@cdktf/cli-core: Zod denial of service vulnerability

[xiehan]

Expected Behavior

Installing CDKTF does not generate security alerts on my repository.

Actual Behavior

https://github.com/hashicorp/cdktf-aws-cdk/security/dependabot/86

Steps to Reproduce

1. Turn on Dependabot security alerts on your repository
2. Install cdktf-cli in your project and push
3. Watch the security alert get created

Versions

cdktf-cli: 0.19.0

Providers

No response

Gist

No response

Possible Solutions

Upgrade the dependency on zod in @cdktf/cli-core to version ^3.22.3.

Workarounds

No response

Anything Else?

This vulnerability is classified as Low severity, but we should still be good citizens and try to address this as part of our next patch release.

References

• GHSA-m95q-7qp3-xv42
• https://github.com/advisories/GHSA-m95q-7qp3-xv42/dependabot

Help Wanted

• I'm interested in contributing a fix myself

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[github-actions]

I'm going to lock this issue because it has been closed for 30 days. This helps our maintainers find and focus on the active issues. If you've found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.