Repository navigation
fix(deps): upgrade zod to 4.6.7 and body-parser to 2.4.0 for audit - #108
Merged
Merged
Conversation
bun audit fails on GHSA-mrhx-c7xc-m3w5 (zod <4.6.6) and GHSA-27r3-jxmh-p828 (body-parser 2.x <2.4.0). Pin zod 4.6.7 in all three workspaces and refresh the locked body-parser. Zod 4 keeps keys whose transform may yield undefined required in the inferred type, so the hook contract restores the previous optional-key output shape; runtime validation is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XRf7b6xrnvwdG56Y8NrGFD
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Shuoh · project thread
Summary
bun auditcurrently fails onmain(and therefore on #107) because of two new high advisories:zod< 4.6.6. Pinnedzodgoes from 3.25.76 to 4.6.7 inshared,telegram-renderer-mcp, andsession-control-mcp.body-parser>=2.0.0 <2.4.0, pulled in through@modelcontextprotocol/sdk→ express. The lockfile now has 2.4.0.Zod 4 keeps a key required in the inferred output type when its transform can return
undefined, which broke typecheck inprogress-disclosure.test.ts.hook-contract.tsnow wraps the exported hook input types to restore the Zod 3 optional-key shape. This is a type-only change. The schemas,.strict()rejection of extra keys, and required template fields behave the same at runtime; I spot-checked this by parsing payloads with both versions.The checked-in worker bundles do not change. Rebuilding them with the pinned Bun 1.3.14 gives byte-identical output.
Verification
bun install --frozen-lockfilebun run check: typecheck, python:compile, bundle:check (Bun 1.3.14), privacy:scan, and version:check pass. Locally, 4artifact-deliveryTS tests and 10 Python tests fail identically on unmodifiedmain, because the sandbox runs as root and those tests refuse to run as root. CI is the authoritative run.bun audit: no vulnerabilitiesDelivery impact
Rollback
Revert this commit. That restores zod 3.25.76 and body-parser 2.3.0, and with them the audit failure.
Generated by Claude Code