[yumike]

Summary

Raise rw-backend's Zod dependency floor from ^3.25.76 || ^4.0.0 to ^4.6.7 to address high-severity Dependabot alert #213, GHSA-mrhx-c7xc-m3w5.

The repository already installs patched Zod 4.6.7 through yarn.lock, but the alert identifies the direct manifest declaration in plugins/rw-backend/package.json. That declaration still permits vulnerable releases, and published plugin consumers do not use this repository's lockfile.

This is a minimum-version security constraint, not an exact pin: future compatible Zod v4 updates remain allowed. The installed package version, checksum, and complete lockfile resolution set are unchanged; only the manifest floor and matching lockfile descriptors change.

The internal permission-rule import from zod/v3 remains unchanged: the Zod 4 package includes that compatibility API, which Backstage's permission types still use. The backend plugin's public entry exports only its plugin, not the internal cursor schemas.

Validation

On Node 24.22.2:

• Hardened immutable install.
• All 666 repository tests, including cursor and comment/permission coverage.
• Typecheck, lint, formatting.
• All plugin builds and separate frontend/backend builds.
• Explicit semver checks exclude vulnerable versions, accept 4.6.7/future v4 releases, and exclude v5.
• Automated lockfile comparison confirms no resolved package changes.
• Verified installed Zod remains 4.6.7 and its zod/v3 compatibility API still validates the permission-rule schema.

No global overrides or peer dependency changes. Main checkout and local config/data remain unchanged.