From d8bf15f729388afe6ff17aadefbc618ad3fd85c5 Mon Sep 17 00:00:00 2001 From: Mark Beacom Date: Sun, 25 Oct 2026 11:49:40 -0400 Subject: [PATCH] fix(deps): require zod ^4.6.6 in core and mcp for GHSA-mrhx-c7xc-m3w5 @adrkit/mcp still declare ^4.6.5. A consumer whose tree already holds 4.6.5 keeps it. Raising the floor to ^4.6.6 excludes the only affected release in range from every install of the next lockstep release. The root workspace declaration and bun.lock's three workspace specs move with it; the resolved zod is unchanged at 4.6.7, so packages/ci/dist and schema/adr.schema.json do not change, and check:clean-clone passes. The documentation site has its own lockfile and resolved zod 4.6.5 through Astro. I moved that single entry to 4.6.7 and kept Astro's range untouched; the site builds (72 pages). build, typecheck, lint, audit:gate, check:changelog, check:clean-clone, and the full suite (4544 pass, 2 skip) pass. Signed-off-by: Mark Beacom --- CHANGELOG.md | 10 ++++++++++ bun.lock | 6 +++--- package.json | 2 +- packages/core/package.json | 2 +- packages/mcp/package.json | 2 +- site/bun.lock | 2 +- 6 files changed, 17 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index deb94b77..13b7b162 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,6 +21,16 @@ Until `1.0.0`, minor releases may include breaking changes `$schema` out of both manifests. The plugin ships on merge to `main` and is versioned independently of this repository. +### Security + +- **`@adrkit/core` and `@adrkit/mcp` now require `zod` `^4.6.6`**, up from + `^4.6.5`, so an install can no longer resolve a zod release affected by + [GHSA-mrhx-c7xc-m3w5](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5) + (validating oversized constrained collections can exhaust memory). This + repository's lockfile already moved to 4.6.7 in #329; this raises the floor + that published installs see. The documentation site's lockfile moves to zod + 4.6.7 as well. + ## [0.20.0] - 2026-10-10 This release adds a read-only REST server to the OCI image: diff --git a/bun.lock b/bun.lock index e801356b..36ffcea3 100644 --- a/bun.lock +++ b/bun.lock @@ -7,7 +7,7 @@ "devDependencies": { "@types/bun": "latest", "typescript": "^6", - "zod": "^4.6.5", + "zod": "^4.6.6", }, }, "packages/adapters/agent-plugin": { @@ -76,7 +76,7 @@ "picomatch": "^4", "semver": "^7", "yaml": "^2.9.1", - "zod": "^4.6.5", + "zod": "^4.6.6", }, "devDependencies": { "@types/bun": "latest", @@ -104,7 +104,7 @@ "dependencies": { "@adrkit/core": "workspace:*", "@modelcontextprotocol/server": "2.3.1", - "zod": "^4.6.5", + "zod": "^4.6.6", }, "devDependencies": { "@modelcontextprotocol/client": "2.3.1", diff --git a/package.json b/package.json index ab99dc55..1368f6b9 100644 --- a/package.json +++ b/package.json @@ -54,6 +54,6 @@ "devDependencies": { "@types/bun": "latest", "typescript": "^6", - "zod": "^4.6.5" + "zod": "^4.6.6" } } diff --git a/packages/core/package.json b/packages/core/package.json index f9b9f52e..6a822cd7 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -61,7 +61,7 @@ "picomatch": "^4", "semver": "^7", "yaml": "^2.9.1", - "zod": "^4.6.5" + "zod": "^4.6.6" }, "devDependencies": { "@types/bun": "latest", diff --git a/packages/mcp/package.json b/packages/mcp/package.json index 1a5cbb24..429e698c 100644 --- a/packages/mcp/package.json +++ b/packages/mcp/package.json @@ -47,7 +47,7 @@ "dependencies": { "@adrkit/core": "workspace:*", "@modelcontextprotocol/server": "2.3.1", - "zod": "^4.6.5" + "zod": "^4.6.6" }, "devDependencies": { "@modelcontextprotocol/client": "2.3.1", diff --git a/site/bun.lock b/site/bun.lock index 544ab5b5..d6e6f778 100644 --- a/site/bun.lock +++ b/site/bun.lock @@ -764,7 +764,7 @@ "yocto-queue": ["yocto-queue@1.2.2", "", {}, "sha512-4LCcse/U2MHZ63HAJVE+v71o7yOdIe4cZ70Wpf8D/IyjDKYQLV5GD46B+hSTjJsvV5PztjvHoU580EftxjDZFQ=="], - "zod": ["zod@4.6.5", "", {}, "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q=="], + "zod": ["zod@4.6.7", "", {}, "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg=="], "zwitch": ["zwitch@2.0.4", "", {}, "sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A=="],