From f69fa17f5f9649c8fcc646c60e34632c41c87293 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 27 Oct 2026 09:11:47 +0000 Subject: [PATCH] chore(deps): bump zod from 4.3.5 to 4.6.7 Closes GHSA-mrhx-c7xc-m3w5 / CVE-2023-54404 (high): $ZodArray's handleArrayResult accumulated one issue object per failing element with no cap, so a large array against an unconstrained array schema could exhaust memory. Fixed in 4.6.6 by checking array, set and map size bounds before parsing elements. The manifest already declares zod@^4.3.5, which admits 4.6.7, so this is a lockfile-only change to the single zod stanza. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_011ya3soxe5kkfQeEw42FD6u --- mcp-server/package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/mcp-server/package-lock.json b/mcp-server/package-lock.json index d4fa977..6ee75c9 100644 --- a/mcp-server/package-lock.json +++ b/mcp-server/package-lock.json @@ -5685,9 +5685,9 @@ } }, "node_modules/zod": { - "version": "4.3.5", - "resolved": "https://registry.npmjs.org/zod/-/zod-4.3.5.tgz", - "integrity": "sha512-k7Nwx6vuWx1IJ9Bjuf4Zt1PEllcwe7cls3VNzm4CQ1/hgtFUK2bRNG3rvnpPUhFjmqJKAKtjV576KnUkHocg/g==", + "version": "4.6.7", + "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz", + "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==", "license": "MIT", "funding": { "url": "https://github.com/sponsors/colinhacks"