Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: [#4545] Please upgrade zod package - botbuilder-core #384

Closed
wants to merge 6 commits into from

Conversation

JhontSouth
Copy link

@JhontSouth JhontSouth commented Nov 6, 2023

#minor

Description

This PR migrates the use of zod 1.11.17 to ^3.0.0 to avoid ReDoS vulnerability.

Specific Changes

  • Updated zod version to ^3.22.4 in
    • botbuilder
    • botframework-schema
    • botframework-connector
    • botbuilder-tests-utils
  • Replaced use of check method with safeParse.

Testing

The following image shows some bot samples working after the update.
image
image

@JhontSouth JhontSouth changed the title [#4545] Please upgrade zod package fix: [#4545] Please upgrade zod package Nov 6, 2023
@JhontSouth JhontSouth changed the title fix: [#4545] Please upgrade zod package fix: [#4545] Please upgrade zod package - botbuilder-core Nov 6, 2023
@coveralls
Copy link

Pull Request Test Coverage Report for Build 6799671639

  • 4 of 10 (40.0%) changed or added relevant lines in 4 files are covered.
  • 83 unchanged lines in 6 files lost coverage.
  • Overall coverage decreased (-0.4%) to 84.272%

Changes Missing Coverage Covered Lines Changed/Added Lines %
libraries/botbuilder-ai/src/luisRecognizer.ts 0 1 0.0%
libraries/botbuilder-core/src/configurationBotFrameworkAuthentication.ts 0 1 0.0%
libraries/botbuilder-ai/src/luisRecognizerOptionsV3.ts 0 4 0.0%
Files with Coverage Reduction New Missed Lines %
libraries/botbuilder-ai/src/luisRecognizerOptionsV3.ts 1 73.38%
libraries/botbuilder-lg/src/templateExtensions.ts 1 84.48%
libraries/botframework-streaming/src/utilities/createNodeServer.ts 1 78.57%
libraries/botframework-streaming/src/namedPipe/namedPipeServer.ts 12 50.68%
libraries/botframework-streaming/src/namedPipe/namedPipeClient.ts 17 34.09%
libraries/botframework-streaming/src/namedPipe/namedPipeTransport.ts 51 3.92%
Totals Coverage Status
Change from base Build 6799548110: -0.4%
Covered Lines: 20243
Relevant Lines: 22748

💛 - Coveralls

@sw-joelmut
Copy link

/promoted 4562

@sw-joelmut sw-joelmut closed this Nov 8, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants