From 57d93f2a909f5c21643cb3a2866b85f76cf6ec01 Mon Sep 17 00:00:00 2001 From: O M Date: Mon, 5 Oct 2026 12:54:46 -0400 Subject: [PATCH] Ignore the unpatched zod finding so the scheduled Snyk scan can pass. zod through 4.6.5 has no fix, and this site does not parse request bodies with zod. Co-authored-by: Cursor --- .snyk | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.snyk b/.snyk index 93d899b..1d6be37 100644 --- a/.snyk +++ b/.snyk @@ -34,6 +34,16 @@ ignore: only reached through ajv 6 inside @vercel/routing-utils, which validates routing config at build time. expires: 2026-12-21T00:00:00.000Z + SNYK-JS-ZOD-20510278: + - '*': + reason: >- + No patched zod release exists (affected through 4.6.5). The issue is + unbounded issue objects when an unconstrained array schema parses a + huge failing array. This site does not parse request bodies with zod. + The copies are Astro and @astrojs/sitemap at build time, and + @vercel/cli-config, which only reads local CLI config and has no + array fields. + expires: 2027-01-05T00:00:00.000Z 'snyk:lic:npm:@vercel/analytics:MPL-2.0': - '*': reason: MPL-2.0 is compatible with Apache-2.0 for unmodified npm dependencies.