Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: [#4545] Zod package - botbuilder-core #4562

Merged
merged 6 commits into from
Nov 9, 2023

Conversation

sw-joelmut
Copy link
Collaborator

@sw-joelmut sw-joelmut commented Nov 8, 2023

Addresses #4545
#minor

Description

This PR migrates the use of zod 1.11.17 to ^3.22.4 to avoid ReDoS vulnerability.

Specific Changes

  • Updated zod version to ^3.22.4 in
    • botbuilder
    • botframework-schema
    • botframework-connector
    • botbuilder-tests-utils
  • Replaced use of check method with safeParse.

Testing

The following image shows some bot samples working after the update.
image
image

@sw-joelmut sw-joelmut requested a review from a team as a code owner November 8, 2023 14:32
@tracyboehrer tracyboehrer merged commit 45d7dda into main Nov 9, 2023
13 of 17 checks passed
@tracyboehrer tracyboehrer deleted the southworks/update/zod-botbuilder-core branch November 9, 2023 12:28
@tracyboehrer tracyboehrer changed the title fix: [#4545] Please upgrade zod package - botbuilder-core fix: [#4545] Zod package - botbuilder-core Nov 9, 2023
tracyboehrer pushed a commit that referenced this pull request Nov 13, 2023
* updates zod version in botbuilder-core

* update support of compat tests

* update botbuilder-core api signature

* update bf-schema api signature

---------

Co-authored-by: JhontSouth <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants