fixture changes only how stub data is supplied. Outside-model coverage is unavailable because the configured CLI authentication failed in this session. The optional MCP tunnel service was inspected but was not installed or run; its exact legacy conversion boundary is exercised by the regression.

Documentation

Status: current. Dependency-patch documentation matches the final frozen security candidate and its compatibility limits.

Scope: audited dependency manifests, scoped overrides, patch registration, Expo factory bridge, regression coverage, and related contributor/mobile/security guidance. This final audit reused the full document reads after verifying unchanged candidate hashes; only pnpm-lock.yaml changed between audits.

Documentation health:

• patches/README.md — Current: identifies the optional MCP consumer, public zod/v3 factory-only bridge, primitive-schema limit, unchanged Zod 4 collection validators, removal gate, and regression commands. It makes no claim that the v3 entry received the Zod 4 collection fix.
• apps/mobile/README.md — Current: SDK and native acceptance boundaries are unchanged.
• CONTRIBUTING.md — Current: focused validation and platform-evidence guidance remains applicable.
• SECURITY.md — Current: reporting and production-support boundaries are unchanged; no remote advisory closure is claimed.

Coverage: patch reference, removal criteria, verification how-to, and compatibility explanation are present; no new public interface needs a separate tutorial. Documentation debt: the pre-existing patches/README.md navigation gap remains because no other tracked Markdown file links to it. Diagram drift: none; module topology is unchanged.

Validation: Git blob hashes prove the sole inter-audit change is exactly three Expo patch-digest replacements in pnpm-lock.yaml. Freshly installed Expo CLI resolves Zod 4.6.6; its command factory uses zod/v3 with no array/map/set schemas, and plugin/output validators retain the default Zod entry. Final candidate comparison found unchanged HEAD, index, and audited bytes; git diff --check passed. The prior 396 Markdown local-link checks remain applicable because all document bytes are unchanged. Historical 2026-10-12 validation remains explicitly dated. No generator, build, dependency install, or runtime test was run by this documentation audit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T12:14:23.633040Z	cd7d902	New commits
🔒 Security Review	✅ Completed 2026-10-25T12:22:01.231827Z	cd7d902	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0f409cef31

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".