[marceloceccon]

Follow-up to #9. Dependabot opened new zod alerts after #9 merged.

Resolved

• zod ^3.25.76 -> ^4.6.7 (alerts #50, #51). No 3.x release has the fix (vulnerable range is <4.6.6).

Code change

• src/core/clash-engine/tool-vault.ts: zod 4 types ZodOptional.unwrap() / ZodArray.element as core $ZodType, so two as z.ZodType casts are needed. No runtime change.

Needs a maintainer decision (not auto-merged)

defineTool() is exported and takes a zod schema. zodToJsonSchema relies on instanceof z.ZodObject, etc. After this change, consumers who pass zod 3 schemas will get type errors and fall through to {type:'string'} at runtime. This is effectively a breaking change for library users, so it probably needs a changeset and a major/minor version bump.

Verification

• pnpm format:check, pnpm lint, pnpm build, pnpm test (445 pass), pnpm test:eval (7 pass), pnpm audit: no known vulnerabilities

[marceloceccon]

Maintainer decision: release as 2.0.0 (major), zod 4 as a regular dependency. Added changeset + changeset version (CHANGELOG + version bump). Local: format, lint (0 errors), build, 445 tests pass. Will tag v2.0.0 after merge; no npm publish.