[juliusmarminge]

The review item is correct: @vercel/config@0.3.0 still resolved zod@3.25.76 (high advisory GHSA-mrhx-c7xc-m3w5, fixed only in 4.6.6). No parent upgrade fixes it, because every @vercel/config release up to 0.14.1 still depends on zod ^3.22.0. I checked compatibility in the installed package: zod is used only in dist/utils/validation.js, a cron-expression schema built with z.object of z.string().regex() and called with .parse(). zod 4 keeps that API unchanged, and the package's .d.ts files reference no zod types. This commit adds the scoped override "@vercel/config>zod": 4.6.7 to pnpm-workspace.yaml, with a short comment. 4.6.7 is already in the lockfile, so nothing new is downloaded, and zod 3.25.76 disappears from the lockfile entirely. The earlier path-to-regexp 6.3.0 override from the first pass is unchanged. No new regex or parser was added.

Fixes #23907

Reproduction on main

On origin/main 3c68642 I parsed every package@version from all packages: sections of pnpm-lock.yaml (2,199 entries) and checked them against the OSV batch API (api.osv.dev/v1/querybatch), keeping advisories with HIGH or CRITICAL severity. I used the API because osv-scanner is not installed on the VM. Result: only path-to-regexp@6.1.0 (GHSA-9wv6-86v2-598j) from the reporter's list is still flagged, plus zod@3.25.76 (GHSA-mrhx-c7xc-m3w5, fixed only in 4.6.6), which the report does not list. Both come from @vercel/config@^0.3.0 in apps/web and apps/marketing: @vercel/routing-utils@6.2.0 pins path-to-regexp to exactly 6.1.0. The other reported packages are fixed on main by later bumps (@modelcontextprotocol/sdk 1.32.2, dompurify 3.4.17, seroval 1.7.10, shell-quote 1.12.0, proxy-addr 2.0.8, sharp 0.35.5, source-map-js 1.2.2, node-forge 1.4.3; uuid 7.0.3 is gone). braces 3.0.3 and http-cache-semantics 4.2.0 are still locked but OSV no longer rates them high. From the comment: stream-json 3.7.0, js-yaml 4.3.2 and fast-uri 3.1.9 are fixed; xml2js 0.4.23 via dbus-next is still locked but its advisory is only moderate. I did not inspect the copies bundled inside @cursor/sdk. PR #23906 was closed unmerged under the one-problem-per-PR rule.

Evidence

Ran the same live OSV scan against every resolved npm package version in both lockfiles on 2026-11-12. Base reproduced both HIGH advisories; head returned none. Images render the captured CLI output.

Before	After
bfec2754b8 — 2,199 versions, two HIGH findings	032328152c — 2,197 versions, zero HIGH/CRITICAL findings

Reproduction script · Raw OSV responses, reports, and transcripts

AI-assisted; verified with the tests and tools listed above.

Not shown:

• Copies bundled inside @cursor/sdk were not inspected; the reproduction scans package entries declared in pnpm-lock.yaml.
• Deployment-config runtime compatibility after the zod major override was not exercised; this proof verifies the reported lockfile advisory condition.

Tests

vp i (lockfile diff: the override line, @vercel/config's snapshot now points at zod 4.6.7, and zod@3.25.76 is removed). For both apps/web and apps/marketing, a scratch script ran @vercel/config's own code on zod 4.6.7: parseCronExpression and createCronExpression return the expected values, an invalid cron expression throws ZodError, validateStaticFields passes on vercel.ts, and getTransformedRoutes returns 7 routes with no error. npm advisory bulk endpoint (registry.npmjs.org/-/npm/v1/security/advisories/bulk) on every locked zod (4.6.7) and path-to-regexp (6.3.0, 8.4.2) version: no advisories. vp run check:changed: pass (unused patches, format, typecheck of 41 packages, 1 test file). Lint and format passed in the commit hook.

Not in this change

• zod@3.25.76 via @vercel/config (GHSA-mrhx-c7xc-m3w5): the only fixed release is zod 4.6.6, and every @vercel/config up to 0.14.1 still depends on zod ^3.22.0, so forcing zod 4 would break the config code. This needs an upstream @vercel/config release.
• Upgrading @vercel/config from ^0.3.0 to 0.14.x: it fixes neither advisory and would be a separate dependency bump.
• braces 3.0.3, http-cache-semantics 4.2.0 and xml2js 0.4.23 (via dbus-next) are still locked; the report says OSV no longer rates them high or critical.
• Upgrading @vercel/config from ^0.3.0 to 0.14.x: no release drops zod 3, so it would not fix this advisory and would be a separate dependency bump.

AI-assisted; verified with the tests and tools listed above.

[macroscopeapp]

Approvability

Verdict: Approved at 0323281

Macroscope's review found this PR approvable — Scopes advisory-fixing dependency overrides to Vercel configuration tooling without changing product defaults or routing policy. Reported validation and route-transformation exercises cover both affected apps, keeping the remaining risk limited.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.5 KiB	21.5 KiB	0 B (0.0%)	24.4 KiB	✅
Codex	Live turn messages	1	1	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	0 B (0.0%)	24.4 KiB	✅
Claude	Live turn messages	1	1	0 (0.0%)	8	✅

Baseline: 0ac41ee · PR result: 0323281 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The workspace configuration adds overrides that pin @vercel/routing-utils’s path-to-regexp to 6.3.0 and @vercel/config’s zod to 4.6.7.

Changes: Dependency overrides

Layer / File(s)	Summary
Pin transitive dependencies pnpm-workspace.yaml	Adds overrides for path-to-regexp and zod. Comments cite advisories and the stated compatibility basis for the Zod override.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Possibly related PRs

• pingdotgg/t3code#23906: Adds the same path-to-regexp override and cites the same advisory.

Suggested reviewers: t3dotgg, macroscopeapp, yash-singh1

Merge Risk: Minimal · up to 03232

This dependency override change adds security-motivated pins for two transitive packages. No concrete merge-blocking issue was found, so it is ready to merge after the usual checks.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title names the main change: a dependency fix that resolves path-to-regexp 6.3.0 under @vercel/routing-utils. The changeset adds pnpm overrides for path-to-regexp and a zod override for @vercel/co…
Linked Issues check		[#23907] The issue requires the lockfile to resolve no package with a published high or critical advisory where a fixed release exists. The row for path-to-regexp requires moving 6.1.0 to 6.3.0 throug…
Out of Scope Changes check		The PR adds the override "@vercel/config>zod": 4.6.7 to pnpm-workspace.yaml. This is not a path-to-regexp change listed in #23907. It still fits the issue's expected behavior, which states the lockfil…
Description check		The description follows the repository template in substance. It has a Problem section that explains the zod 3.25.76 advisory (GHSA-mrhx-c7xc-m3w5) and the path-to-regexp advisory. It has a Change sec…

Full details: Title check

Explanation

The title names the main change: a dependency fix that resolves path-to-regexp 6.3.0 under @vercel/routing-utils. The changeset adds pnpm overrides for path-to-regexp and a zod override for @vercel/config. The title omits the zod override, but it still matches the primary intent and the linked issue. It follows the conventional commit format.

Full details: Linked Issues check

Explanation

[#23907] The issue requires the lockfile to resolve no package with a published high or critical advisory where a fixed release exists. The row for path-to-regexp requires moving 6.1.0 to 6.3.0 through an override, because @vercel/routing-utils pins 6.1.0. The PR adds the override "@vercel/routing-utils>path-to-regexp": 6.3.0 in pnpm-workspace.yaml (reviewable change in the raw summary). The PR states that 6.3.0 is already in the lockfile and that the npm advisory bulk check reports no advisory for 6.3.0. The lockfile itself is excluded from review (pnpm-lock.yaml, excluded by !**/pnpm-lock.yaml), so the resolved lockfile entries were not inspected directly. The override is the coding requirement the issue specifies, and it is present in reviewable code. The other eight packages listed as fixed in #23906 are stated to be on main already, and the four still-open packages are outside this PR's requirements. The PR does not implement the zod advisory row, which the issue does not list; that is covered under the out-of-scope assessment.

Full details: Out of Scope Changes check

Explanation

The PR adds the override "@vercel/config>zod": 4.6.7 to pnpm-workspace.yaml. This is not a path-to-regexp change listed in #23907. It still fits the issue's expected behavior, which states the lockfile must resolve no package version with a published high or critical advisory where a fixed release exists. The PR reports zod 3.25.76 as flagged (GHSA-mrhx-c7xc-m3w5, fixed in 4.6.6) through the same scan method the issue describes. It also states that 4.6.7 is already in the lockfile, so the change removes the flagged version without adding a new package. The change is a major-version override, so the PR's scratch-script checks for @vercel/config behavior are relevant evidence. The PR does not upgrade @vercel/config, and it does not change the other listed packages. No unrelated change is demonstrated in the reviewed summary.

Full details: Description check

Explanation

The description follows the repository template in substance. It has a Problem section that explains the zod 3.25.76 advisory (GHSA-mrhx-c7xc-m3w5) and the path-to-regexp advisory. It has a Change section that describes the scoped zod 4.6.7 override and the earlier path-to-regexp override. It has a Scope section that links the issue (#23907) and explains the one-problem-per-PR decision. It has a Verification section with lockfile checks, scratch runtime checks, npm advisory checks, check:changed, and an OSV before/after scan with evidence. It also states what was not checked, and it ends with the AI-assistance attribution the template asks for. Minor gaps: the Problem section does not state expected behavior in plain terms, the Scope section does not say why this is a bug fix rather than a feature, and the Verification section describes the evidence and the 'Before/After' screenshots only through external links. The description also repeats the @vercel/config 0.14.x point in two places. The author also says evidence for the real app is still being captured, which conflicts with the 'Evidence' section that reports completed captures. Overall the description is mostly complete.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: factory/issue-23907
• File: .coderabbit.config.ts
• Commit: 0323281
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Team
• Run ID: 292f815e-09eb-4db0-a01a-93756b14a294

Commits

Reviewing files that changed from the base of the PR and between 0ac41ee and 0323281.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 1

• pnpm-workspace.yaml

Limit details: You’ve used all 10 included reviews currently available.