zod

Verified. zod 3.25.76 → 4.6.6, with code changes in 2 files. The repo's checks pass before and after the upgrade (4/4 tests).

Why this repo

zod 3.25.76 is a direct dependency and is in the vulnerable range of:

• GHSA-mrhx-c7xc-m3w5 Zod can exhaust memory while validating oversized constrained collections (high). GHSA-mrhx-c7xc-m3w5, CVE-2023-54404. Fixed in 4.6.6.

The advisories name no function to look for, so Teire cannot rule out that your code reaches the vulnerable path.

What changed upstream

Comparing the public API of 3.25.76 and 4.6.6: zod: Zod can exhaust memory while validating oversized constrained collections.

18e71c71 Rename the JSON Schema process helper so bundler polyfills cannot collide (#6541) by @colinhacks

— v4.6.0

413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged

— v4.6.3

Commits between 3.25.76 and 4.6.6:

• 9c21983 ci: stage at verbose so a failed OIDC token exchange says why
• 529f78d 4.6.6
• a0ebf97 fix(v4): check array, set and map size bounds before parsing elements (colinhacks/zod#6652)
• a2ba4a6 fix(types): declare record output and input as members, not base type argumen...
• c42596b release: hold the run on the release-approval environment until the staged ve...
• bacad51 docs: square the Code for Japan logo to match the other bronze tiles
• 8fb2faf docs: crop the Code for Japan logo and list it first in bronze
• b2ef983 docs: add Code for Japan to bronze sponsors
• 74304ce release: stage npm versions instead of publishing them (colinhacks/zod#6622)
• 34a626f docs: tighten the z.locales tree-shaking note

compare the versions

Changes

_{Fixed zod v4 breaking changes in two files: 1. schema.ts: z.record() now requires two arguments (keySchema, valueSchema). Changed z.record(z.string()) to z.record(z.string(), z.unknown()) to match the Record<string, unknown> type for the labels field. 2. intake.ts: zod v4 replaced ZodError.errors with ZodError.issues. Updated both intake() and firstProblem() to use parsed.error.issues instead of parsed.error.errors. Each issue has a path property (array of string|number) that works the same way as before.}

--- a/npm-zod/src/schema.ts
+++ b/npm-zod/src/schema.ts
@@ -12,7 +12,7 @@
     email: z.string().email(),
     channel: z.nativeEnum(Channel),
     subject: z.string().min(1),
-    labels: z.record(z.string()).default({}),
+    labels: z.record(z.string(), z.unknown()).default({}),
   })
   .strict();
 

--- a/npm-zod/src/intake.ts
+++ b/npm-zod/src/intake.ts
@@ -6,11 +6,11 @@
 export function intake(input: unknown): IntakeResult {
   const parsed = Ticket.safeParse(input);
   if (parsed.success) return { ok: true, ticket: parsed.data };
-  return { ok: false, problems: parsed.error.errors.map((issue) => issue.path.join(".") || "(root)") };
+  return { ok: false, problems: parsed.error.issues.map((issue) => issue.path.join(".") || "(root)") };
 }
 
 /** The first problem's field, for a one-line error banner. */
 export function firstProblem(input: unknown): string | null {
   const parsed = Ticket.safeParse(input);
-  return parsed.success ? null : (parsed.error.errors[0]?.path.join(".") ?? null);
+  return parsed.success ? null : (parsed.error.issues[0]?.path.join(".") ?? null);
 }

Verification

Each side installed its own lockfile in its own sandbox (Token Factory Sandboxes, a microVM per command; the install had the network, the checks had no network interface).

Evidence: verified. typecheck, test pass on the baseline and after; 4/4 tests passed.

Receipt

Model total: $0.163.

Risks not covered

• z.iso.datetime() and z.iso.datetime({ offset: true }) no longer accept minute-precision input like 2020-01-01T06:15Z; local: true still admits 2020-01-01T06:15 — "RFC 3339 mandates seconds. z.iso.datetime() and z.iso.datetime({ offset: true }) no longer accept minute-precision input like 2020-01-01T06:15Z. local: true still admits 2020-01-01T06:15, si" (source)

• Chained checks no longer overwrite each other in JSON Schema output; the converter now folds checks as a conjunction, so order no longer changes output (e.g., .min() and .max() bounds are preserved even after a format check) — "⚠️ Chained checks no longer overwrite each other in JSON Schema Each check used to write its own bounds into the schema as it attached, in chain order, so a format check applied after .min() and `.m" (source)

• z.emoji() pattern now requires at least one pictograph, regional indicator, or keycap; no longer accepts standalone variation selectors, skin tone modifiers, or joiners like "123", "#", "*", or lone zero-width joiners — "Unicode's Emoji_Component property covers the pieces that attach to an emoji, so z.emoji() accepted "123", "#", "*", and a lone zero-width joiner, variation selector, or skin tone modifier. " (source)

• Numeric enum options no longer include reverse mappings in JSON Schema output; z.base64() and z.base64url() runtime patterns are now character sets with length/padding enforced in code, not regex, to avoid regex stack overflow on large strings — "⚠️ Numeric enum options no longer include the reverse mappings … The runtime patterns for z.base64() and z.base64url() are the character sets, with length and padding enforced in code, so a multi-" (source)

• A record's key schema now governs only keys that match it (like TypeScript index signatures); intersecting an object with a pattern-keyed record no longer rejects the object's own keys, and unrecognized_keys issues no longer abort the schema, allowing multiple issues to be reported — "A record's key schema now governs only the keys that match it, the way TypeScript treats an index signature. Intersecting an object with a pattern-keyed record no longer rejects the object's own keys." (source)

• JSON Schema $defs entries no longer include redundant id fields; this may affect consumers reading those internal id fields directly — "JSON Schema $defs entries no longer include redundant id Fixed in #5759. JSON Schema conversion through z.toJSONSchema() now strips redundant id " (source)

• CUID validation tightened and CUID v1 deprecated; z.cuid() now uses stricter regex — "CUID validation through z.cuid() has been tightened, and CUID v1 is now deprecated. Fixed in #5880." (source)

• Empty z.union([]), z.xor([]), and discriminated unions no longer crash at construction time; they now construct and fail at parse time — "Empty z.union([]), z.xor([]), and discriminated unions no longer crash at construction time. They construct and fail at parse time. Fixed in #5869." (source)

• Lint, end-to-end and integration suites were not run; dependencies were installed without lifecycle scripts.

Rollback

Revert this pull request: every file listed under Changes returns to zod 3.25.76.

Commands

@teire rebase · @teire recreate · @teire explain · @teire ignore zod

_{Teire · live run · NVIDIA Nemotron 3 Ultra on Nebius Token Factory}