Repository navigation
fix(deps): clear the CLI production audit with patched Zod - #91
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update Zod version range package.json |
The declared zod version changes from exact version 4.2.0 to compatible range ^4.6.6. |
Priority:
Estimated code review effort: 1 (Trivial) | ~3 minutes
Change: Bug fix
Possibly related PRs
- polymorfa/cli#90: Also updates the CLI root
zoddependency from4.2.0to a patched4.6.xversion.
Merge Risk: 
c0b5c
-
The dependency update is mergeable with no remaining review-blocking risk.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title "fix(deps): clear the CLI production audit with patched Zod" matches the main change. The PR raises the CLI's root Zod requirement from 4.2.0 to ^4.6.6 to clear a production audit advisory (… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Title check
-
Explanation
The title "fix(deps): clear the CLI production audit with patched Zod" matches the main change. The PR raises the CLI's root Zod requirement from 4.2.0 to ^4.6.6 to clear a production audit advisory (GHSA-mrhx-c7xc-m3w5). The title is specific, follows conventional commit style, and names the dependency and the reason for the change. It does not describe unrelated work.
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
Summary
npm run verifyfails its production audit because the CLI directly pins Zod 4.2.0. Raise the dependency to^4.6.6; the npm-generated lockfile resolves 4.6.7. This addresses GHSA-mrhx-c7xc-m3w5, whose patched floor is 4.6.6.The change is two files, +6/-5. Only the root Zod requirement and its lock node change; all 282 other package nodes and the SDK pin
0.1.0-dev.20261004024706remain unchanged. No audit suppression or application source changes.This is independent maintenance for CLI main. It fixes the dependency failure exposed by CLI #79; #79 itself remains at
06a29d8until this fix merges.Impact
Impact table
No impact table
Verification
Exact source
c0b5c9524d9da19f0106b81f845f7b5124f629a9, treecbacab918cfb63d3f96ea43dc3fad60603be82be, parent CLI main58e91a18d1a4afc108eb3119db0830340bb2a926.Installed Node24.15 and npm11.20, standard exclusive validation lease, private worktree/caches:
npm ci --ignore-scripts --no-audit --no-fund, followed by explicit build.The triggering Node22 job on #79 passed all 1,115 tests, formatting/lint/typecheck/build/pack, then failed only production audit. Hosted CI run 40292579866 passed on this exact commit, including the Node22 verification pipeline and release-evidence checks. Local checks used Node24. This is source/CI qualification, not registry, deployment or feature acceptance.
Session provenance and UI evidence
Sole ordinary Campaign owner thread
646a0c0a-e900-4d0f-9a25-0b8834d7d4e6, user-selected Codex gpt-6.1-sol/xhigh, no subagents or overlapping writer. Separate task worktree preserves #79 unchanged. Coordinator explicitly assigned this CLI fix separately from monorepo POL-34.Local evidence:
~/.polymorfa-agent-work/cli-zod-audit-20261026/; committed sanitized checkpoint publication remains coordinator-owned. No screenshots apply: no GUI changes. Tests use existing synthetic/local fixtures; no real credentials/provider acceptance.Rollout and rollback
A user or release owner must approve merging into CLI main; the coordinator's monorepo dev authority does not cover this merge. No main merge, registry publishing, tag or CI dispatch/rerun/cancel was performed. Existing nightly/stable acceptance and provenance requirements remain unchanged.
After this merges, normally merge CLI main into #79 without changing its SDK pin/filter gates; those wait for the accepted SDK350 package. If validation compatibility regresses, hold release and fix forward. Reverting to 4.2.0 would restore the known audit failure. No data migration or rollback is needed.
Final source-merge qualification — 28 October 2026
The current user directive authorizes Release to execute relevant source merges across the workstreams; package/registry and environment acceptance gates remain separate. Release independently verified the exact head, two-file patch, unchanged CLI main parent, successful hosted Node22 verification logs, and zero review threads/reviews.
The remaining
RELEASING.mdActionlint requirement passed in the existing Docs owner's serialized validation claim: installed actionlint v1.7.12 (go1.25.12 darwin/arm64), explicit lint of both complete workflow files, exit0 with empty output. Their Git blobs are byte-identical at CLI main and this head:ci-hosted.ymld640123636864bd5107b7ad7ff5fea586664ab43;publish-dev.yml993b2f319603b3ae3c2a1c74c10f83c18ce1df1e. Local execution is owner-reported; Release independently confirmed these source identities. Existing hosted production audit reports zero vulnerabilities; the dev-inclusive npm-ci advisory report is not represented as zero.A normal exact-head source merge changes no SDK pin, publication workflow, protected release acceptance, tag or deployed availability. No publication dispatch, automated review request or CI rerun was made.