[zuhairhalawa]

Why

pnpm audit in the verify job fails on main (0438851) with five advisories published after 2026-10-23, when the identical source tree was green. verify is a required check, so every pull request is blocked until this lands.

Advisory	Package	Severity	Path	Fixed in	Now
GHSA-mrhx-c7xc-m3w5	zod	high	.>zod	4.6.6	4.6.6
GHSA-834v-8h66-3h79	happy-dom	high	.>happy-dom, .>vitest>happy-dom	21.0.4	21.0.4
GHSA-xjj6-f33q-929c	undici	high	.>wrangler>miniflare>undici	7.30.1	7.30.1
GHSA-4qv8-2p9j-2685	undici	moderate	same	7.30.1	7.30.1
GHSA-f72v-6w45-q472	undici	moderate	same	7.30.1	7.30.1

What changes

Dependency files only (package.json, pnpm-workspace.yaml, pnpm-lock.yaml); no application source.

• zod 4.6.5 -> 4.6.6, the first patched release (exact pin, like every other dependency). 4.6.7 exists but differs from 4.6.6 only in the version string.
• happy-dom (dev, test DOM) 20.14.6 -> 21.0.4. 21.0.4 is the first fixed release; vitest 5.0.3 accepts any happy-dom (peerDependencies: "*").
• undici 7.29.1 -> 7.30.1 through a pnpm override scoped to miniflare>undici. Every miniflare release up to the one wrangler 4.152.0 (the latest) pulls in pins undici 7.29.1 exactly, so bumping wrangler cannot fix this. The override is scoped to miniflare's own dependency, is an exact version, stays inside undici 7.x (the range miniflare asks for), and has a comment saying when to remove it. Nothing else resolves undici.
• minimumReleaseAgeExclude: happy-dom@21.0.4 in pnpm-workspace.yaml. See the next section.

The 7-day release-age rule

The project resolves only package versions at least seven days old.

• zod 4.6.6 (2026-10-11) and undici 7.30.1 (2026-10-15) are older than seven days: no exception needed for undici.
• happy-dom 21.0.4 was published on 2026-10-20, so it is only four days old and pnpm refuses it. It is the only fixed version (21.0.3 and earlier are affected), so this PR adds a one-version exception, happy-dom@21.0.4, with a comment. The rule stays on for every other package, and the exception becomes redundant on 2026-10-27 and can be deleted then.
• happy-dom is a development dependency (the DOM the unit tests run in); it is not in the production bundle. The advisory is host code execution from an unsanitized import alias, which matters for a test environment that loads untrusted markup, but the exposure here is limited to the test run.

Because it is a deliberate, narrow exception to a supply-chain rule, I compared the published tarballs before using it: happy-dom 21.0.3 vs 21.0.4 differs in 7 source files (ECMAScriptModuleCompiler, BrowserFrameNavigator, BrowserFrameURL, HTMLIFrameElement, PublicSuffixList, CSSPropertyList, ICSSStyleDeclaration; I read the ECMAScriptModuleCompiler change, which is the alias validation the advisory describes, and only skimmed the rest) with no new dependencies, no install scripts, and npm provenance attestations present. undici 7.29.1 vs 7.30.1 differs only in library code (decompress interceptor, EventSource parser, SRI token parsing, cookies, websocket, H1/H2 client), also with provenance and no dependencies or install scripts.

If you would rather not carry the exception, the alternative is to wait until 2026-10-27 and drop that one line; main would stay red until then.

Verified locally (Windows, Node 24.16.0, pnpm 11.7.0)

• pnpm install regenerated the lockfile; pnpm install --frozen-lockfile is then a no-op
• pnpm audit: No known vulnerabilities found
• pnpm exec tsc -b --noEmit, pnpm typecheck:worker: pass
• pnpm test: 45 files, 655 tests pass
• pnpm scan:secrets: no findings
• pnpm build: succeeds (the existing large-chunk warning is unchanged)
• STUDYAI_E2E_PORT_BASE=24000 pnpm test:e2e: 72 passed, 2 skipped (the two that need STUDYAI_REAL_LECTURE/STUDYAI_REAL_PACK or STUDYAI_SCREENSHOTS, which are off by default)