[rhein1]

Problem

The maintained OpenRouter top-60 review pack pinned Zod 4.4.3. The current GitHub-reviewed advisory GHSA-mrhx-c7xc-m3w5 affects Zod versions below 4.6.6 and blocks the repository's moderate-level audit gate.

Change

• Pin the private review-pack test harness to Zod 4.6.7.
• Regenerate the package lockfile with npm install --package-lock-only --ignore-scripts; the lockfile records the registry-provided resolved URL and integrity.

This is dependency metadata only. The pack remains private, review-only, unactivated, and has no provider calls, payment, deployment, publication, or live execution authority.

Validation

• npm audit --audit-level=moderate --package-lock-only --ignore-scripts: 0 vulnerabilities.
• node scripts/validate.mjs: 60 catalog entries, 58 decision records, 36 files.
• Syntax checks for the four maintained JavaScript/TypeScript sources: passed.
• Offline review-pack and validator suites using existing dependencies: 33 passed, 1 suite blocked by unavailable @openrouter/agent in the no-install environment; no test failures in executed cases.
• node scripts/sync-integration-counts.mjs --check: passed.
• Repository rename preflight check remains stale on the existing base branch and is unrelated to this two-file change; it was not regenerated.

No packages were installed and no provider or hosted calls were made.