[waleedlatif1]

Summary

• zod 4.3.6 checks an array's .max()/.length() (and a set's or map's .max()/.size()) only after parsing every element (GHSA-mrhx-c7xc-m3w5). Against a bounded schema, a sub-megabyte body of malformed elements builds one issue per element; the public deployed-chat endpoint validates before auth, so this was an unauthenticated memory blowup (on 1M entries 4.3.6 crashes building the error message)
• Backports the leading size gate from upstream fix(v4): check array, set and map size bounds before parsing elements colinhacks/zod#6652 (shipped in 4.6.6) as a version-pinned bun patch, patches/zod@4.3.6.patch, on the ESM and CJS builds: a container larger than its leading upper bound skips its elements, and its own size check reports the single too_big issue
• Not upgrading to 4.6.7 here: 4.6 rejects absent unknown/any object keys, requires seconds in ISO datetimes, and emits root $ref JSON Schema for id'd schemas. @trigger.dev/core, which the root override puts on our zod, declares unknown/any run and IPC fields. The Sim-side fixes for 4.6 are kept on fix/zod-4-6-7 (fix(deps): update zod to 4.6.7 so bounded collections stop walking every element before their size check #9386, closed) for when Trigger.dev supports zod 4
• patches/README.md documents the patch and when to remove it

Type of Change

• Bug fix

Testing

• Differential check, patched vs pristine 4.3.6, 17 schemas (array/set/map with max/min/length/size/nonempty, refine/transform/optional/default/catch wrappers, nested objects, records, tuples) × 25 inputs: all 401 in-bound results identical; the 24 differing cases are oversized inputs whose issues are exactly the pristine too_big issues without the per-element ones. Async parse matches
• 1M-element body against a 15-file array: patched 1 issue in 1ms; pristine throws RangeError: Invalid string length
• New chats.test.ts case: oversized files array yields one too_big issue. Red on unpatched zod (40,001 issues), green patched
• bun run test on lib/api/contracts, lib/api/mcp, lib/permission-groups, lib/dashboards, lib/table (143 files, 1547 tests) and realtime-protocol

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Ignored	Preview	Oct 27, 2026 12:21am UTC

[cubic-dev-ai]

All reported issues were addressed across 5 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge, with no new actionable findings.

Summary

Backports early collection-size checks to Zod 4.3.6 without upgrading Zod.

• Oversized collections stop before their entries are validated.

No new actionable findings were established. Tests were not run during this review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Collection input] --> B{Forward parse with checks enabled?}
  B -->|No| C[Use existing Zod run]
  B -->|Yes| D{Exceeds a leading upper bound?}
  D -->|No| C
  D -->|Yes| E[Run the failing size check]
  E --> F[Mark its issue non-continuing]
  F --> G[Return without parsing elements or running later checks]

Loading

_{Reviews (2) · Last reviewed commit: "fix(deps): stop later checks from readin..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}