fix: CVE Bump zod Peer Dependency to ^3.22.3 (#403)

michaelangeloio · web-flow · commit 10dff96d2f4d · 2023-10-04T10:00:38.000-04:00
* fix: CVE Bump Zod Peer Dependency to 3.22.3

* changeset

* Update warm-plants-approve.md

* Update warm-plants-approve.md
diff --git a/.changeset/warm-plants-approve.md b/.changeset/warm-plants-approve.md
@@ -0,0 +1,14 @@
+---
+'@ts-rest/core': patch
+'@ts-rest/express': patch
+'@ts-rest/fastify': patch
+'@ts-rest/nest': patch
+'@ts-rest/next': patch
+'@ts-rest/open-api': patch
+'@ts-rest/react-query': patch
+'@ts-rest/solid-query': patch
+'@ts-rest/vue-query': patch
+---
+
+ - fix: address `zod` [CVE](https://nvd.nist.gov/vuln/detail/CVE-2023-4316) with bump `@ts-rest` peer dependency `zod` to minimum `^3.22.3`
+   - ref PR: https://github.com/colinhacks/zod/pull/2824
diff --git a/libs/ts-rest/core/package.json b/libs/ts-rest/core/package.json
@@ -24,6 +24,6 @@
     }
   },
   "peerDependencies": {
-    "zod": "^3.21.0"
+    "zod": "^3.22.3"
   }
 }
diff --git a/libs/ts-rest/express/package.json b/libs/ts-rest/express/package.json
@@ -3,7 +3,7 @@
   "version": "3.30.3",
   "peerDependencies": {
     "express": "^4.0.0",
-    "zod": "^3.21.0"
+    "zod": "^3.22.3"
   },
   "peerDependenciesMeta": {
     "zod": {
diff --git a/libs/ts-rest/fastify/package.json b/libs/ts-rest/fastify/package.json
@@ -3,7 +3,7 @@
   "version": "3.30.3",
   "peerDependencies": {
     "fastify": "^4.0.0",
-    "zod": "^3.21.0"
+    "zod": "^3.22.3"
   },
   "peerDependenciesMeta": {
     "zod": {
diff --git a/libs/ts-rest/nest/package.json b/libs/ts-rest/nest/package.json
@@ -23,7 +23,7 @@
     "@nestjs/common": "^9.0.0 || ^10.0.0",
     "@nestjs/core": "^9.0.0 || ^10.0.0",
     "rxjs": "^7.1.0",
-    "zod": "^3.21.0"
+    "zod": "^3.22.3"
   },
   "peerDependenciesMeta": {
     "zod": {
diff --git a/libs/ts-rest/next/package.json b/libs/ts-rest/next/package.json
@@ -3,7 +3,7 @@
   "version": "3.30.3",
   "peerDependencies": {
     "next": "^12.0.0 || ^13.0.0",
-    "zod": "^3.21.0"
+    "zod": "^3.22.3"
   },
   "peerDependenciesMeta": {
     "zod": {
diff --git a/libs/ts-rest/open-api/package.json b/libs/ts-rest/open-api/package.json
@@ -6,6 +6,6 @@
     "openapi3-ts": "^2.0.2"
   },
   "peerDependencies": {
-    "zod": "^3.21.0"
+    "zod": "^3.22.3"
   }
 }
diff --git a/libs/ts-rest/react-query/package.json b/libs/ts-rest/react-query/package.json
@@ -23,7 +23,7 @@
   "peerDependencies": {
     "react": "^16.8.0 || ^17.0.0 || ^18.0.0",
     "@tanstack/react-query": "^4.0.0",
-    "zod": "^3.21.0"
+    "zod": "^3.22.3"
   },
   "peerDependenciesMeta": {
     "zod": {
diff --git a/libs/ts-rest/solid-query/package.json b/libs/ts-rest/solid-query/package.json
@@ -22,7 +22,7 @@
   },
   "peerDependencies": {
     "@tanstack/solid-query": "^4.0.0",
-    "zod": "^3.21.0"
+    "zod": "^3.22.3"
   },
   "peerDependenciesMeta": {
     "zod": {
diff --git a/libs/ts-rest/vue-query/package.json b/libs/ts-rest/vue-query/package.json
@@ -22,7 +22,7 @@
   },
   "peerDependencies": {
     "@tanstack/vue-query": "^4.0.0",
-    "zod": "^3.0.0"
+    "zod": "^3.22.3"
   },
   "peerDependenciesMeta": {
     "zod": {
diff --git a/package.json b/package.json
@@ -117,7 +117,7 @@
     "uuid": "^8.3.2",
     "vitest": "0.32.4",
     "vue": "^3.3.4",
-    "zod": "^3.21.4",
+    "zod": "^3.22.3",
     "zustand": "^4.1.1"
   },
   "devDependencies": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/test-projects/nest-10/pnpm-lock.yaml b/test-projects/nest-10/pnpm-lock.yaml
diff --git a/test-projects/nest-9/pnpm-lock.yaml b/test-projects/nest-9/pnpm-lock.yaml

Original file line number	Diff line number	Diff line change
`@@ -24,6 +24,6 @@`
`24`	`24`	`}`
`25`	`25`	`},`
`26`	`26`	`"peerDependencies": {`
`27`		`- "zod": "^3.21.0"`
	`27`	`+ "zod": "^3.22.3"`
`28`	`28`	`}`
`29`	`29`	`}`
Original file line number	Diff line number	Diff line change
`@@ -6,6 +6,6 @@`
`6`	`6`	`"openapi3-ts": "^2.0.2"`
`7`	`7`	`},`
`8`	`8`	`"peerDependencies": {`
`9`		`- "zod": "^3.21.0"`
	`9`	`+ "zod": "^3.22.3"`
`10`	`10`	`}`
`11`	`11`	`}`