Repository navigation
fix(deps): update dependency zod to v4.6.6 [security] - #486
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Contributor
Contributor
Preview DeploymentThe web app for this PR has been deployed: Use this to verify the app works correctly, especially for dependency updates. |
![henry-nsheaps[bot]](https://avatars.githubusercontent.com/in/2371206?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Approve — security patch bump looks clean
- ✅ Renovate patch bump
zod 4.6.5 → 4.6.6 to pick up the fix for CVE-2023-54404 (array/set/map size bounds now checked before parsing elements — colinhacks/zod#6652).
- ✅ Diff is version-string only:
packages/core/package.json + matching bun.lock entry (version + sha512). No code changes needed; patch within the 4.6.x line.
- ✅ Supply-chain note from upstream release — the six malicious commits pushed to zod
main on Sep 21 were reverted the same day and never published to npm. npm provenance for 4.6.6 names 284243f (identical to the pre-rewrite 9c21983). Safe to adopt.
- ✅ Repo exposure to CVE is low in practice: the only
z.array(...) call lives in packages/core/src/space/config.ts and parses local YAML config files, not a network boundary — but patching is still the right call.
Click to expand for full details
zod 4.6.5 → 4.6.6 to pick up the fix for CVE-2023-54404 (array/set/map size bounds now checked before parsing elements — colinhacks/zod#6652).packages/core/package.json + matching bun.lock entry (version + sha512). No code changes needed; patch within the 4.6.x line.main on Sep 21 were reverted the same day and never published to npm. npm provenance for 4.6.6 names 284243f (identical to the pre-rewrite 9c21983). Safe to adopt.z.array(...) call lives in packages/core/src/space/config.ts and parses local YAML config files, not a network boundary — but patching is still the right call.Scope of change
packages/core/package.json | 2 +-
bun.lock | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
Both edits are version-string bumps against the same zod dependency; the lockfile hash update (sha512-v5l… → sha512-4Um…) matches the npm registry entry for 4.6.6.
CVE analysis in context
- Advisory: GHSA-mrhx-c7xc-m3w5, CVSS 4.0 base 8.2 (High). Attack vector is a schema-validated input containing a very large array; pre-patch
$ZodArray.handleArrayResultenumerated issues for every failing element with no early termination, enabling memory exhaustion. - Fix: Size bounds (
.min/.max) are now evaluated before per-element parsing, so an unbounded array validation can short-circuit rather than allocate an issue per element. - Repo usage: The sole zod array call site is
packages/core/src/space/config.ts—z.array(z.string(), { error: 'must be a list of strings' }).optional(). The input is a YAML config file from the user's workspace, so a successful exploit would require the attacker to already control the local filesystem; impact is bounded. The upgrade is still worthwhile for hygiene and future call sites. - Possible follow-up (P2): once this lands, consider adding
.max(…)bounds to any array schemas that parse untrusted or externally-sourced data. Not required for this PR.
Non-code checks
bun.lockentry structure is unchanged (same keys, same transitive deps block); only the version and integrity hash moved, which is the expected shape for a patch bump of a leaf dependency.package.jsonkeeps the exact-version pin style used elsewhere in the file — no range operator introduced.- Renovate description accurately summarizes the CVE and release notes; the auto-generated changelog preview and release-version-check comment are consistent (
0.64.13→0.64.14,fix(deps)conventional-commit prefix).
Risk assessment
| Dimension | Notes |
|---|---|
| Correctness | ✅ Semver patch; no breaking changes expected. |
| Security | ✅ Addresses the advertised CVE; supply-chain provenance addressed in upstream notes. |
| Performance | ✅ Fix actually improves worst-case behavior under hostile input. |
| Maintainability | ✅ Pure dependency update; no code touched. |
| Test coverage | ✅ N/A — no production logic changed. CI will cover regression via existing suites. |
| PR description accuracy | ✅ Matches the diff. |
Follow-ups: none.
- Workflow run: https://github.com/nsheaps/.ai-agent-henry/actions/runs/40028027487
- Advisory: GHSA-mrhx-c7xc-m3w5
- Upstream fix PR: colinhacks/zod#6652
- Release notes: https://github.com/colinhacks/zod/releases/tag/v4.6.6
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.6.5→4.6.6Zod can exhaust memory while validating oversized constrained collections
CVE-2023-54404 / GHSA-mrhx-c7xc-m3w5
More information
Details
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
colinhacks/zod (zod)
v4.6.6Compare Source
Commits:
0cd3af5docs: load the en locale directly in Zod Mini9d5e60fdocs: import locales from zod/locales, not z.locales34a626fdocs: tighten the z.locales tree-shaking note74304cerelease: stage npm versions instead of publishing them (#6622)b2ef983docs: add Code for Japan to bronze sponsors8fb2fafdocs: crop the Code for Japan logo and list it first in bronzebacad51docs: square the Code for Japan logo to match the other bronze tilesc42596brelease: hold the run on the release-approval environment until the staged versions are approved (#6638)a2ba4a6fix(types): declare record output and input as members, not base type arguments (#6645)a0ebf97fix(v4): check array, set and map size bounds before parsing elements (#6652)529f78d4.6.69c21983ci: stage at verbose so a failed OIDC token exchange says whyConfiguration
📅 Schedule: (in timezone America/New_York)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.