Repository navigation
Automation plugins: patch undici and the bundled zod; reviewed audit exception for n8n's zod 3 - #89
Merged
Merged
Conversation
…exception for n8n's zod 3 - undici 6.29.1 (GHSA-4qv8-2p9j-2685, GHSA-xjj6-f33q-929c). - zod 4.6.7 for @activepieces/pieces-framework and @activepieces/shared; this is the zod the Activepieces piece bundles (GHSA-mrhx-c7xc-m3w5). - zod 3.25.76 under n8n-workflow / @n8n/expression-runtime has no patched 3.x and ships the affected zod 4 core under zod/v4. It is dev-only here (n8n-workflow is a peer the n8n host provides; no shipped bundle contains it), so scripts/audit.mjs excepts exactly that advisory at that path and version. Everything else still fails the audit. Fixes #84. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 59dbfff87f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
An unreachable or failing audit endpoint returned error-only JSON, which the wrapper read as a clean audit. It now exits 1 unless npm returns a vulnerability report. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #84.
Changes (
plugins/automations)@ai-sdk/provider-utilsasks for^6.28.0.@activepieces/pieces-frameworkand@activepieces/shared(scoped overrides, same major): GHSA-mrhx-c7xc-m3w5. This is the zod the Activepieces piece bundles;activepieces/dist/dependencies.jsonnow lists onlyzod@4.6.7.npm run audit→scripts/audit.mjs: runsnpm audit --audit-level=lowas before, with one reviewed exception (below). The exception matches advisory + install path + exact version, so any other finding, or a different zod version at that path, still fails.n8n's zod 3 path: is it affected?
Yes, on paper: the advisory range is
zod < 4.6.6. zod 3.25.76 ships the zod 4 core underzod/v4, and that core contains the vulnerablehandleArrayResult(zod/v4/core/schemas.js).n8n-workflowimportszod/v4.But no fix is available: there is no patched 3.x (3.25.76 is the last one). The current
@n8n/expression-runtime(0.35.0) still pinszod 3.25.76. Forcing zod 4 onto it would be a breaking change for n8n-workflow, andnpm audit fix --forceonly suggests a downgrade to n8n-workflow 1.75.1.And it is dev-only in this repo:
n8n-workflowis a peer dependency ofn8n-nodes-patronusthat the n8n host provides at runtime.n8n/distcontains no zod, and no shipped bundle contains this copy. That is why it is a documented exception, to be removed once n8n moves to zod ≥ 4.6.6.Test
npm test(build + typecheck + 55 tests): passed.n8nlint: ok.npm run audit: passes; it lists 3 entries, all from the one excepted advisory.npm ciinn8n/fails because that npm reads the lockfile differently.🤖 Generated with Claude Code