Update dependency zod to v3.22.3 [SECURITY]#12479
Open
renovate[bot] wants to merge 1 commit intomasterfrom
Open
Update dependency zod to v3.22.3 [SECURITY]#12479renovate[bot] wants to merge 1 commit intomasterfrom
renovate[bot] wants to merge 1 commit intomasterfrom
Conversation
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Author
|
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
EntelligenceAI PR SummaryUpgrades the
Confidence Score: 5/5 - Safe to MergeSafe to merge — this PR performs a targeted security update to the Key Findings:
Files requiring special attention
|
WalkthroughThis update bumps the Changes
Sequence DiagramThis diagram shows the interactions between components: sequenceDiagram
title Zod Dependency Version Bump in plugins/home
participant Dev as Developer
participant PackageManager as "Package Manager (npm/yarn)"
participant HomePkg as "plugins/home"
participant Zod as "zod library"
Dev->>PackageManager: Install dependencies
PackageManager->>HomePkg: Resolve package.json
HomePkg->>PackageManager: Request zod ~3.22.0
Note over HomePkg, Zod: Previously: zod ~3.21.4
Note over HomePkg, Zod: Updated to: zod ~3.22.0
PackageManager->>Zod: Fetch zod@3.22.x
Zod-->>PackageManager: Return zod package
PackageManager-->>HomePkg: Install zod ~3.22.0
HomePkg-->>Dev: Dependencies resolved with updated zod
🔗 Cross-Repository Impact AnalysisEnable automatic detection of breaking changes across your dependent repositories. → Set up now Learn more about Cross-Repository AnalysisWhat It Does
How to Enable
Benefits
|
🤖 Augment PR SummarySummary: Updates the Changes:
🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
| "react-resizable": "^3.0.4", | ||
| "react-use": "^17.2.4", | ||
| "zod": "~3.21.4" | ||
| "zod": "~3.22.0" |
There was a problem hiding this comment.
~3.22.0 still permits resolving zod@3.22.2 (the CVE mentioned in the PR description), so if the lockfile is pinned (or CI uses a frozen install) this PR may not actually move the installed version to 3.22.3. Consider ensuring the repo’s lockfile/resolutions result in zod>=3.22.3 so the security fix is guaranteed.
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
3.21.4→3.22.3~3.21.4→~3.22.0Zod denial of service vulnerability
CVE-2023-4316 / GHSA-m95q-7qp3-xv42
More information
Details
Zod version 3.22.2 allows an attacker to perform a denial of service while validating emails.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
colinhacks/zod (zod)
v3.22.3Compare Source
Commits:
1e23990Commit9bd3879docs: remove obsolete text about readonly types (#2676)f59be09clarify datetime ISO 8601 (#2673)64dcc8eUpdate sponsors18115a8Formatting28c1927Update sponsorsad2ee9c2718 Updated Custom Schemas documentation example to use type narrowing (#2778)ae0f7a2docs: update ref to discriminated-unions docs (#2485)2ba00fe[2609] fix ReDoS vulnerability in email regex (#2824)1e61d763.22.3v3.22.2Compare Source
Commits:
13d9e6bFix lint0d49f10docs: add typeschema to ecosystem (#2626)8e4af7bX to Zod: add app.quicktype.io (#2668)792b3efFix superrefine typesv3.22.1Compare Source
Commits:
Fix handing of
thisin ZodFunction schemas. The parse logic for function schemas now requires theReflectAPI.932cc47Initial prototype fix for issue #2651 (#2652)0a055e73.22.1v3.22.0Compare Source
ZodReadonlyThis release introduces
ZodReadonlyand the.readonly()method onZodType.Calling
.readonly()on any schema returns aZodReadonlyinstance that wraps the original schema. The new schema parses all inputs using the original schema, then callsObject.freeze()on the result. The inferred type is also marked asreadonly.The inferred type uses TypeScript's built-in readonly types when relevant.
Commits:
6dad907Comments56ace68Fix deno test3809d54Add superformsd1ad522Add transloadita3bb701Testing on Typescript 5.0 (#2221)51e14bedocs: update deprecated link (#2219)a263814fixed Datetime & IP TOC links502384edocs: add mobx-zod-form to form integrations (#2299)a8be450docs: Addzockerto Ecosystem section (#2416)15de22aAllow subdomains and hyphens inZodString.email(#2274)00f5783Addzod-openapito ecosystem (#2434)0a17340docs: fix minor typo (#2439)60a2134Add masterborn0a90ed1chore: moveexports.typesfield to first spot @ package.json. (#2443)67f35b1docs: allow Zod to be used in dev tools at site (#2432)6795c57Fix not working Deno doc link. (#2428)37e9c55Generalize uuidRegex0969950adds ctx to preprocess (#2426)af08390fix: super refinement function types (#2420)36fef58Make email regex reasonable (#2157)f627d14Document canarye06321cdocs: add tapiduck to API libraries (#2410)11e507cdocs: add ts as const example in zod enums (#2412)5427565docs: add zod-fixture to mocking ecosystem (#2409)d3bf7e6docs: addzodockto mocking ecosystem (#2394)2270ae5remove "as any" casts in createZodEnum (#2332)00bdd0afix proto pollution vulnerability (#2239)a3c5256Fix error_handling unrecognized_keys example4f75cbcAdds getters to Map for key + value (#2356)ca7b032FMC (#2346)6fec8bddocs: fix typo in link fragment (#2329)16f90bdUpdate README.md2c80250Update readmeeaf64e0Update sponsorsc576311Update readme5e23b4fAdd*.mdpattern to prettier (#2476)898dcedRevamp tests6309322Update test runnersc0aece1Add vitest config73a5610Update script8d8e1a2Fix deno test bug9eb2508Clean up configscfbc7b3Fix root jest config8677f68docs(comparison-yup): Yup added partial() and deepPartial() in v1 (#2603)fb00edddocs: add VeeValidate form library for Vue.js (#2578)ab8e717docs: fix typo in z.object (#2570)d870407docs: fix incomplete Records example (#2579)5adae24docs: add conform form integration (#2577)8b8ab3eUpdate README.md (#2562)6aab901fix typo test name (#2542)81a89f5Update nullish documentation to correct chaining order (#2457)78a4090docs: update comparison withruntypes(#2536)1ecd624Fix prettier981d4b5Add ZodReadonly (#2634)fba438c3.22.0Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.