Repository navigation
fix(control): refresh Zod to restore runtime dependency audit #338
Description
Problem
The scheduled dependency audit failed in the Node runtime job on main 9324b9f644e1ac748e67ad5afc01636c3b887900: https://github.com/abruption/session-peer/actions/runs/40329921935
The preserved npm report identifies one high-severity transitive vulnerability in zod 4.6.5: GHSA-mrhx-c7xc-m3w5, uncontrolled memory consumption during collection validation. The current advisory lists versions below 4.6.6 as affected. Python runtime audit succeeded; npm dependency installation succeeded, so this is not evidence of a registry outage.
Fix and acceptance
- Refresh only the Zod lockfile entry to patched 4.6.7, within the existing Better Auth dependency constraints. Preserve direct dependency versions and audit policy.
- Verify a clean
npm ci, typecheck, Control tests/build, runtime and complete npm audits, and relevant Python/Node contract integration. - Complete independent source review and publish a separate PR with current CI. No merge, release or operational service deployment is included.
This records a dependency advisory and audit failure, not a newly reproduced exploit against deployed Control. An upgrade to a running Node Control service requires a separately approved rollout; a Python CLI package update alone does not deploy it.
Activity
abruption commentedon Oct 26, 2026
Fixed by PR #339, merged as
7cb4d957b7144af941ba5651636109b235d67679after all 28 PR checks passed and automatic Codex code/security reviews completed without findings.The same scheduled dependency-audit workflow was dispatched on that protected-main commit: https://github.com/abruption/session-peer/actions/runs/40419409906 — both Node and Python runtime audits completed successfully. The original failed run remains historical evidence; it was not relabeled as successful.
Zod now resolves to 4.6.7 within the existing Better Auth ranges. No audit bypass or dependency exception was introduced. Local Control tests (123) and Node/Python integration tests (11) passed. The owner's v1.3.1 release preparation is separate and in progress. This closes the source/audit defect, not a deployed-service remediation claim; operational rollout remains separately authorized.