fix(deps): patch the zod, happy-dom and undici advisories

package.json

@@ -54,7 +54,7 @@
     "remark-rehype": "11.1.2",
     "ts-fsrs": "5.4.2",
     "unified": "11.0.5",
-    "zod": "4.6.5"
+    "zod": "4.6.6"
   },
   "devDependencies": {
     "@axe-core/playwright": "4.13.0",
@@ -66,7 +66,7 @@
     "@types/react-dom": "19.3.0",
     "@vitejs/plugin-react": "6.1.2",
     "fake-indexeddb": "6.2.5",
-    "happy-dom": "20.14.6",
+    "happy-dom": "21.0.4",
     "tailwindcss": "4.3.3",
     "typescript": "7.0.2",
     "vite": "8.3.4",

pnpm-workspace.yaml

@@ -1,10 +1,17 @@
 # Supply-chain hygiene: never resolve a package version published in the last 7 days.
 minimumReleaseAge: 10080
+# Exception for one version: happy-dom 21.0.4 is the first release that fixes GHSA-834v-8h66-3h79 (high, host code execution from an unsanitized
+# import alias; <=21.0.3 is affected). It was published 2026-10-20, so it clears the 7-day rule on 2026-10-27; remove this entry then.
+minimumReleaseAgeExclude:
+  - happy-dom@21.0.4
 savePrefix: ""
 # One KaTeX everywhere: rehype-katex and micromark-extension-math ask for 0.16.x, which has an advisory
 # (GHSA-238p-pmpm-9mq7, fixed in 0.18.2). The app itself already uses the patched 0.19.0.
 overrides:
   katex: 0.19.0
+# miniflare (inside wrangler) pins undici 7.29.1 in every release up to wrangler 4.152.0; 7.30.1 fixes GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685 and
+# GHSA-f72v-6w45-q472. Scoped to miniflare's own dependency; remove once a miniflare release pins undici >= 7.30.1.
+  "miniflare>undici": 7.30.1
 # Dependencies may not run install scripts unless listed here: esbuild (bundler) and workerd (Cloudflare's local Workers runtime).
 allowBuilds:
   esbuild: true