zod 3.25.76 exact pin ships a copy affected by GHSA-mrhx-c7xc-m3w5 — please allow zod ^4.6.6 (zod/v3 subpath) #622

Summary

transloadit@6.4.0 (and every 4.x–6.x release) declares "zod": "3.25.76" as an exact runtime dependency. That version is in the affected range of GHSA-mrhx-c7xc-m3w5 / CVE-2023-54404 (high, DoS: $ZodArray.handleArrayResult accumulates one issue per invalid array element without a cap; patched in zod@4.6.6). Consumers that have moved their own code to zod 4 still ship a second, vulnerable zod copy via transloadit, and because the pin is exact neither Dependabot nor a normal update can resolve it — only an application-level override.

Ask

Could the SDK depend on zod@^4.6.6 and import its v3 schemas from the zod/v3 subpath (zod 4 ships the full v3 API there; see https://zod.dev/library-authors)? That keeps the @transloadit/zod/v3 schemas unchanged for v3 consumers (as discussed in #263) while removing the vulnerable copy from everyone's tree. Alternatively, a peerDependency range ^3.25 || ^4 with a devDependency would also let consumers resolve a single patched copy.

Context

• npm view 'transloadit@>=4.10.2' dependencies.zod → 3.25.76 for every release through 6.4.0 (2026-10-22).
• Hit in gamma-app/gamma after upgrading the workspace to zod 4.6.7; transloadit is now one of the two remaining zod 3 copies in our server image.