Update dependency zod to v4.6.6 [SECURITY] #2
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/npm-zod-vulnerability"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
4.6.2→4.6.6Zod can exhaust memory while validating oversized constrained collections
CVE-2023-54404 / GHSA-mrhx-c7xc-m3w5
More information
Details
Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic in $ZodArray, which accumulates every validation issue for each failing element with no cap or early termination, causing the process to allocate excessive issue objects and crash due to out-of-memory conditions.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
colinhacks/zod (zod)
v4.6.6Compare Source
Commits:
0cd3af5docs: load the en locale directly in Zod Mini9d5e60fdocs: import locales from zod/locales, not z.locales34a626fdocs: tighten the z.locales tree-shaking note74304cerelease: stage npm versions instead of publishing them (#6622)b2ef983docs: add Code for Japan to bronze sponsors8fb2fafdocs: crop the Code for Japan logo and list it first in bronzebacad51docs: square the Code for Japan logo to match the other bronze tilesc42596brelease: hold the run on the release-approval environment until the staged versions are approved (#6638)a2ba4a6fix(types): declare record output and input as members, not base type arguments (#6645)a0ebf97fix(v4): check array, set and map size bounds before parsing elements (#6652)529f78d4.6.69c21983ci: stage at verbose so a failed OIDC token exchange says whyv4.6.5Compare Source
Commits:
d2b135cdocs: add the 4.6.x patch highlights to the 4.6 postf1448f7docs: fold the 4.6.x patch highlights into the 4.6 post's own sectionsde65a5cdocs: lead the properties section with the check and add a Zod Mini tab (#6598)56222cdfeat(instanceof): key the .properties() shape off the instance type (#6600)ca0229aRevert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"cc4cd4eRevert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""0f3f5ee4.6.559bbc03chore: re-pin the integration peers to the workspace zod after the 4.6.5 bumpv4.6.4Compare Source
A patch on top of 4.6.3.
d6bc1e30feat: addz.currencyCode()over a vendored ISO 4217 list, refreshed weekly by CI (#6595)ad32d751perf:z.url()rejects an invalid URL withURL.canParse()instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)2bb08717chore: re-pin the integration peers to the workspace zod after the 4.6.4 bumpf6e1701achore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)v4.6.3Compare Source
A patch on top of 4.6.2.
413cce9afix(v4): make z.properties() a check again (#6594) — removes the standalonez.properties()schema from 4.6.0;z.instanceof().properties()and.check(...z.properties())are unchanged75d63ee1docs: show only the.properties()method form in the 4.6 post46da9572docs: match the error-message examples to what the parsers emitConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
Superceeded by
a42018c1a2Pull request closed