Upgate zod package

[dominykas]

Is your feature request related to a problem? Please describe.

The zod version (1.11.17) used across the project has a security vulnerability, which gets picked up by various scanners, e.g. https://security.snyk.io/vuln/SNYK-JS-ZOD-5925617 and it is also over two years old.

Describe the solution you'd like

Please upgrade to v3.x release line (first released some 2+ years ago).

Describe alternatives you've considered

n/a

Additional context

Would it make sense to turn on Renovate (or change Dependabot config) for this project? There does not seem be a clearly visible dependency upgrade strategy in place.

[arthurfeduniv]

+1

[Arthur264]

+1

[Ermak-13]

🔐

[alyaptsev]

➕

[jineshjin]

+1

[Joao-pina-fernandes]

👍

[Harvey1976]

+1 we are use the botkit to generate our application ,in recently trivy scan , we found the issue of Zod.

actually zod already fix this, but bot builder did not fix this. please upgrade of Zod to 3.xx

[seanhsmith]

+1

[cdeliens]

+1

[hieumoscow]

Hi @sw-joelmut, have you started a branch to upgrade Zod to 3.22.4? I have a project that is blocked, due to this CVE, from going to production this week.

Can you help me to look into this issue please, thank you.

[sw-joelmut]

Hi @sw-joelmut, have you started a branch to upgrade Zod to 3.22.4? I have a project that is blocked, due to this CVE, from going to production this week.

Can you help me to look into this issue please, thank you.

Hi @hieumoscow,

We are working on this, we'll have news soon.

[hieumoscow]

Hi @sw-joelmut, took me a bit of time to upgrade and test locally, it seems to run fine and parses the test.

However there is 1 test at the CloudAdapter Test that the stub seems unable to get the desired expired error message.

botbuilder-js/libraries/botbuilder/tests/cloudAdapter.test.js

Line 181 in 842baf3

expect(consoleStub.calledWithMatch({ message: 'The token has expired' })).to.be.true;

Could you please help me review. Pardon me for anythings that I might have missed out as it is my first time contributing to this repo.

[Harvey1976]

hi I check the Pull request proposed by @hieumoscow , it seems this PR is try to merge code to 4.21.release of bot kit.
as a user of botkit, current the zod CVE is blocked our project to release actually.
then , may I know the possbile release date of 4.21？ thanks a lot

[shabbir-dhangot]

What is the release version and date for this change to be made available for consumption?