#3835 chore(deps): bump zod to 4.6.7

zod below 4.6.6 can exhaust memory while validating oversized constrained collections (GHSA-mrhx-c7xc-m3w5, high). The catalog pins 4.3.6, used by @react-email/ui (bundled into the preview server) and apps/web.

Changes

• pnpm-workspace.yaml catalog: zod 4.3.6 → 4.6.7 (2026-10-12, the latest 4.6 patch; includes the 4.6.6 fix).
• pnpm-lock.yaml: re-locked. Only packages/ui and apps/web move.
• .changeset/ui-bump-zod.md: patch for @react-email/ui.

With #3834 removing zod 3 (via pkg-pr-new), this leaves no vulnerable zod in the lockfile.

Testing

Suite	Result
render	90/90
react-email	319/319
ui	113/113
editor (unit + browser)	540/540

• pnpm install --frozen-lockfile, pnpm build, pnpm typecheck, biome and scripts/check-dependency-versions.ts pass. The lockfile is stable under another pnpm install --lockfile-only.
• @react-email/ui server action: called exportSingleTemplate directly with no Resend API key (nothing reaches the network). validationErrors and the serverError fallback have the same shape as on 4.3.6.
• Preview server: email dev on apps/demo renders and hot-reloads, no page errors.
• apps/web tests: 36 passed, 68 skipped, same as canary on 4.3.6. That includes all 11 /api/send/test route tests (Resend, Supabase and rate limiters stubbed), among them the zod cases: an invalid to address and a missing field both return 400.
• apps/web API: ran next start and posted invalid bodies to /api/check-spam. Both return 400 with the ZodError issues, before any network call.

---

Summary by cubic

Bumps zod from 4.3.6 to 4.6.7 to fix a high-severity vulnerability (GHSA-mrhx-c7xc-m3w5) where zod below 4.6.6 can exhaust memory while validating oversized constrained collections.

• Updates the catalog entry in pnpm-workspace.yaml and re-locks pnpm-lock.yaml; only @react-email/ui and apps/web move.
• Adds a patch changeset for @react-email/ui.