[vvillait88]

Summary

Relocks the zod copy under mppx from 4.6.5 to 4.6.7 and releases 3.1.5.

mppx 0.15.0 depends on zod ^4.6.5, and the lock resolved that to 4.6.5. GHSA-mrhx-c7xc-m3w5 covers every zod below 4.6.6: memory grows when an array schema with no length limit rejects a very large array. The build inlines mppx and its zod into dist/index.mjs and dist/stripe-multichain/index.mjs. Consumers therefore ship the vulnerable copy with no package.json that osv-scanner or an image scanner could find, and bumping zod in a consumer's own lock does not reach it. Inside the bundle, this zod parses the MPP credential from the Authorization: Payment header.

bun update zod moved the two nested zod 4 entries in bun.lock (mppx/zod and the dev-only knip/zod) to 4.6.7.

The required Dependency Scan also fails on advisories that main carries since they landed this week. None of them is in the published bundle, but they are cleared here so the gate passes:

• bun update body-parser fast-uri: body-parser 2.3.0 to 2.4.0 (GHSA-27r3-jxmh-p828, which also pulls qs 6.16.1 under it), fast-uri 3.1.8 to 3.1.9, and fast-uri 4.2.1 to 4.2.3 under @fastify/ajv-compiler and fast-json-stringify (four advisories each).
• The root zod 3.25.76 has no fixed 3.x release. It is required at ^3 by the x402 and cdp-sdk dev dependencies, whose latest releases still require zod ^3. osv-scanner.toml gets a [[PackageOverrides]] entry scoped to 3.25.76 (effective until 2027-01-24). The dist source maps list mppx/node_modules/zod as the only bundled zod, so this copy never ships, and a zod 4 regression still fails the scan.

The version moves to 3.1.5.

Worked with: Varun, who asked for the open Oneleet and Inspector findings to be fixed.

Not done here: tagging v3.1.5 (which publishes) and bumping the hosted stores to 3.1.5, which both follow this merge. The build's existing rollup-plugin-dts warning that RateLimitCoreOptions has no public re-export is also left alone: it is on main already, and a consumer declaration-emit probe (TypeScript 6.0.3, declaration: true, skipLibCheck: false) compiles clean, so it is cosmetic. Adding a public type export does not belong in a security patch release.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None.

Test plan

• osv-scanner scan source --lockfile=bun.lock reports no issues locally.
• bun install --frozen-lockfile, typecheck, lint, knip, build and test all exit 0 locally (109 test files passed and 1 skipped; 1637 tests passed and 4 skipped).
• The bundle carries the fix: the zod version constant inlined in dist/index.mjs and dist/stripe-multichain/index.mjs reads major: 4, minor: 6, patch: 7 on this branch. As a control, a build of main reads patch: 5.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
  (the public surface did not change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review (head 4b69dcc)

Verdict: one blocker, and it is not the change itself. The zod relock is correct and the bundle really moves. The required Dependency Scan check is red on advisories already present on main, so the PR cannot merge as it stands.

Blocking

1. Required check Dependency Scan fails (run 40142138733). Main's ruleset requires ci and Dependency Scan. osv-scanner reports 10 advisories across 4 packages:

   package	locked	fixed	advisories
   body-parser	2.3.0	2.4.0	GHSA-27r3-jxmh-p828 (7.5)
   fast-uri	3.1.8	3.1.9	GHSA-333x-w4r6-6crp, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h
   fast-uri (nested under @fastify/ajv-compiler and fast-json-stringify)	4.2.1	4.2.3	the same four
   zod (root, required at ^3 by the x402 and cdp packages)	3.25.76	4.6.6	GHSA-mrhx-c7xc-m3w5

   None of these come from this PR. The lock diff touches only knip/zod and mppx/zod, and main's last green Security run was 2026-10-22, before the fast-uri advisories (2026-10-23) and the zod review date (2026-10-23).

   None of them ship to consumers. The only third-party code inlined into dist is mppx (including its zod), ox, viem, @noble/hashes, eventemitter3, @scure/bip39 and @adraffy/ens-normalize, read from the // node_modules/... region markers in dist/index.mjs. No fast-uri, body-parser, ajv or root zod is bundled. express and fastify are peer and dev dependencies.

   Suggested fix, in this PR. It is a release, and 3.1.3 already relocked dev dependencies past their advisories.

   • bun update fast-uri body-parser takes all nine fixable findings.
   • Add the same version-scoped [[PackageOverrides]] for zod 3.25.76 that the hosted stores use, with its reason and lift condition, and update the "Empty on purpose" header.
   • Update the body's "moved only the two nested zod 4 entries" line to match.

Verified, no issue

• Bundle moves. I built main and this head from clean git archive trees (bun install --frozen-lockfile, then bun run build, both exit 0).
  • The inlined node_modules/mppx/node_modules/zod/v4/core/versions.js reads minor: 6, patch: 5 on main and minor: 6, patch: 7 here.
  • This holds in all four bundles that carry it: dist/index.mjs, dist/index.js, dist/stripe-multichain/index.mjs and dist/stripe-multichain/index.js.
  • Installed node_modules/mppx/node_modules/zod is 4.6.5 on main and 4.6.7 here. Root zod stays 3.25.76.
• Nothing else moved. The diff is bun.lock +2/-2 (knip/zod, mppx/zod) and package.json version 3.1.4 to 3.1.5. Both trees report Checked 667 installs across 690 packages.
• Release convention matches.
  • Release 3.1.4 and 3.1.3 were also bun.lock + package.json squash merges.
  • v3.1.4 points at the 3.1.4 merge commit.
  • The publish workflow triggers on v* tags and sets the version from the tag.
  • So tagging v3.1.5 on the merge commit after merge is the established path, as the body says.
• The RateLimitCoreOptions dts warning is pre-existing and harmless in practice.
  • The identical eight warnings (express, fastify, hono, web, in .d.mts and .d.ts) print on the main build.
  • The type sits in the shared chunk _core-*.d.ts, exported only as R. Each middleware entry uses it only as the base of its own exported, named interface (RateLimitHonoOptions extends RateLimitCoreOptions, and so on), and the exported functions take those named interfaces.
  • I probed declaration emit in a consumer (TypeScript 6.0.3, declaration: true, skipLibCheck: false, package laid out as published). Exporting rateLimitHono(...), a value typed RateLimitHonoOptions, a factory over Parameters<typeof rateLimitHono>[0], and a rest-destructure of the options compiled clean. The emitted types named RateLimitHonoOptions or inlined the four primitive fields, and no TS2742 appeared.
  • The remaining gap is cosmetic: a consumer cannot import RateLimitCoreOptions by name. Re-exporting it from the middleware entries would silence the warning. It is not a reason to hold this release.

Not yet seen

• ci and node-compat (22/24/26) were still pending when I read the checks. CodeQL and Analyze pass.

[vvillait88]

Review answered in ac3627a:

• Dependency Scan: fixed as suggested. bun update body-parser fast-uri clears the nine fixable findings, and a [[PackageOverrides]] entry scoped to zod 3.25.76 replaces the empty header. osv-scanner reports no issues locally.
• Body line on what moved: corrected.
• RateLimitCoreOptions warning: left alone on purpose. It is on main already and your emit probe compiles clean, so it is cosmetic, and a new public type export does not belong in a security patch release. Recorded in the body.