From 06897f70c1664bdc452a809593114b4936a4cc4e Mon Sep 17 00:00:00 2001 From: Dimitri Kennedy Date: Tue, 27 Oct 2026 13:11:40 -0400 Subject: [PATCH] fix(deps): bump zod to 4.6.7 for GHSA-mrhx-c7xc-m3w5 (HACK-1394) Root package.json pinned zod 4.3.5, which is affected by GHSA-mrhx-c7xc-m3w5 (Dependabot alert #59, fixed in 4.6.6). Pin 4.6.7 (latest 4.x) and update bun.lock. packages/db's ^4.1.12 range dedupes to the same zod@4.6.7. --- bun.lock | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bun.lock b/bun.lock index 73e2c3ec6..537001c33 100644 --- a/bun.lock +++ b/bun.lock @@ -12,7 +12,7 @@ "elysia": "^1.4.9", "qrcode": "^1.5.4", "qrcode-terminal": "^0.12.0", - "zod": "4.3.5", + "zod": "4.6.7", }, "devDependencies": { "@biomejs/biome": "2.3.11", @@ -1417,7 +1417,7 @@ "zeptomatch": ["zeptomatch@2.1.0", "", { "dependencies": { "grammex": "^3.1.11", "graphmatch": "^1.1.0" } }, "sha512-KiGErG2J0G82LSpniV0CtIzjlJ10E04j02VOudJsPyPwNZgGnRKQy7I1R7GMyg/QswnE4l7ohSGrQbQbjXPPDA=="], - "zod": ["zod@4.3.5", "", {}, "sha512-k7Nwx6vuWx1IJ9Bjuf4Zt1PEllcwe7cls3VNzm4CQ1/hgtFUK2bRNG3rvnpPUhFjmqJKAKtjV576KnUkHocg/g=="], + "zod": ["zod@4.6.7", "", {}, "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg=="], "zod-to-json-schema": ["zod-to-json-schema@3.25.1", "", { "peerDependencies": { "zod": "^3.25 || ^4" } }, "sha512-pM/SU9d3YAggzi6MtR4h7ruuQlqKtad8e9S0fmxcMi+ueAK5Korys/aWcV9LIIHTVbj01NdzxcnXSN+O74ZIVA=="], diff --git a/package.json b/package.json index fc868f7ac..8e51d905e 100644 --- a/package.json +++ b/package.json @@ -102,6 +102,6 @@ "@opentui/core": "^0.1.74", "qrcode": "^1.5.4", "qrcode-terminal": "^0.12.0", - "zod": "4.3.5" + "zod": "4.6.7" } }