[saurabhmaheshwari-obin]

What

This ports main's dependency advisory fixes onto the release/v0.0.105-b2 patch line. On v0.0.105 the "Codefly supply chain" gate (npm audit --omit=dev --audit-level=high on frontend and marketing) fails on advisories that were published after v0.0.105 was tagged, so every PR into this line and every tag cut from it is blocked. Nothing here is new work: it is main's resolution, carried back.

• fix(deps): the nextjs agent to 0.0.167, which ships a patched Next.js #1232 (7ed5dedf1), cherry-picked: the nextjs agent goes to 0.0.167, which ships a patched Next.js.
• fix(deps): migrate production validation to patched Zod 4 #1239 (f3fee4c06), ported with conflicts resolved in package.json and package-lock.json: Zod 4 (^4.6.6), @hookform/resolvers ^5.9.2, react-hook-form ^7.55.0. The call sites are the ones fix(deps): migrate production validation to patched Zod 4 #1239 changed (saas-ui schema.ts, team-form.tsx, marketing environment.ts).
• Pins from main that fix(deps): migrate production validation to patched Zod 4 #1239 relied on (main moved them in feat(module)!: remove telemetry service and use the operations intake #1027, which is too large to port):
  • next and eslint-config-next 16.4.1, frontend and marketing;
  • @sentry/nextjs 10.75.2 (critical GHSA-mchm-gjx6-7h55);
  • dompurify 3.4.17, within its existing range (critical GHSA-cg2g-xh64-v4q7).
• Kit packages: @codefly-dev/saas-ui and @codefly-dev/ui go to 0.13.0, main's numbers. Their package directories are byte-identical to main's at f3fee4c06.

CI on this line

The base branch's ci.yml runs pull_request only for PRs into main, so this PR also carries the two CI commits reviewed in #1243 (5a2c45ffb, e8a8920cb):

• release/** PRs run the full checks against their own base;
• only tags on main announce;
• the announce guard fails on git errors.

They are identical to #1243's. When #1243 is rebased on this PR, they drop out of #1243 and its diff stays the reviewed one.

The cherry-picked commits here are re-authored and carry no co-author trailer naming a person, because the naming gate refuses one in a commit record. Credit: #1232 and #1239 on main.

Checks (local)

• npm audit --omit=dev --audit-level=high: frontend and marketing both exit 0. Two moderates remain, fast-uri via ajv, the same as on main.
• Typecheck: frontend and marketing pass.
• Tests:
  • saas-ui vitest: 347/347;
  • marketing: 22/22;
  • published plugin contract tests: pass;
  • scripts/ci/*.test.mjs: 193/193.
• Gates: kit-version against v0.0.105 passes, and module-verify.mjs is OK.
• Frontend vitest, pure project: 3 failures in boundaries.test.ts under local Node 20 ("module.register is not a function"). The same 3 fail on the untouched v0.0.105. CI runs Node 24.

Review

• Codex (high, read-only, on e8a8920cb): no actionable defects. Its findings:
  • Zod 4 port: datasource validation, resolver field errors, team defaults and marketing URL validation all behave as before, and the other usages are clean against the Zod 4 migration guide.
  • Lockfiles: they equal main's f3fee4c06, and Zod 4.6.7 and react-hook-form 7.87.0 satisfy the declared ranges.
  • Kit trees: they equal main's 0.13.0.
  • CI commits: the release PR triggers, the authorization base selection, the protobuf baseline selection and the announce guard all check out.
• code-reviewer: proceed (details below). Its one cheap fix, main's lockfiles to keep libc, is taken.

Code-reviewer detail:

• Matches main: outside the lockfiles, every package.json, kit package, Zod call site, next.config and Sentry file equals main's f3fee4c06. Main's CI was green on that commit.
• Run in a scratch copy:
  • tsc passes;
  • 272 Zod and form tests pass;
  • test-registry-ui passes.
• All 16 Zod importers swept: no Zod 3 API remains.
• Lockfiles: regenerating them with an older npm dropped every libc field. The fix was to take main's lockfiles, which are otherwise identical (76edb5d12).
• Notes, not regressions:
  • Zod 4 rejects datetimes without seconds and non-RFC UUIDs. Everything checked in passes.
  • The marketing environment check throws a raw TypeError on an invalid URL, the same as on Zod 3.

No security review beyond the audit going clean: these are main's fixes.

Order

Merge this first. Then #1243 (the workload operation arm) is rebased on it, so its supply-chain gate goes green with its reviewed diff unchanged.

Second consumer

None: this only keeps the patch line releasable. main already has these fixes.

🤖 Generated with Claude Code