Fix blocking bun audit highs (SDK/zod bumps, docs-only ignores)

.github/workflows/ci.yml

@@ -283,10 +283,14 @@ jobs:
         # http-cache-semantics via Blume @scalar/astro, source-map-js via Blume astro unifont css-tree.
         # Runtime-touching advisories (fast-uri, proxy-addr via MCP SDK; tinypool via oxfmt) are
         # fixed with package.json overrides instead — never ignored.
+        # Docs/release-tooling-only transitives, likewise no src/ reach — ignored, not overridden:
+        # dompurify + sharp + undici + astro's zod via Blume (static docs build),
+        # markdown-it via typedoc (API reference generation),
+        # launch-editor + shell-quote via @changesets/cli (local release tooling).
         run: |
           set +e
           # bun emits ANSI color even when piped — strip it or the severity grep misses it.
-          NO_COLOR=1 bun audit --ignore=GHSA-w3rx-r6r6-pgpr --ignore=GHSA-5p2g-fcmc-qvqq --ignore=GHSA-qhr7-859c-m2p7 --ignore=GHSA-6j4f-fj2g-mc7p --ignore=GHSA-ch52-4w7c-c8xp --ignore=GHSA-68fv-2mgg-jv7q 2>&1 | sed -E 's/\x1b\[[0-9;]*m//g' > /tmp/bun-audit.log
+          NO_COLOR=1 bun audit --ignore=GHSA-w3rx-r6r6-pgpr --ignore=GHSA-5p2g-fcmc-qvqq --ignore=GHSA-qhr7-859c-m2p7 --ignore=GHSA-6j4f-fj2g-mc7p --ignore=GHSA-ch52-4w7c-c8xp --ignore=GHSA-68fv-2mgg-jv7q --ignore=GHSA-cg2g-xh64-v4q7 --ignore=GHSA-mrv2-3pqr-j5jr --ignore=GHSA-587h-7wmj-h5pm --ignore=GHSA-pqg4-j6r4-53mv --ignore=GHSA-gfr2-rv44-r23c --ignore=GHSA-r7fv-28h4-cvq7 --ignore=GHSA-wq5f-xc86-pv6w --ignore=GHSA-xjj6-f33q-929c --ignore=GHSA-mrhx-c7xc-m3w5 2>&1 | sed -E 's/\x1b\[[0-9;]*m//g' > /tmp/bun-audit.log
           cat /tmp/bun-audit.log
           if grep -E '(^|[[:space:]])(high|critical):[[:space:]]' /tmp/bun-audit.log; then
             echo "::error::high or critical vulnerabilities found — blocking"

apps/docs/public/.htaccess

@@ -49,9 +49,13 @@ ErrorDocument 404 /codemap/404.html
 # Apache ignores that file; this is what actually ships headers under /codemap.
 <IfModule mod_mime.c>
   AddType application/json .json
-  AddType application/gzip .tar.gz
 </IfModule>
 
+# Compound extension needs a filename match — AddType splits on dots.
+<FilesMatch "\.tar\.gz$">
+  ForceType application/gzip
+</FilesMatch>
+
 # Homepage Link header (RFC 8288 / RFC 9727 s3). Minimal form; keep in sync with dist/_headers.
 <IfModule mod_setenvif.c>
   SetEnvIf Request_URI "^/codemap/$" IS_CODEMAP_HOME

package.json

@@ -96,15 +96,15 @@
   },
   "dependencies": {
     "@clack/prompts": "1.7.0",
-    "@modelcontextprotocol/sdk": "1.30.0",
+    "@modelcontextprotocol/sdk": "1.32.2",
     "better-sqlite3": "13.0.3",
     "chokidar": "5.0.0",
     "lightningcss": "1.33.0",
     "oxc-parser": "0.147.0",
     "oxc-resolver": "11.24.2",
     "package-manager-detector": "1.8.0",
     "tinyglobby": "0.2.17",
-    "zod": "4.4.3"
+    "zod": "4.6.7"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
@@ -128,6 +128,7 @@
   },
   "overrides": {
     "@hono/node-server": "1.19.17",
+    "body-parser": "2.4.0",
     "fast-uri": ">=3.1.8",
     "hono": ">=4.12.34",
     "nanoid": "3.3.18",