chore(deps): update Zod, OpenCode SDK and Bun types

[dependabot]

Summary

Update Zod, the OpenCode evaluation SDK, and Bun type declarations while keeping the SDK, MCP app, and evaluation dependency graphs aligned.

Changes

• Update zod from 4.6.5 to 4.6.6 across the three lockfiles and both direct consumers.
• Update @opencode-ai/sdk from 1.18.35 to 1.19.0 in triage evaluations and its existing override.
• Update @types/bun and bun-types from 1.4.2 to 1.4.3. The new Bun declaration edge reuses the existing undici-types 8.9.0 record.
• Preserve existing lifecycle-hook policy and runtime versions. Remaining lockfile changes update Zod peer bindings.

Testing

• Frozen installs for the SDK, MCP app, and triage evaluations: passed.
• All five portable plugin checks: Ruff lint, Ruff format, SDK build:ci, source compatibility, and source compatibility tests passed.
• SDK types, format, build:evals, and build:plugin: passed.
• git diff --check HEAD^ HEAD: passed.
• Upstream package archive integrity, publication ages, lifecycle hooks, engine requirements, shipped changes, and affected call sites reviewed. Focused old/new Zod behavior checks passed.
• Current-head CI passed before this description update. Full local runtime suites and the latest applicable CI remain merge gates.

Risk and rollout

Zod changes record typing and checks collection bounds before parsing elements; invalid oversized collections can report fewer element diagnostics while remaining rejected. The OpenCode SDK runtime JavaScript is unchanged, and Bun changes affect development types. No public CLI or runtime-setting changes are included.

All updated packages satisfy the seven-day cooldown; the latest eligibility was 2026-10-19 at 08:04:42.842 UTC for @types/bun 1.4.3. The Zod npm archive checksums and signature verified, its provenance commit and cleaned upstream release commit have identical Git trees, and shipped source files match that tree. See the Zod release for upstream context.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-19T09:29:19.006458Z	76bc1b2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

Reviewed publication ages, archive integrity, upstream changes, installation hooks, engines and affected call sites. All updated packages satisfy cooldown. Three frozen installs, all five portable plugin checks, types, formatting, evaluation/plugin builds, all 393 MCP tests, deterministic evaluation tests and configuration validation passed. The full SDK suite passed with 4,939 passes, 65 skips and no failures. Current-head CI passed. Initial pnpm store access and local Ruff version mismatches were resolved in the validation environment; no source repair was needed.