Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: [#4545] Zod package - botbuilder-core #4562

Merged
merged 6 commits into from
Nov 9, 2023
Merged

fix: [#4545] Zod package - botbuilder-core #4562

merged 6 commits into from
Nov 9, 2023

Conversation

sw-joelmut
Copy link
Collaborator

@sw-joelmut sw-joelmut commented Nov 8, 2023 •
edited
Loading

Addresses #4545
#minor

Description

This PR migrates the use of zod 1.11.17 to ^3.22.4 to avoid ReDoS vulnerability.

Specific Changes

  • Updated zod version to ^3.22.4 in
    • botbuilder
    • botframework-schema
    • botframework-connector
    • botbuilder-tests-utils
  • Replaced use of check method with safeParse.

Testing

The following image shows some bot samples working after the update.
image
image

@sw-joelmut sw-joelmut requested a review from a team as a code owner November 8, 2023 14:32
@tracyboehrer tracyboehrer merged commit 45d7dda into main Nov 9, 2023
13 of 17 checks passed
@tracyboehrer tracyboehrer deleted the southworks/update/zod-botbuilder-core branch November 9, 2023 12:28
@tracyboehrer tracyboehrer changed the title fix: [#4545] Please upgrade zod package - botbuilder-core fix: [#4545] Zod package - botbuilder-core Nov 9, 2023
tracyboehrer pushed a commit that referenced this pull request Nov 13, 2023
@sw-joelmut @JhontSouth
fix: [#4545] Please upgrade zod package - botbuilder-core (#4562)
958fb9b 
* updates zod version in botbuilder-core

* update support of compat tests

* update botbuilder-core api signature

* update bf-schema api signature

---------

Co-authored-by: JhontSouth <jhonatan.sandoval@southworks.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@sw-joelmut @tracyboehrer @JhontSouth