Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency zod to v3.22.3 [security] #302

Merged
merged 1 commit into from
Jan 3, 2025
Merged

fix(deps): update dependency zod to v3.22.3 [security] #302

merged 1 commit into from
Jan 3, 2025

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Feb 25, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
zod (source) 3.20.2 -> 3.22.3 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-4316

Zod version 3.22.2 allows an attacker to perform a denial of service while validating emails.

Release Notes

colinhacks/zod (zod)

v3.22.3

Compare Source

Commits:

v3.22.2

Compare Source

Commits:

v3.22.1

Compare Source

Commits:

Fix handing of this in ZodFunction schemas. The parse logic for function schemas now requires the Reflect API.

const methodObject = z.object({
  property: z.number(),
  method: z.function().args(z.string()).returns(z.number()),
});
const methodInstance = {
  property: 3,
  method: function (s: string) {
    return s.length + this.property;
  },
};
const parsed = methodObject.parse(methodInstance);
parsed.method("length=8"); // => 11 (8 length + 3 property)

v3.22.0

Compare Source

ZodReadonly

This release introduces ZodReadonly and the .readonly() method on ZodType.

Calling .readonly() on any schema returns a ZodReadonly instance that wraps the original schema. The new schema parses all inputs using the original schema, then calls Object.freeze() on the result. The inferred type is also marked as readonly.

const schema = z.object({ name: string }).readonly();
type schema = z.infer<typeof schema>;
// Readonly<{name: string}>

const result = schema.parse({ name: "fido" });
result.name = "simba"; // error

The inferred type uses TypeScript's built-in readonly types when relevant.

z.array(z.string()).readonly();
// readonly string[]

z.tuple([z.string(), z.number()]).readonly();
// readonly [string, number]

z.map(z.string(), z.date()).readonly();
// ReadonlyMap<string, Date>

z.set(z.string()).readonly();
// ReadonlySet<Promise<string>>

Commits:

v3.21.4

Compare Source

Commits:

v3.21.3

Compare Source

Commits:

v3.21.2

Compare Source

Commits:

  • b276d71 Improve typings in generics
  • 4d016b7 Improve type inference in generics
  • f9895ab Improve types inside generic functions
  • ac0135e Pass input into catchValue

v3.21.1

Compare Source

Features

Support for ULID validation

z.string().ulid();

Commits:

v3.21.0

Compare Source

Features

z.string().emoji()

Thanks @​joseph-lozano for https://github.com/colinhacks/zod/pull/2045! To validate that all characters in a string are emoji:

z.string().emoji()

...if that's something you want to do for some reason.

z.string().cuid2()

Thanks @​joulev for https://github.com/colinhacks/zod/pull/1813! To validate CUIDv2:

z.string().cuid2()
z.string().ip()

Thanks @​fvckDesa for https://github.com/colinhacks/zod/pull/2066. To validate that a string is a valid IP address:

const v4IP = "122.122.122.122";
const v6IP = "6097:adfa:6f0b:220d:db08:5021:6191:7990";

// matches both IPv4 and IPv6 by default
const ipSchema = z.string().ip();
ipSchema.parse(v4IP) //  pass
ipSchema.parse(v6IP) //  pass

To specify a particular version:

const ipv4Schema = z.string().ip({ version: "v4" });
const ipv6Schema = z.string().ip({ version: "v6" });
z.bigint().{gt|gte|lt|lte}()

Thanks @​igalklebanov for #1711! ZodBigInt gets the same set of methods found on ZodNumber:

z.bigint().gt(BigInt(5));
z.bigint().gte(BigInt(5));
z.bigint().lt(BigInt(5));
z.bigint().lte(BigInt(5));
z.bigint().positive();
z.bigint().negative();
z.bigint().nonnegative();
z.bigint().nonpositive();
z.bigint().multipleOf(BigInt(5));
z.enum(...).extract() and z.enum(...).exclude()

Thanks @​santosmarco-caribou for https://github.com/colinhacks/zod/pull/1652! To add or remove elements from a ZodEnum:

const FoodEnum = z.enum(["Pasta", "Pizza", "Tacos", "Burgers", "Salad"]);
const ItalianEnum = FoodEnum.extract(["Pasta", "Pizza"]); // ZodEnum<["Pasta", "Pizza"]>
const UnhealthyEnum = FoodEnum.exclude(["Salad"]); // ZodEnum<["Pasta", "Pizza", "Tacos", "Burgers"]>

This API is inspired by the Exclude and Extract TypeScript built-ins.

Pass a function to .catch()

Thanks @​0xWryth for https://github.com/colinhacks/zod/pull/2087! The .catch() method now accepts a function that receives the caught error:

const numberWithErrorCatch = z.number().catch((ctx) => {
  ctx.error; // ZodError
  return 42;
});

Compiler performance

Zod 3.20.2 introduced an accidental type recursion that caused long compilation times for some users. These kinds of bugs are very hard to diagnose. Big shoutout to @​gydroperit for some heroic efforts here: https://github.com/colinhacks/zod/pull/2107 Zod 3.21 resolves these issues:

Commits:

v3.20.6

Compare Source

Commits:

v3.20.5

Compare Source

Commits:

  • e71c7be Fix extract/exclude type error

v3.20.4

Compare Source

Commits:

v3.20.3

Compare Source

Features

Fixes and documentation

New Contributors

Full Changelog: colinhacks/zod@v3.20.2...v3.20.3

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Feb 25, 2024
@changeset-bot changeset-bot
Copy link

changeset-bot bot commented Feb 25, 2024 •
edited
Loading

⚠️ No Changeset found

Latest commit: 6bce504

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@renovate renovate bot changed the title fix(deps): update dependency zod to v3.22.3 [security] fix(deps): update dependency zod to v3.22.3 [security] - autoclosed Mar 13, 2024
@renovate renovate bot closed this Mar 13, 2024
@renovate renovate bot deleted the renovate/npm-zod-vulnerability branch March 13, 2024 03:46
@renovate renovate bot changed the title fix(deps): update dependency zod to v3.22.3 [security] - autoclosed fix(deps): update dependency zod to v3.22.3 [security] Mar 13, 2024
@renovate renovate bot reopened this Mar 13, 2024
@renovate renovate bot restored the renovate/npm-zod-vulnerability branch March 13, 2024 08:06
@renovate renovate bot force-pushed the renovate/npm-zod-vulnerability branch from 78c70e8 to e265dc4 Compare March 13, 2024 08:06
@renovate renovate bot force-pushed the renovate/npm-zod-vulnerability branch from e265dc4 to 6bce504 Compare January 3, 2025 11:42
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jan 3, 2025 •
edited
Loading

🚀 Snapshot Release (alpha)

The latest changes of this PR are available as alpha on npm (based on the declared changesets):

Package Version Info
bob-the-bundler 7.0.2-alpha-20250103115043-6bce50441e8e1a1e5ffc66adeb951abfd3eb89be npm ↗︎ unpkg ↗︎

@renovate renovate bot changed the title fix(deps): update dependency zod to v3.22.3 [security] fix(deps): update dependency zod to v3.22.3 [security] - autoclosed Jan 3, 2025
@renovate renovate bot closed this Jan 3, 2025
@renovate renovate bot deleted the renovate/npm-zod-vulnerability branch January 3, 2025 11:46
@renovate renovate bot changed the title fix(deps): update dependency zod to v3.22.3 [security] - autoclosed fix(deps): update dependency zod to v3.22.3 [security] Jan 3, 2025
@renovate renovate bot reopened this Jan 3, 2025
@renovate renovate bot merged commit 33629c1 into master Jan 3, 2025
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants