Repository navigation
fix(deps): bump zod to 4.6.7 for GHSA-mrhx-c7xc-m3w5 (HACK-1394) - #513
Conversation
Root package.json pinned zod 4.3.5, which is affected by GHSA-mrhx-c7xc-m3w5 (Dependabot alert #59, fixed in 4.6.6). Pin 4.6.7 (latest 4.x) and update bun.lock. packages/db's ^4.1.12 range dedupes to the same zod@4.6.7.
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
This security review couldn’t start because the paying account has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
This security review couldn’t start because the paying account has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
This security review couldn’t start because the paying account has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
## [4.2.4](v4.2.3...v4.2.4) (2026-10-27) ### Bug Fixes * **deps:** bump zod to 4.6.7 for GHSA-mrhx-c7xc-m3w5 (HACK-1394) ([#513](#513)) ([75225e0](75225e0)), closes [#59](#59) [#456](#456)
Fixes Dependabot alert #59 (GHSA-mrhx-c7xc-m3w5, high: "Zod can exhaust memory while validating oversized constrained collections"; affected < 4.6.6, patched 4.6.6). Part of HACK-1394.
Change
package.json:zod4.3.5 → 4.6.7 (latest 4.x; exact pin kept, matching repo style).bun.lock: root dependency line and the single hoistedzodentry move to 4.6.7.packages/db(^4.1.12) dedupes to the same version. The zod 3.x copies under@jimp/*are untouched (not in the affected range).Validation
bun install --lockfile-only --ignore-scriptson Bun 1.4.4 (the repo's pinned version);bun install --frozen-lockfile --lockfile-onlythen passes. Unrelated workspace-version drift that Bun also wrote into the lockfile was left out so the diff stays minimal.Kept separate from #456 so that PR's head stays stable. Not merged; merges go through Dimitri.
Need help on this PR? Tag
@codesmith-botwith what you need.