astro@3.4.0 and @astrojs/sitemap@3.0.2 using vulnerable version of Zod

[josephshambrook]

Astro Info

Astro                    v3.4.0
Node                     v18.18.0
System                   Linux (x64)
Package Manager          npm
Output                   static
Adapter                  none
Integrations             @astrojs/mdx
                         @astrojs/sitemap

If this issue only occurs in one browser, which browser is a problem?

No response

Describe the Bug

Running npm audit on a new Astro project raises the following vulnerability with Zod v3.22.1, currently used by both astro@3.4.0 and @astrojs/sitemap@3.0.2.

The vulnerability in Zod is fixed after v3.22.3 (latest version is v3.22.4).

What's the expected result?

Running npm audit should not find any security vulnerabilities within Astro.

Link to Minimal Reproducible Example

https://stackblitz.com/edit/withastro-astro-jqpxng?file=package.json

Participation

• I am willing to submit a pull request for this issue.

[matthewp]

Hm, Astro is using Zod 3.21.1 not 3.22.1. Are you sure this affects us?

[jacobdalamb]

There's a PR already for this issue

[josephshambrook]

Hm, Astro is using Zod 3.21.1 not 3.22.1. Are you sure this affects us?

I believe so yes; the vulnerability report says it affects all versions under 3.22.1, so 3.21.1 is included.

[josephshambrook]

Relevant PR: #8762