Repository navigation
chore(deps): patch zod, Sentry, DOMPurify and toml advisories - #6430
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
GitHub Actions
Inactive
OpenWork evidence
Run details · Open the preview to inspect evidence and sandbox options. |
![diff-warden[bot]](https://avatars.githubusercontent.com/u/118544361?s=60&v=4){kind=small}
There was a problem hiding this comment.
Warden clearance. Complete security and confidentiality review of 72de9d60e090161ead86f6ef002e54b600139a5e found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run
Warden: approvedNo high or medium security findings and no confidentiality findings. Reviewed |
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
GitHub Actions
Error
There was a problem hiding this comment.
Warden clearance. Complete security and confidentiality review of baf02cf51b3b73df11d4cc81ec934063969343c1 found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run
baf02cf to
2b32e8f
Compare
GitHub Actions
Inactive
There was a problem hiding this comment.
Warden clearance. Complete security and confidentiality review of 2b32e8fd81ebc2613c382feab75a005abe4e13f0 found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run
…t advisories Bumps zod to 4.6.6 everywhere (including the two MCP servers still on zod 3), @sentry/nextjs to 10.75.2, dompurify to 3.4.17, and pins toml 5.0.1 and ip-address 10.7.4 through overrides. Evals move to vitest 4.1.12. The .opencode npm lockfile picks up the patched zod and toml. Next.js is handled separately in #6416.
zod 4.6 emits nullable unions as type arrays and requires seconds in ISO date-time patterns (RFC 3339).
2b32e8f to
f5e5682
Compare
GitHub Actions
Inactive
There was a problem hiding this comment.
Warden clearance. Complete security and confidentiality review of f5e5682eab4d3687c06adbbfe411f5472701f8e2 found no high or medium security findings and no confidentiality findings. Any new push dismisses this approval. Analysis run
…date (#6457) A dependency bump (#6430) changed a package the desktop guest bundles, so the runner deployed from that push expected a new desktop identity while CELLD_RUNNER_VARS still named the old snapshot. Every computer then reported out of date, and rebuilding one could not help: a rebuild starts again from that same snapshot. The deploy now compares the snapshot slug (named after the guest identity by snapshot:build:freestyle-desktop) with the identity it just built, and stops before the fleet changes when they differ. Signed-off-by: Jalil <reachjalil@gmail.com>
What is this about?
Patches the open Dependabot security alerts that #6416 (Next.js) does not cover: zod, @sentry/nextjs, DOMPurify, toml, ip-address and @vitest/mocker.
What problem does it solve?
Dependabot reports critical and high advisories for these packages (Sentry tunnel middleware bypass, DOMPurify sanitizer bypasses, zod/toml/ip-address denial of service, Vitest mock injection). Its own PRs (#6423, #6426) fail CI because their lockfiles break
minimumReleaseAge, and they also bump Next.js, which overlaps #6416.What was the situation before?
39 open Dependabot alerts. Both Dependabot PRs were red on install.
How is this implemented?
zodmoves to^4.6.6in every manifest, plus azod@<4.6.6override for transitive copies.den-admin-mcpandopenwork-ui-mcpmove from zod 3 to 4.z.record(value)becomesz.record(z.string(), value)so it works on zod 4.@sentry/nextjs10.64.0 → 10.75.2 in den-web.dompurifygoes to^3.4.17, with its override raised to match.toml@<5.0.1(pulled in byeffect) andip-address10.7.4.vitestand@vitest/coverage-v8move to 4.1.12, plus a zod override for Remotion's pinned 4.4.3..opencode/package-lock.json: zod 4.6.6, toml 5.0.1. The lockfile was regenerated with npm, using overrides only for that run.What else changed?
packages/docs/openapi.jsonfor zod 4.6: nullable unions are now written as type arrays, and date-time patterns require seconds (RFC 3339). Den API inputs like2026-09-03T17:00+02:00are now rejected;…T17:00:00+02:00still works.Release note
none
Evidence
No E2E; typecheck, unit tests and the existing core journeys only. I checked a zod-4 MCP tool schema with an in-memory MCP client.