Development toolchain includes an audited vulnerable Zod version
Maintainers usually reply within 2 days
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 70/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- javascript, node.js
Research direction
Start by locating the frontend toolchain's package manifest and lockfile, then check how Zod is resolved. Update the compatible dependency resolution to Zod 4.6.6 or newer and run lint and tests. Done means those checks pass and the lockfile resolves the patched version.
Written by the indexing model from the issue text.
Description
Is your feature request related to a problem? Please describe.
The frontend development toolchain resolves a Zod version below the audited patched version. The package is dev-only and absent from the production audit; no production exposure is claimed.
Describe the solution you'd like
Update the compatible toolchain/lockfile so Zod resolves to 4.6.6 or newer, then verify lint and tests.
Describe alternatives you've considered, if relevant.
If an immediate update is incompatible, document the blocker and track the update; do not describe the advisory as browser-app exploitation.
Additional context
Full npm audit identified high advisory GHSA-mrhx-c7xc-m3w5 (<4.6.6, oversized constrained collection validation memory exhaustion). Production-only audit did not include this Zod finding. Tested commit d3446e045960b5ebee4641aa70fdeb03af186587, PyRIT 1.2.0.dev0, offline dependency audit. Evidence: files/evidence/round4/npm-audit.json; local path is not an attachment.
- Dominant language
- Python
- Stars
- 4.7k
- Forks
- 1k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 439
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- No Dockerfile or Docker Compose file
- Has a pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/PyRIT
-
Description-only preset edits split comma-containing exact goals into separate goalsPossibly taken @MRX-72 claimed this 1 day ago. Openhelp wanted
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 2 days
-
GUI rejects valid empty-string SearchReplaceConverter settings, preventing deletion convertersPossibly taken @Darshika140 claimed this 1 day ago. Openhelp wanted
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
microsoft/PyRIT#3749 · 1 comment ·
Maintainers usually reply within 2 days
-
HTML scenario export replaces an intentionally empty converted message with the original textPossibly taken @VISHNU0906 claimed this 1 day ago. Openhelp wanted
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
microsoft/PyRIT#3741 · 1 comment · 1 assignee ·
Maintainers usually reply within 2 days
-
help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 2 days
-
TextTarget is described as using API-key authentication even though it needs no credentialsPossibly taken @pcbeingused333 claimed this 1 day ago. Openhelp wanted
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
Maintainers usually reply within 2 days
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
pytest-dev/pyfakefs#1367 · 1 comment ·
Maintainers usually reply within 2 days
-
IFEvalG exclude_word_harder misses the keyword next to punctuation, at the start or end of the text, and in other letter casePossibly taken @damienen claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
allenai/open-instruct#2151 ·
Maintainers usually reply within 1 day
-
feat(plan): support convertorLabels and convertorAffinity in Plan resourcePossibly taken @AmenB claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
RedHatQE/openshift-python-wrapper#2849 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 25 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
libnativeapi/nativeapi#21 ·