[mbeacom]

What and why

The required audit check now fails on every pull request, #328 included. Two high advisories were published after main's last green run on 2026-10-11:

• GHSA-mrhx-c7xc-m3w5: zod < 4.6.6. Validating oversized constrained collections can exhaust memory.
• GHSA-xjj6-f33q-929c: undici >= 6.23.0 < 6.29.1. An unhandled error on excessive content-encodings is a denial of service. undici reaches this repository through @actions/github and @actions/http-client, which are bundled into all three Actions.

As in #251, this edits only those two bun.lock entries, so unrelated packages don't move:

• zod: 4.6.5 → 4.6.7, inside ^4.6.5, published 2026-10-12.
• undici: 6.29.0 → 6.29.1, inside ^6.23.0, published 2026-10-15.

Both are past the 3-day minimumReleaseAge, and their integrity hashes match the npm registry. bun install --frozen-lockfile accepts the edit. audit:gate now reports no advisories at any severity, so the moderate one it listed before is gone too.

Checklist

• Commits are DCO signed off.
• No recorded decision changes.
• The schema is unchanged: schema:emit leaves schema/adr.schema.json byte-identical with zod 4.6.7.
• I regenerated packages/ci/dist under linux/amd64 oven/bun:1.4.2. The diff is zod's and undici's own code, and nothing else moves.
• Tests: no new behavior. Before this change audit:gate failed locally on main's lockfile with the same two advisories; it passes after.
• bun run typecheck && bun run build && bun test && bun run lint pass (4544 pass, 2 skip, 0 fail).

Notes for reviewers

• This touches packages/ci/**, so it needs gate-change-acknowledged.
• Run under Node with no event, each bundle prints the same result as main's: index.js exits early outside a pull request, queue-action.js asks for a token, and portal-action.js refuses a payload with no visibility.
• @adrkit/core and @adrkit/mcp still declare zod: ^4.6.5. A consumer's fresh install already resolves 4.6.7, but the floor would only exclude 4.6.5 if it moved to ^4.6.6 in the next lockstep release. The audit gate's stated scope doesn't cover consumer installs, so I left that out of this fix.

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[github-actions]

Decisions governing this change

5 accepted decisions govern this change

• 0030 — Keep extension surfaces that carry a dependency tree outside this repository
  • via path: packages/ci/**
• 0035 — Execute the gates that certify a pull request from the default branch
  • via path: packages/ci/**
• 0036 — Expose the governing-decisions Action through one root Marketplace entry point
  • via path: packages/ci/dist/index.js
• 0041 — Regenerate committed artifacts on Dependabot pull requests with default-branch scripts behind a maintainer label
  • via path: packages/ci/dist/**
• 0043 — Publish schema v0.2.0 with RFC 3339 seconds, retain v0.1.0, and validate every record against the current schema
  • via package: zod

_{Links point at 2ceb361, this run's GITHUB_SHA. Run adr explain <path> locally to see why a file is governed.}