[ajivanyandev]

Fixed

• zod GHSA-mrhx-c7xc-m3w5 (high): devextreme 26.1.4 pins zod 3.24.4 and there is no patched 3.x. Bumped devextreme and devextreme-react 26.1.4 → 26.1.6, which depends on zod 4.6.7.
• The other zod copy (4.3.6) updated in the lockfile to 4.6.7.

Also updated (to keep the DevExtreme packages in sync)

• devextreme-themebuilder 26.1.4 → 26.1.6, with src/themes/generated/* regenerated.
• devextreme-cli 1.17.0 → 1.18.0.

[Copilot]

🟢 Approval recommended

The manifest and lockfile changes are consistent, and no blocking issues remain in this focused dependency update.

No open issues 🎉

1 file not reviewed

• pnpm-lock.yaml: Generated file

What changed in this PR

Updates DevExtreme dependencies to address the reported Zod vulnerability, GHSA-mrhx-c7xc-m3w5.

Changes:

• Upgrades devextreme and devextreme-react from 26.1.4 to 26.1.6.
• Consolidates both Zod dependency paths on 4.6.7 and removes obsolete transitive dependencies.
• Leaves devextreme-themebuilder at 26.1.4.

File	Description
pnpm-lock.yaml	Updates resolved dependencies and replaces both older Zod versions with 4.6.7.
package.json	Pins DevExtreme and its React integration to 26.1.6.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

Dependency references are consistent, generated theme changes align with the upgrade, and no blocking issues were identified.

No open issues 🎉

1 file not reviewed

• pnpm-lock.yaml: Generated file

_{Review effort: Balanced}