Ignore the unpatched zod finding so Snyk can pass

[om986]

Summary

• The scheduled Snyk run failed on SNYK-JS-ZOD-20510278 (CVE-2023-54404), published today. Zod through 4.6.5 has no patched release; the open upstream fix is an abort-early parse option that has not shipped.
• The finding is unbounded memory use when an unconstrained array schema parses a huge failing array. This site does not parse request bodies with zod. The three copies are Astro and @astrojs/sitemap at build time, and @vercel/cli-config, which only reads local CLI config and has no array fields.
• Ignore it in .snyk until 2027-01-05, matching the other unpatched transitive findings. Revisit then, or sooner if a fixed zod release lands.

Test plan

• Confirm the Snyk job on this pull request reports the zod issue as ignored and exits successfully
• After merge, confirm the next scheduled scan on main is green

Made with Cursor

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
website	Ready	Preview	Oct 5, 2026 4:55pm UTC

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 405c7911-70cd-47b5-92f3-933d4cc9dc36

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}