[waleedlatif1]

Summary

• zod 4.3.6 → 4.6.7 everywhere (GHSA-mrhx-c7xc-m3w5): before 4.6.6, .max()/.length()/.size() on arrays, sets and maps ran only after every element was parsed, so an oversized body against a bounded schema (e.g. the deployed-chat files array) cost memory per element. 4.6.7 checks the bound first
• 4.6 emits a root $ref + $defs for a schema with .meta({ id }). Added inlineRootRef in @sim/utils/json-schema and used it where Sim reads the root: the MCP catalog (otherwise executeWorkflow's x-run-id/x-sim-via headers disappear from the allowlist), the OpenAPI generator and check, and the v2 CLI generator
• 4.6 made z.iso.datetime() strict RFC 3339 and rejects minute precision (2026-01-01T06:15Z). Added isoDateTimeSchema in contract primitives with the 4.3 grammar, issue and JSON Schema, and used it at untrusted input boundaries: list-logs filters, v2 run-window bounds, workspace file expectedUpdatedAt, table analytics and TTL values, integration tool inputs (CloudTrail, Lambda, SailPoint, Resend, Buffer, QuickBooks webhook), and the chat lastObservedAt. Fields that only hold Sim's own toISOString() output stay strict
• Table TTLs: the cleanup SQL used zod's datetime regex, so a minute-precision TTL would have been rejected and an already stored one would never expire. Both now use the shared pattern
• CLI generator handles JSON Schema type arrays (4.6 compacts nullable unions to ["string","null"]), and both generators keep a .meta({ default }) that 4.6 drops from a transforming schema's input side
• search_workspace filter dates stay strict: that file is mirrored into the worker verbatim, and its callers (LLM tool args, UI toISOString()) already send seconds
• Regenerated OpenAPI specs (anyOf → type arrays, datetime/email patterns only; no lost properties or headers) and the mothership tool catalog (4 datetime patterns). CLI types are byte-identical

Type of Change

• Bug fix

Testing

• New: MCP catalog asserts executeWorkflow caller headers and that no operation slot is a bare $ref; red without inlineRootRef
• New: isoDateTimeSchema accepts minute precision with Z/offset and rejects malformed values; red (with ttl.test.ts) when swapped for z.iso.datetime(). Cross-checked against zod 4.3.6 on 16 samples × both modes, 0 mismatches
• bun run test on lib/api/contracts, lib/api/mcp, script tests for the CLI/MCP/OpenAPI generators, realtime-protocol, realtime handlers, and neighbors of every touched file (table, buffer, sailpoint, chat post, dashboards, knowledge transfer, quickbooks, logs, v2 routes): all pass
• check:openapi, check:cli-api, check:mcp-operations, check:tool-metadata, bun run lint

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Error		Oct 26, 2026 11:17pm UTC

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable regression was found.

Summary

Updates zod from 4.3.6 to 4.6.7 and adapts schema readers to its changed output.

• Oversized collections reach their size check before every item is parsed.
• Selected input timestamps still accept minute precision.
• Schema generators keep root schemas and nullable types readable to their consumers.

Acknowledged intent: waleedlatif1 explicitly keeps search_workspace dates strict because its schema is mirrored into the worker and its callers already send seconds.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Contracts[Zod contracts] --> Convert[JSON Schema conversion]
  Convert --> Inline[inlineRootRef]
  Inline --> MCP[MCP operation descriptions]
  Inline --> OpenAPI[OpenAPI generation and checks]
  Inline --> CLI[CLI types and field descriptions]

Loading

_{Reviews (1) · Last reviewed commit: "fix(deps): update zod to 4.6.7 so bounde..." · Reviewed by Greptile}

[waleedlatif1]

Closing in favor of backporting the upstream size-bound fix (colinhacks/zod#6652) onto 4.3.6 as a bun patch. 4.6 also changes absent-key handling for unknown/any properties, datetime precision, and root $ref output, and @trigger.dev/core (forced onto our zod by the root override) has unknown/any keys in its run and IPC schemas that would hit the absent-key change. This branch keeps the Sim-side fixes for the full upgrade later, once Trigger.dev supports zod 4.