Fix the lockfile high advisories (zod, vite, source-map-js) and turn the dependency audit back on #262

Which package is this bug report for?

other

Issue description

pnpm audit --prod on main reports 13 advisories: 3 high, 5 moderate, 5 low. The CI dependency audit is off (audit-level: '', .github/workflows/tests.yml:30) until the lockfile's high ones are fixed, and no issue tracked that. The open dependabot PRs (#240–#246) don't cover them.

• zod (high, "can exhaust memory while validating oversized constrained collections", vulnerable <4.6.6, patched >=4.6.6): the lockfile has zod@4.6.5 (catalog:libs), reached through ui, kernel and protocol. Every RPC is parsed with zod, with /rpc bodies up to 100 MiB, so this one matters most.
• vite (high + 4 moderate, launch-editor and server.fs): dev server only.
• source-map-js (high, event-loop DoS through indexed source-map section offsets).
• minimatch (moderate).

Suggested fix: bump the libs catalog's zod to >=4.6.6, bump or override vite and source-map-js, then set audit-level back to high in tests.yml.

Found by an audit of main (2026-11-11).

Code sample

No response

Versions

• NanoForge Editor main (75093cc)
• Node.js 26, pnpm 12, Bun 1.3
• Arch Linux (kernel 7.2)

Issue priority

Medium (should be fixed soon)

I have tested this issue on a development release

75093cc