Repository navigation
fix(deps): security bumps for next, MCP SDK, drizzle-orm (HACK-1394) - #456
Merged
Merged
Conversation
Contributor
Author
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
This security review couldn’t start because the paying account has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
roodboi
pushed a commit
that referenced
this pull request
Oct 27, 2026
## [4.2.3](v4.2.2...v4.2.3) (2026-10-27) ### Bug Fixes * **deps:** security bumps for next, MCP SDK, drizzle-orm (HACK-1394) ([#456](#456)) ([739c4e5](739c4e5))
roodboi
added a commit
that referenced
this pull request
Oct 27, 2026
Fixes Dependabot alert #59 (GHSA-mrhx-c7xc-m3w5, high: "Zod can exhaust memory while validating oversized constrained collections"; affected < 4.6.6, patched 4.6.6). Part of HACK-1394. ## Change - Root `package.json`: `zod` 4.3.5 → 4.6.7 (latest 4.x; exact pin kept, matching repo style). - `bun.lock`: root dependency line and the single hoisted `zod` entry move to 4.6.7. `packages/db` (`^4.1.12`) dedupes to the same version. The zod 3.x copies under `@jimp/*` are untouched (not in the affected range). ## Validation - Lockfile regenerated with `bun install --lockfile-only --ignore-scripts` on Bun 1.4.4 (the repo's pinned version); `bun install --frozen-lockfile --lockfile-only` then passes. Unrelated workspace-version drift that Bun also wrote into the lockfile was left out so the diff stays minimal. - No local test run; relying on CI for the full gate. Kept separate from #456 so that PR's head stays stable. Not merged; merges go through Dimitri. <!-- codesmith:footer --> --- <a href="https://app.blacksmith.sh/hack-dance/codesmith/hack/pr/513?autoLogin=true&ref=codesmith_pr_footer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v3.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v3.svg"><img alt="View with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v3-3x.png" width="162" height="28"></picture></a> <a href="https://backend.blacksmith.sh/track/enable-autofix?expires=1795713114&installation_model_id=17053&pr_number=513&ref=codesmith_pr_footer&repository=hack-dance%2Fhack&return_to=https%3A%2F%2Fgithub.com%2Fhack-dance%2Fhack%2Fpull%2F513&signature=b9966d79394461d8c0aea775fa40fe863488c0f166054cdece7651fe73a944a5"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img alt="Autofix with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark-3x.png" width="190" height="28"></picture></a> <sup>Need help on this PR? Tag <code>@codesmith-bot</code> with what you need.</sup> <!-- codesmith:autofix:disabled --> <!-- /codesmith:footer -->
roodboi
pushed a commit
that referenced
this pull request
Oct 27, 2026
## [4.2.4](v4.2.3...v4.2.4) (2026-10-27) ### Bug Fixes * **deps:** bump zod to 4.6.7 for GHSA-mrhx-c7xc-m3w5 (HACK-1394) ([#513](#513)) ([75225e0](75225e0)), closes [#59](#59) [#456](#456)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
![https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v3.svg"><source](https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v3.svg"><source){kind=link}
![https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v3.svg"><img](https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v3.svg"><img){kind=link}
![https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source](https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source){kind=link}
![https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img](https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img){kind=link}
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates three direct dependencies to patched releases for HACK-1394. These versions cover the 26 currently open Dependabot alerts listed below. Both Bun lockfiles are updated; no application code or tests change.
Versions and alerts
next: 16.2.6 → 16.4.1
Manifest:
examples/next-app/package.json.use cachefunctions returning typed arrays@modelcontextprotocol/sdk: 1.26.0 → 1.32.0
Manifest:
package.json.drizzle-orm: ^0.44.5 (locked 0.44.7) → 0.45.2
Manifest:
packages/db/package.json.Next 16.4.1 and MCP SDK 1.32.0 are the first patched versions for the newest listed advisories and also cover the older alerts. Drizzle ORM 0.45.2 is the first patched version for its identifier-escaping advisory; it is pinned explicitly.
Validation
restart --json preserves E_USAGE for a detached linked worktreedid not recur in full branch runs on Bun 1.3.5 or 1.3.9. On an isolatedorigin/mainsnapshot at08e0412a, the unchanged lifecycle tests passed five repetitions on each runtime (45 tests per runtime). The full origin/main suite on Bun 1.3.5 also passed (956 passed, 5 skipped, 0 failed). The timeout could not be reproduced on main, so its pre-existing status is not confirmed; branch reruns establish that the earlier failure was intermittent.Release signal:
fix(deps)(patch). No database migration or merge is included.Need help on this PR? Tag
@codesmith-botwith what you need.