From 1efc896f56b3891de1ee4ffa061abdd18da3ab40 Mon Sep 17 00:00:00 2001
From: Michael Gasperini <michael@mikesoft.it>
Date: Sun, 1 Nov 2026 00:36:59 +0100
Subject: [PATCH] fix(deps): override toml to ^5.0.1 and zod to ^4.6.7

Clears the two HIGH toml advisories (GHSA quadratic DoS, dev scope via effect beta) and the HIGH zod advisory. Upstream @opencode-ai/plugin 1.19.5 still pins effect beta and zod 4.1.8, so scoped overrides until it moves. Verified: npm audit 0 high/critical, 43 tests green.
---
 package-lock.json | 12 ++++++------
 package.json      |  8 ++++++++
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 7ec9075..157e624 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4064,9 +4064,9 @@
       }
     },
     "node_modules/toml": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/toml/-/toml-4.3.0.tgz",
-      "integrity": "sha512-lVb8X9BsPVuH0M4BKeS91tXAmJvCjQ5UIyAbQFaxkKGyUFK2RPkhwaFSQH8vbpl1d23eu/IBH+dwVMHWaq9A5A==",
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/toml/-/toml-5.0.1.tgz",
+      "integrity": "sha512-EqYNA/YvUNndrA2B3O2ojzLQoTQrBxeZ9UIjQwk8t10oe6n7dwclBwd9IdZQTOKwe6vWX+AXtl6IntXRbepdxQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4380,9 +4380,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "4.1.8",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.1.8.tgz",
-      "integrity": "sha512-5R1P+WwQqmmMIEACyzSvo4JXHY5WiAFHRMg+zBZKgKS+Q1viRa0C1hmUKtHltoIFKtIdki3pRxkmpP74jnNYHQ==",
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
       "dev": true,
       "license": "MIT",
       "funding": {
diff --git a/package.json b/package.json
index bf0a3b4..fe9d872 100644
--- a/package.json
+++ b/package.json
@@ -42,6 +42,14 @@
     "test": "node --test --test-concurrency=1 \"tests/*.test.ts\"",
     "prepublishOnly": "npm run build"
   },
+  "overrides": {
+    "effect": {
+      "toml": "^5.0.1"
+    },
+    "@opencode-ai/plugin": {
+      "zod": "^4.6.7"
+    }
+  },
   "devDependencies": {
     "@opencode-ai/plugin": "^1.19.3",
     "@types/node": "^26.6.5",