[aikido-autofix]

Upgrade zod, bundle-name, @inquirer/external-editor, and yaml to fix prototype pollution, Base64 validation bypass, ReDoS attacks, and AppleScript injection vulnerabilities.

✅ Code not affected by breaking changes.

✅ No breaking changes from either package upgrade affect this codebase.

Zod (3.25.76 => 4.6.0): The codebase uses only basic zod features (z.object(), z.string(), z.record(), z.enum(), z.boolean(), .url(), .optional(), .default(), .parse()). None of the breaking changes apply:

• The z.record(z.string(), projectConfigSchema) usage is a simple string-keyed record without pattern matching or intersections

• The __proto__ stripping behavior complements existing security protections rather than breaking them

• The stricter URL validation only rejects invalid URLs, which is desired behavior

• No usage of affected methods like .pick(), .omit(), .extend(), .merge(), string length validation, datetime parsing, or specialized validators

@inquirer/external-editor (1.0.3 => 3.0.3): All prompt names are simple strings ("selection", "value", "password", "confirmed") without dots, so the answer name expansion behavior change does not apply. No expand type prompts are used. Node version requirements are satisfied.

All breaking changes by upgrading zod from version 3.25.76 to 4.6.7 (CHANGELOG)

Version	Description
4.3.0	Using .pick() or .omit() on object schemas with refinements now throws an error instead of silently dropping refinements
4.3.0	Using .extend() to overwrite properties on object schemas with refinements now throws an error
4.3.0	Object masking methods (.pick(), .omit()) now validate that the keys provided actually exist in the schema and throw errors for unrecognized keys
4.3.0	Intersection behavior changed: when intersecting schemas with z.strictObject(), only keys unrecognized by both sides are rejected, whereas previously any unrecognized key from either side would cause an error
4.4.0	Tuple defaults now materialize output values correctly, changing the structure of parsed output for tuples with defaults and optional elements
4.4.0	Object properties with z.undefined() schema are now treated as required (key must be present) instead of optional
4.4.0	The .merge() method now throws when the receiver has refinements instead of silently producing ambiguous refinement behavior
4.4.0	Base64 validation now rejects whitespace instead of allowing it
4.4.0	CUID validation has been tightened and CUID v1 is deprecated
4.4.0	HTTP URL validation now rejects malformed HTTP(S) URLs with a missing slash after the protocol
4.5.0	z.iso.datetime() now requires seconds in RFC 3339 format; minute-precision input like 2020-01-01T06:15Z is no longer accepted (except with local: true)
4.5.0	String length methods (.min(), .max(), .length()) now count Unicode code points instead of UTF-16 code units, which tightens validation for .min() and .length() on astral characters like emoji
4.5.0	Record key schemas now only govern keys that match them (aligning with TypeScript index signatures); intersecting an object with a pattern-keyed record no longer rejects the object's own keys
4.5.0	__proto__ keys are now always stripped from parsed objects, records, and key transforms; strict mode reports own __proto__ input keys as unrecognized_keys instead of silently swallowing them
4.5.0	z.ipv6() validation is stricter and no longer accepts malformed addresses like ::@1\ or ::1\n
4.5.0	z.ulid() now restricts the first character to 0–7 to prevent timestamp overflow
4.5.0	z.httpUrl() now enforces RFC 1035 length limits on the host
4.5.0	Number and bigint formats are now distinguished at the type level
4.6.0	Error maps run when result.error is first read rather than at parse time, so code that swaps z.config() between the parse and the read gets the newer configuration instead of the configuration active at parse time.
4.6.0	z.emoji() now rejects component-only strings like "123", "#", "*", and lone zero-width joiners, variation selectors, or skin tone modifiers that were previously accepted.
4.6.0	Numeric enum .options no longer includes reverse mapping keys; a three-member numeric enum now lists only [0, 1, 2] instead of ["UK", "Germany", "France", 0, 1, 2].
4.6.0	The runtime patterns for z.base64() and z.base64url() changed to character sets with length/padding enforced in code; composing z.base64() into a template literal now checks alphabet but not length.
4.6.0	The email pattern string changed: z.regexes.email no longer has capture groups, issue.pattern on failed z.email() changed, and z.toJSONSchema() output no longer contains lookaheads; composing email into template literals no longer applies the no-consecutive-dots rule to the rest of the string.
4.6.0	Eight metadata members (.format, .minLength, .maxLength, .minValue, .maxValue, .isInt, .minDate, .maxDate) are now computed getters that materialize on first read instead of being written at construction; Object.keys() and Object.assign() behavior changes, and values can differ for order-dependent chains.
4.6.0	fromJSONSchema() now enforces six validation keywords (minProperties, maxProperties, uniqueItems, contains, minContains, maxContains) that were previously ignored.

All breaking changes by upgrading @inquirer/external-editor from version 1.0.3 to 3.0.7 (CHANGELOG)

Version	Description
2.0.0	Answer name with . are now expand in the answer object. e.g. name.sub would generate an answer object formatted as {name: {sub: 'answer'}}.
2.0.0	expand prompt default value if not specified is now help.
2.0.0	Drop support for node 0.10 and 0.12
3.0.0	Drop support for Node < 4

✅ 7 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-10707	MEDIUM	[zod] A prototype pollution vulnerability exists in object schemas with catchall merges, where a literal __proto__ key is treated as a normal property and can replace the result object's prototype. This allows attackers to inject inherited properties into validated objects.
AIKIDO-2026-10706	MEDIUM	[zod] Base64 validator incorrectly accepts strings with whitespace, allowing invalid Base64 inputs to pass validation by being normalized during decoding, weakening strict validation guarantees.
AIKIDO-2026-970919	LOW	[zod] Zod's runtime base64 and base64url string-format validators use regular expressions whose repeated capturing groups recurse over the input. Validating a large or specially composed untrusted string with z.string().base64() or z.string().base64url() overflows the regex engine call st...
AIKIDO-2026-161437	LOW	[zod] A ReDoS vulnerability in the emoji format validator causes exponential backtracking on certain Unicode sequences, allowing attackers to stall the event loop for seconds with a ~100-byte malicious string, resulting in denial of service.
AIKIDO-2026-886499	MEDIUM	[bundle-name] bundleName inserts the caller supplied bundle identifier directly into an AppleScript string passed to runAppleScript without validating it. A bundle identifier containing a double quote, backslash, or line break can escape the AppleScript string literal and inject additional st...
AIKIDO-2026-674364	LOW	[@inquirer/external-editor] The package previously created temp files and launched an external editor in ways that could allow path escaping from the intended temp location and/or unsafe command interpretation. The fix creates a dedicated temporary directory (mkdtempSync) and always places the te...
AIKIDO-2026-683761	LOW	[yaml] Recursive merge key aliases can cause unbounded expansion, exhausting memory or call stack and crashing the process with an uncontrolled RangeError instead of the intended bounded alias-count error.

🔗 Related Tasks

• https://linear.app/wave-av/issue/WAVE-32761/aikido-fix-7-security-issues-in-zod-bundle-name-inquirerexternal

🤖 Remediation details

Fix security vulnerabilities in zod, yaml, bundle-name, and @inquirer/external-editor

Short summary

This PR remediates security vulnerabilities in four npm packages: zod, yaml, bundle-name, and @inquirer/external-editor. Two of these (zod and yaml) are direct dependencies declared in the root package.json; the other two are transitives resolved only in package-lock.json. All four are now resolved at patched versions in package-lock.json.

zod

zod is a direct dependency in the root package.json (declared as ^3.22.0, resolved at 3.25.76). The patched floor requires 4.6.0, which is a semver-major jump. The declared spec was updated to ^4.6.0 and npm install --package-lock-only resolved it to 4.6.7. The @wave-av/sdk peer dependency already declared ^3.22.0 || ^4.4.3, so the major bump was compatible with the existing dependency tree.

yaml

yaml is a direct dependency in the root package.json (declared as ^2.7.0, resolved at 2.9.0). The patched floor is 2.9.1, a patch-level bump within the same major. The declared spec was updated to ^2.9.1 and npm install --package-lock-only resolved it to 2.9.1.

bundle-name

bundle-name is a transitive dependency pulled in by default-browser → open (a direct dep). default-browser@5.5.1 was already installed and declared bundle-name as ^4.1.0, a range that permits the patched 4.1.1. No manifest edit was needed; running npm update bundle-name --package-lock-only was sufficient to advance the lockfile resolution from 4.1.0 to 4.1.1.

@inquirer/external-editor

@inquirer/external-editor is a transitive dependency reached via inquirer → @inquirer/prompts → @inquirer/editor → @inquirer/external-editor. The patched floor is 3.0.3, but the installed @inquirer/editor@4.2.23 only resolved @inquirer/external-editor@1.0.3. Fixing the chain required bumping inquirer (a direct dependency) from ^12.3.2 to ^13.0.0: inquirer@13 pulls @inquirer/prompts@8, which pulls @inquirer/editor@5, which resolves @inquirer/external-editor at 3.0.7. The declared spec for inquirer in the root package.json was updated accordingly and npm install --package-lock-only realized the full chain.

Version changes

Package	From	To	Why updated
zod	^3.22.0 / 3.25.76	^4.6.0 / 4.6.7	Direct CVE fix (major bump required)
yaml	^2.7.0 / 2.9.0	^2.9.1 / 2.9.1	Direct CVE fix
inquirer	^12.3.2 / 12.11.1	^13.0.0 / 13.4.3	Parent bump required to fix @inquirer/external-editor
@inquirer/prompts	7.10.1	8.7.5	Transitive after parent bump (inquirer)
@inquirer/editor	4.2.23	5.3.6	Transitive after parent bump (inquirer → @inquirer/prompts)
@inquirer/external-editor	1.0.3	3.0.7	CVE fix — transitive after parent bump (inquirer → @inquirer/prompts → @inquirer/editor)
bundle-name	4.1.0	4.1.1	CVE fix — lockfile refresh under existing default-browser@5.5.1

[codeant-ai]

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML; Path: .coderabbit.yaml; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: 982361b1-007d-4486-a03f-40755e5936d2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	yaml@​2.9.0 ⏵ 2.9.1	+1
	zod@​3.25.76 ⏵ 4.6.7		+16
	inquirer@​12.11.1 ⏵ 13.4.3	+1		+1	-1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Potential typosquat (AI signal): npm fast-string-width as a typo of string-width Did you mean: fast~~-st~~ring-width From: package-lock.json → npm/inquirer@13.4.3 → npm/fast-string-width@3.0.2 ℹ Read more on: This package | This alert | What is AI-detected potential typosquatting? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Given the AI system's identification of this package as a potential typosquat, please verify that you did not intend to install a different package. Be cautious, as malicious packages often use names similar to popular ones. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fast-string-width@3.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Potential typosquat (AI signal): npm fast-wrap-ansi as a typo of wrap-ansi Did you mean: ~~fast-~~wrap-ansi From: package-lock.json → npm/inquirer@13.4.3 → npm/fast-wrap-ansi@0.2.2 ℹ Read more on: This package | This alert | What is AI-detected potential typosquatting? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Given the AI system's identification of this package as a potential typosquat, please verify that you did not intend to install a different package. Be cautious, as malicious packages often use names similar to popular ones. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fast-wrap-ansi@0.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report