@openclaw/slack 2026.10.10-beta.5 → 2026.11.5-beta.1

package/node_modules/undici/lib/web/websocket/receiver.js

@@ -16,6 +16,7 @@ const { failWebsocketConnection } = require('./connection')
 const { WebsocketFrameSend } = require('./frame')
 const { PerMessageDeflate } = require('./permessage-deflate')
 const { MessageSizeExceededError } = require('../../core/errors')
+const { defaultWebSocketMaxFragments, defaultWebSocketMaxPayloadSize } = require('../../core/constants')
 
 // This code was influenced by ws released under the MIT license.
 // Copyright (c) 2011 Einar Otto Stangvik <einaros@gmail.com>
@@ -48,18 +49,25 @@ class ByteParser extends Writable {
   /**
    * @param {import('./websocket').Handler} handler
    * @param {Map<string, string>|null} extensions
-   * @param {{ maxPayloadSize?: number }} [options]
+   * @param {{ maxFragments?: number, maxPayloadSize?: number }} [options]
+   *   A missing value uses the default limit; `0` disables the limit.
    */
   constructor (handler, extensions, options = {}) {
     super()
 
     this.#handler = handler
     this.#extensions = extensions == null ? new Map() : extensions
-    this.#maxFragments = options.maxFragments ?? 0
-    this.#maxPayloadSize = options.maxPayloadSize ?? 0
+    // Options come from the dispatcher's `webSocketOptions`, which only
+    // DispatcherBase provides. Fall back to the defaults rather than to no
+    // limit, so RetryAgent, MockAgent or a custom dispatcher can't turn off
+    // the payload and decompression limits by accident.
+    this.#maxFragments = options.maxFragments ?? defaultWebSocketMaxFragments
+    this.#maxPayloadSize = options.maxPayloadSize ?? defaultWebSocketMaxPayloadSize
 
     if (this.#extensions.has('permessage-deflate')) {
-      this.#extensions.set('permessage-deflate', new PerMessageDeflate(extensions, options))
+      this.#extensions.set('permessage-deflate', new PerMessageDeflate(extensions, {
+        maxPayloadSize: this.#maxPayloadSize
+      }))
     }
   }
 
@@ -244,6 +252,19 @@ class ByteParser extends Writable {
         if (isControlFrame(this.#info.opcode)) {
           this.#loop = this.parseControlFrame(body)
           this.#state = parserStates.INFO
+
+          // If the automatic PONG/CLOSE reply filled the socket's write buffer,
+          // stop parsing and resume on drain so a PING flood cannot grow the
+          // outbound queue without bound.
+          if (this.#loop && this.#handler.socket.writableNeedDrain) {
+            this.#loop = false
+            this.#handler.socket.once('drain', () => {
+              if (this.destroyed) return
+              this.#loop = true
+              this.run(callback)
+            })
+            return
+          }
         } else {
           if (!this.#info.compressed) {
             if (!this.writeFragments(body)) {

package/node_modules/undici/package.json

@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "8.11.2",
+  "version": "8.12.3",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {
@@ -63,13 +63,15 @@
   "types": "index.d.ts",
   "scripts": {
     "build:node": "esbuild index-fetch.js --bundle --platform=node --outfile=undici-fetch.js --define:esbuildDetection=1 --keep-names && node scripts/strip-comments.js",
-    "build:wasm": "node build/wasm.js --docker",
+    "build:milo": "node build/milo.js",
+    "build:llhttp": "node build/llhttp.js --docker",
+    "build:wasm": "node build/llhttp.js --docker",
     "generate-pem": "node scripts/generate-pem.js",
     "lint": "eslint --cache",
     "lint:fix": "eslint --fix --cache",
     "test": "npm run test:javascript && cross-env NODE_V8_COVERAGE= npm run test:typescript",
     "test:javascript": "npm run test:javascript:no-jest && npm run test:jest",
-    "test:javascript:no-jest": "npm run generate-pem && npm run test:unit && npm run test:fetch && npm run test:node-fetch && npm run test:infra && npm run test:cache && npm run test:cache-interceptor && npm run test:interceptors && npm run test:cookies && npm run test:eventsource && npm run test:subresource-integrity && npm run test:wpt && npm run test:websocket && npm run test:node-test && npm run test:cache-tests",
+    "test:javascript:no-jest": "npm run generate-pem && npm run test:unit && npm run test:fetch && npm run test:node-fetch && npm run test:infra && npm run test:cache && npm run test:cache-interceptor && npm run test:interceptors && npm run test:cookies && npm run test:eventsource && npm run test:subresource-integrity && npm run test:websocket && npm run test:node-test && npm run test:cache-tests",
     "test:javascript:without-intl": "npm run test:javascript:no-jest",
     "test:busboy": "borp --timeout 180000 -p \"test/busboy/*.js\"",
     "test:cache": "borp --timeout 180000 -p \"test/cache/*.js\"",
@@ -97,7 +99,7 @@
     "test:websocket:autobahn": "node test/autobahn/client.js",
     "test:websocket:autobahn:report": "node test/autobahn/report.js",
     "test:wpt:setup": "node test/web-platform-tests/wpt-runner.mjs setup",
-    "test:wpt": "npm run test:wpt:setup && node test/web-platform-tests/wpt-runner.mjs run /fetch /mimesniff /xhr /websockets /eventsource",
+    "test:wpt": "npm run test:wpt:setup && node test/web-platform-tests/wpt-runner.mjs run /fetch /mimesniff /xhr /websockets /eventsource /service-workers",
     "test:cache-tests": "node test/cache-interceptor/cache-tests.mjs --ci",
     "coverage": "npm run coverage:clean && cross-env NODE_V8_COVERAGE=./coverage/tmp npm run test:javascript && npm run coverage:report",
     "coverage:ci": "npm run coverage:clean && cross-env NODE_V8_COVERAGE=./coverage/tmp npm run test:javascript && npm run coverage:report:ci",
@@ -109,7 +111,7 @@
     "prepare": "husky && node ./scripts/platform-shell.js"
   },
   "devDependencies": {
-    "@fastify/busboy": "3.2.2",
+    "@fastify/busboy": "3.2.3",
     "@matteo.collina/tspl": "^0.2.0",
     "@metcoder95/https-pem": "^1.0.0",
     "@sinonjs/fake-timers": "^12.0.0",
@@ -120,12 +122,12 @@
     "cross-env": "^10.0.0",
     "dns-packet": "^5.4.0",
     "esbuild": "^0.28.0",
-    "eslint": "^9.9.0",
+    "eslint": "^10.12.0",
     "fast-check": "^4.1.1",
     "husky": "^9.0.7",
     "jest": "^30.0.5",
     "jsondiffpatch": "^0.7.3",
-    "neostandard": "^0.13.0",
+    "neostandard": "^0.14.0",
     "node-forge": "^1.3.1",
     "proxy": "^4.0.0",
     "tsd": "^0.33.0",

package/node_modules/undici/types/api.d.ts

@@ -5,7 +5,7 @@ import Dispatcher from './dispatcher'
 /** Performs an HTTP request. */
 declare function request<TOpaque = null> (
   url: string | URL | UrlObject,
-  options?: { dispatcher?: Dispatcher } & Omit<Dispatcher.RequestOptions<TOpaque>, 'origin' | 'path' | 'method'> & Partial<Pick<Dispatcher.RequestOptions, 'method'>>,
+  options?: { dispatcher?: Dispatcher } & Omit<Dispatcher.RequestOptions<TOpaque>, 'origin' | 'path' | 'method'> & Partial<Pick<Dispatcher.RequestOptions, 'method'>>
 ): Promise<Dispatcher.ResponseData<TOpaque>>
 
 /** A faster version of `request`. */

package/node_modules/undici/types/cache-interceptor.d.ts

@@ -160,6 +160,16 @@ declare namespace CacheHandler {
      * @default Infinity
      */
     maxEntrySize?: number
+
+    /**
+     * Responses whose body size, in bytes, is greater than this value are
+     * stored compressed with zstd. Responses with an easily compressible
+     * Content-Type (e.g. json, xml, plain text) are compressed regardless of
+     * size. Requires Node with zstd support
+     * (22.19+).
+     * @default 1048576 (1 MiB)
+     */
+    compressThreshold?: number
   }
 
   export class SqliteCacheStore implements CacheStore {

package/node_modules/undici/types/client.d.ts

@@ -92,7 +92,7 @@ export declare namespace Client {
      */
     allowH2?: boolean;
     /**
-     * @description Dictates the maximum number of concurrent streams for a single H2 session. It can be overridden by a SETTINGS remote frame.
+     * @description Dictates the maximum number of concurrent streams for a single H2 session. The server's SETTINGS_MAX_CONCURRENT_STREAMS can lower it, but not raise it.
      * @default 100
      * @deprecated Use h2Options.maxConcurrentStreams instead
      */
@@ -119,6 +119,8 @@ export declare namespace Client {
      * @description HTTP/2 configuration options
      */
     h2Options?: Client.H2Options;
+    /** @experimental Enables the experimental Milo HTTP/1 parser for this client. Defaults to the `UNDICI_USE_MILO` environment variable. */
+    useMilo?: boolean;
   }
   export interface SocketInfo {
     localAddress?: string
@@ -157,7 +159,7 @@ export declare namespace Client {
      */
     pingInterval?: number;
     /**
-     * @description Dictates the maximum number of concurrent streams for a single H2 session. It can be overridden by a SETTINGS remote frame.
+     * @description Dictates the maximum number of concurrent streams for a single H2 session. The server's SETTINGS_MAX_CONCURRENT_STREAMS can lower it, but not raise it.
      * @default 100
     */
     maxConcurrentStreams?: number;
@@ -173,8 +175,12 @@ export declare namespace Client {
   }
   export interface EventSourceOptions {
     /**
-     * Maximum allowed event size in bytes for EventSource messages.
-     * Set to 0 to disable the limit.
+     * Maximum total bytes of data and metadata field values retained for a
+     * pending EventSource event. Each unfinished line is separately bounded
+     * to this value plus seven syntax bytes. The number of data lines per
+     * event and buffered input chunks are each limited to
+     * min(131072, max(1024, floor(maxEventSize / 128))).
+     * Set to 0 to disable these limits.
      * @default buffer.kStringMaxLength
      */
     maxEventSize?: number;

package/node_modules/undici/types/errors.d.ts

@@ -39,13 +39,15 @@ declare namespace Errors {
       code: number,
       options: {
         headers?: IncomingHttpHeaders | string[] | null,
-        body?: null | Record<string, any> | string
+        body?: null | Record<string, any> | string,
+        bodyTruncated?: boolean
       }
     )
     name: 'ResponseError'
     code: 'UND_ERR_RESPONSE'
     statusCode: number
     body: null | Record<string, any> | string
+    bodyTruncated: boolean
     headers: IncomingHttpHeaders | string[] | null
   }
 
@@ -121,6 +123,13 @@ declare namespace Errors {
     code: string
   }
 
+  /** WebAssembly is unavailable when initializing the HTTP/1 parser. */
+  export class WebAssemblyNotSupportedError extends Error {
+    constructor (message?: string)
+    name: 'Error'
+    code: 'ERR_WEBASSEMBLY_NOT_SUPPORTED'
+  }
+
   /** The response exceed the length allowed. */
   export class ResponseExceededMaxSizeError extends UndiciError {
     name: 'ResponseExceededMaxSizeError'
@@ -169,6 +178,12 @@ declare namespace Errors {
     code: 'UND_ERR_MAX_ORIGINS_REACHED'
   }
 
+  /** The maximum number of redirects has been reached. */
+  export class MaxRedirectsError extends UndiciError {
+    name: 'MaxRedirectsError'
+    code: 'UND_ERR_REDIRECT_MAX'
+  }
+
   /** SOCKS5 proxy related error. */
   export class Socks5ProxyError extends UndiciError {
     constructor (

package/node_modules/undici/types/h2c-client.d.ts

@@ -63,7 +63,7 @@ export declare namespace H2CClient {
     /** The amount of time in milliseconds to wait for a connection attempt to finish before trying the next address when using the `autoSelectFamily` option. */
     autoSelectFamilyAttemptTimeout?: number;
     /**
-     * @description Dictates the maximum number of concurrent streams for a single H2 session. It can be overridden by a SETTINGS remote frame.
+     * @description Dictates the maximum number of concurrent streams for a single H2 session. The server's SETTINGS_MAX_CONCURRENT_STREAMS can lower it, but not raise it.
      * @default 100
     */
     maxConcurrentStreams?: number

package/node_modules/undici/types/interceptors.d.ts

@@ -16,7 +16,12 @@ declare namespace Interceptors {
     maxSize?: number
   }
 
-  export type ResponseErrorInterceptorOpts = { throwOnError: boolean }
+  export type ResponseErrorInterceptorOpts = {
+    /** @deprecated This option is ignored. The interceptor always throws on error responses. */
+    throwOnError?: boolean
+    /** Maximum number of response body bytes to include in the error. 0 disables the limit. @default 1048576 */
+    maxSize?: number
+  }
   export type CacheInterceptorOpts = CacheHandler.CacheOptions
 
   // DNS interceptor

package/node_modules/undici/types/utility.d.ts

@@ -1,7 +1,7 @@
 type AutocompletePrimitiveBaseType<T> =
-  T extends string ? string :
-    T extends number ? number :
-      T extends boolean ? boolean :
-        never
+  T extends string ? string
+    : T extends number ? number
+      : T extends boolean ? boolean
+        : never
 
 export type Autocomplete<T> = T | (AutocompletePrimitiveBaseType<T> & Record<never, never>)

package/node_modules/zod/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zod",
-  "version": "4.6.5",
+  "version": "4.6.7",
   "type": "module",
   "license": "MIT",
   "author": "Colin McDonnell <zod@colinhacks.com>",

package/node_modules/zod/src/v4/classic/tests/array.test.ts

@@ -140,6 +140,33 @@ test("continue parsing despite array size error", () => {
   `);
 });
 
+test("an upper size bound fails before any element is parsed", () => {
+  let parsed = 0;
+  const el = z.string().refine(() => ++parsed);
+  let refined = 0;
+  const schema = z
+    .array(el)
+    .max(2, "too many")
+    .refine(() => ++refined);
+  expect(schema.safeParse([1, 2, 3]).error!.issues).toMatchObject([{ code: "too_big", path: [], message: "too many" }]);
+  expect(z.array(el).length(2).safeParse(["a", "b", "c"]).error!.issues).toMatchObject([
+    { code: "too_big", exact: true },
+  ]);
+  expect(z.object({ a: z.array(el).max(1) }).safeParse({ a: [1, 2] }).error!.issues).toMatchObject([
+    { code: "too_big", path: ["a"] },
+  ]);
+  expect([parsed, refined]).toEqual([0, 0]);
+
+  // a check that may rewrite the value ends the gate
+  expect(
+    z
+      .array(z.number())
+      .overwrite((a) => a.slice(0, 2))
+      .max(2)
+      .parse([1, 2, 3])
+  ).toEqual([1, 2]);
+});
+
 test("parse should fail given sparse array", () => {
   const schema = z.array(z.string()).nonempty().min(1).max(3);
   const result = schema.safeParse(new Array(3));

package/node_modules/zod/src/v4/classic/tests/map.test.ts

@@ -97,6 +97,13 @@ test("failing when map is bigger than max() ", () => {
   expect(result.success).toEqual(false);
   expect(result.error!.issues.length).toEqual(1);
   expect(result.error!.issues[0].code).toEqual("too_big");
+  const bad = new Map([
+    [1, 1],
+    [2, 2],
+  ]);
+  const capped = z.map(z.string(), z.string()).max(1);
+  expect(capped.safeParse(bad).error!.issues).toMatchObject([{ code: "too_big" }]);
+  expect(capped.safeParse(new Set([1, 2])).error!.issues[0]).toMatchObject({ code: "invalid_type", expected: "map" });
 });
 
 test("failing when map does not match size() ", () => {

package/node_modules/zod/src/v4/classic/tests/set.test.ts

@@ -83,6 +83,12 @@ test("failing when set is bigger than max() ", () => {
   expect(result.success).toEqual(false);
   expect(result.error!.issues.length).toEqual(1);
   expect(result.error!.issues[0].code).toEqual("too_big");
+  expect(
+    z
+      .set(z.string())
+      .max(1)
+      .safeParse(new Set([1, 2])).error!.issues
+  ).toMatchObject([{ code: "too_big" }]);
 });
 
 test("failing when set does not match size() ", () => {

package/node_modules/zod/src/v4/core/compile.ts

@@ -1551,6 +1551,12 @@ function generateNullableCheck(
   return outputVar;
 }
 
+function generateSizeGate(doc: Doc, schema: SomeType, size: string): void {
+  for (const [max, check] of util.sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check._zod.def.check)}) return INVALID;`);
+  }
+}
+
 function generateArrayCheck(
   doc: Doc,
   ctx: CompileContext,
@@ -1560,6 +1566,7 @@ function generateArrayCheck(
 ): string | null {
   const def = schema._zod.def as unknown as { element: SomeType };
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
 
   // Build a new array with validated/transformed elements.
   const outputVar = buildsValue ? newVar(ctx) : null;
@@ -2094,6 +2101,7 @@ function generateMapCheck(doc: Doc, ctx: CompileContext, schema: SomeType, acces
   const def = schema._zod.def as unknown as { keyType: SomeType; valueType: SomeType };
 
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
 
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
@@ -2115,6 +2123,7 @@ function generateSetCheck(doc: Doc, ctx: CompileContext, schema: SomeType, acces
   const def = schema._zod.def as unknown as { valueType: SomeType };
 
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
 
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);

package/node_modules/zod/src/v4/core/schemas.ts

@@ -1844,6 +1844,34 @@ export interface $ZodArrayInternals<T extends SomeType = $ZodType> extends _$Zod
 
 export interface $ZodArray<T extends SomeType = $ZodType> extends $ZodType<any, any, $ZodArrayInternals<T>> {}
 
+// an oversized container fails its leading size checks before any element is parsed
+function capSize(inst: $ZodType, size: (input: any) => number): void {
+  const caps = util.sizeCaps(inst._zod.def.checks);
+  if (!caps.length) return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of util.sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when!(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload as ParsePayload<never>);
+          // the value is still the raw input, so no later check may read it
+          (payload.issues[start] as { continue?: boolean }).continue = false;
+          util.attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse(payload, ctx);
+  };
+}
+
+const arraySize = (input: unknown): number => (Array.isArray(input) ? input.length : -1);
+const mapSize = (input: unknown): number => (input instanceof Map ? input.size : -1);
+const setSize = (input: unknown): number => (input instanceof Set ? input.size : -1);
+
 function handleArrayResult(result: ParsePayload<any>, final: ParsePayload<any[]>, index: number) {
   if (result.issues.length) {
     final.issues.push(...util.prefixIssues(index, result.issues));
@@ -1899,6 +1927,7 @@ export const $ZodArray: core.$constructor<$ZodArray> = /*@__PURE__*/ core.$const
 
     return payload; //handleArrayResultsAsync(parseResults, final);
   };
+  capSize(inst, arraySize);
 });
 
 //////////////////////////////////////////
@@ -3218,8 +3247,11 @@ export type $InferZodRecordInput<
     : Record<core.input<Key> & PropertyKey, core.input<Value>>;
 
 export interface $ZodRecordInternals<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType>
-  extends $ZodTypeInternals<$InferZodRecordOutput<Key, Value>, $InferZodRecordInput<Key, Value>> {
+  extends $ZodTypeInternals {
   def: $ZodRecordDef<Key, Value>;
+  // members rather than base type arguments, which TypeScript 7.1 reports as circular for `z.json()`
+  output: $InferZodRecordOutput<Key, Value>;
+  input: $InferZodRecordInput<Key, Value>;
   isst: errors.$ZodIssueInvalidType | errors.$ZodIssueInvalidKey<Record<PropertyKey, unknown>>;
   optin?: "optional" | undefined;
   optout?: "optional" | undefined;
@@ -3480,6 +3512,7 @@ export const $ZodMap: core.$constructor<$ZodMap> = /*@__PURE__*/ core.$construct
     if (proms.length) return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 
 function handleMapResult(
@@ -3582,6 +3615,7 @@ export const $ZodSet: core.$constructor<$ZodSet> = /*@__PURE__*/ core.$construct
     if (proms.length) return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 
 function handleSetResult(result: ParsePayload, final: ParsePayload<Set<any>>) {

package/node_modules/zod/src/v4/core/util.ts

@@ -935,6 +935,19 @@ export function unwrapMessage(message: string | { message: string } | undefined
 }
 
 /* A check holds no link back to the schema it is attached to — the same check instance is shared by every clone of that schema — so the owner is stamped onto the issues a check just raised, at the only point where both are in scope. Runs on the failure path only; `start` is the issue count from before the check ran. */
+/** The leading size checks of `defChecks` that set an upper bound, each paired with it. */
+export function sizeCaps(defChecks: checks.$ZodCheck<never>[] | undefined): [number, checks.$ZodCheck<never>][] {
+  const caps: [number, checks.$ZodCheck<never>][] = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def as any;
+    // a later check may rewrite the value
+    if (!/_(length|size)$|_equals$/.test(d.check)) break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0) caps.push([max, ch]);
+  }
+  return caps;
+}
+
 export function attachSchema(issues: errors.$ZodRawIssue[], start: number, inst: schemas.$ZodType): void {
   for (let i = start; i < issues.length; i++) {
     (issues[i] as any).schema ??= inst;

package/node_modules/zod/src/v4/core/versions.ts

@@ -1,5 +1,5 @@
 export const version = {
   major: 4,
   minor: 6,
-  patch: 5 as number,
+  patch: 7 as number,
 } as const;

package/node_modules/zod/v4/core/compile.cjs

@@ -1241,9 +1241,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
     doc.write(`}`);
     return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+    for (const [max, check] of util.sizeCaps(schema._zod.def.checks)) {
+        doc.write(`if (${size} > ${numericOperand(max, check._zod.def.check)}) return INVALID;`);
+    }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
     const def = schema._zod.def;
     doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.length`);
     // Build a new array with validated/transformed elements.
     const outputVar = buildsValue ? newVar(ctx) : null;
     const iVar = newVar(ctx);
@@ -1707,6 +1713,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
     const def = schema._zod.def;
     doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.size`);
     const outputVar = newVar(ctx);
     const kVar = newVar(ctx);
     const valVar = newVar(ctx);
@@ -1723,6 +1730,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
     const def = schema._zod.def;
     doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.size`);
     const outputVar = newVar(ctx);
     const valVar = newVar(ctx);
     doc.write(`const ${outputVar} = new Set();`);

package/node_modules/zod/v4/core/compile.js

@@ -1210,9 +1210,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
     doc.write(`}`);
     return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+    for (const [max, check] of util.sizeCaps(schema._zod.def.checks)) {
+        doc.write(`if (${size} > ${numericOperand(max, check._zod.def.check)}) return INVALID;`);
+    }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
     const def = schema._zod.def;
     doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.length`);
     // Build a new array with validated/transformed elements.
     const outputVar = buildsValue ? newVar(ctx) : null;
     const iVar = newVar(ctx);
@@ -1676,6 +1682,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
     const def = schema._zod.def;
     doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.size`);
     const outputVar = newVar(ctx);
     const kVar = newVar(ctx);
     const valVar = newVar(ctx);
@@ -1692,6 +1699,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
     const def = schema._zod.def;
     doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.size`);
     const outputVar = newVar(ctx);
     const valVar = newVar(ctx);
     doc.write(`const ${outputVar} = new Set();`);

package/node_modules/zod/v4/core/schemas.cjs

@@ -860,6 +860,33 @@ exports.$ZodDate = core.$constructor("$ZodDate", (inst, def) => {
         return payload;
     };
 });
+// an oversized container fails its leading size checks before any element is parsed
+function capSize(inst, size) {
+    const caps = util.sizeCaps(inst._zod.def.checks);
+    if (!caps.length)
+        return;
+    const cap = Math.min(...caps.map((c) => c[0]));
+    const parse = inst._zod.parse;
+    inst._zod.parse = (payload, ctx) => {
+        const n = size(payload.value);
+        if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+            for (const [max, ch] of util.sizeCaps(inst._zod.def.checks)) {
+                if (n > max && ch._zod.def.when(payload)) {
+                    const start = payload.issues.length;
+                    ch._zod.check(payload);
+                    // the value is still the raw input, so no later check may read it
+                    payload.issues[start].continue = false;
+                    util.attachSchema(payload.issues, start, inst);
+                    return payload;
+                }
+            }
+        }
+        return parse(payload, ctx);
+    };
+}
+const arraySize = (input) => (Array.isArray(input) ? input.length : -1);
+const mapSize = (input) => (input instanceof Map ? input.size : -1);
+const setSize = (input) => (input instanceof Set ? input.size : -1);
 function handleArrayResult(result, final, index) {
     if (result.issues.length) {
         final.issues.push(...util.prefixIssues(index, result.issues));
@@ -905,6 +932,7 @@ exports.$ZodArray = core.$constructor("$ZodArray", (inst, def) => {
         }
         return payload; //handleArrayResultsAsync(parseResults, final);
     };
+    capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input, optin, optout) {
     const isPresent = key in input;
@@ -1942,6 +1970,7 @@ exports.$ZodMap = core.$constructor("$ZodMap", (inst, def) => {
             return Promise.all(proms).then(() => payload);
         return payload;
     };
+    capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input, inst, ctx) {
     if (keyResult.issues.length) {
@@ -2011,6 +2040,7 @@ exports.$ZodSet = core.$constructor("$ZodSet", (inst, def) => {
             return Promise.all(proms).then(() => payload);
         return payload;
     };
+    capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
     if (result.issues.length) {

package/node_modules/zod/v4/core/schemas.d.cts

@@ -834,8 +834,10 @@ export type $InferZodRecordOutput<Key extends $ZodRecordKey = $ZodRecordKey, Val
 export type $InferZodRecordInput<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType> = Key extends $partial ? Partial<Record<core.input<Key> & PropertyKey, core.input<Value>>> : [
     Value
 ] extends [OptionalInSchema] ? Partial<Record<core.input<Key> & PropertyKey, core.input<Value>>> : Record<core.input<Key> & PropertyKey, core.input<Value>>;
-export interface $ZodRecordInternals<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType> extends $ZodTypeInternals<$InferZodRecordOutput<Key, Value>, $InferZodRecordInput<Key, Value>> {
+export interface $ZodRecordInternals<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType> extends $ZodTypeInternals {
     def: $ZodRecordDef<Key, Value>;
+    output: $InferZodRecordOutput<Key, Value>;
+    input: $InferZodRecordInput<Key, Value>;
     isst: errors.$ZodIssueInvalidType | errors.$ZodIssueInvalidKey<Record<PropertyKey, unknown>>;
     optin?: "optional" | undefined;
     optout?: "optional" | undefined;

package/node_modules/zod/v4/core/schemas.d.ts

@@ -834,8 +834,10 @@ export type $InferZodRecordOutput<Key extends $ZodRecordKey = $ZodRecordKey, Val
 export type $InferZodRecordInput<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType> = Key extends $partial ? Partial<Record<core.input<Key> & PropertyKey, core.input<Value>>> : [
     Value
 ] extends [OptionalInSchema] ? Partial<Record<core.input<Key> & PropertyKey, core.input<Value>>> : Record<core.input<Key> & PropertyKey, core.input<Value>>;
-export interface $ZodRecordInternals<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType> extends $ZodTypeInternals<$InferZodRecordOutput<Key, Value>, $InferZodRecordInput<Key, Value>> {
+export interface $ZodRecordInternals<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType> extends $ZodTypeInternals {
     def: $ZodRecordDef<Key, Value>;
+    output: $InferZodRecordOutput<Key, Value>;
+    input: $InferZodRecordInput<Key, Value>;
     isst: errors.$ZodIssueInvalidType | errors.$ZodIssueInvalidKey<Record<PropertyKey, unknown>>;
     optin?: "optional" | undefined;
     optout?: "optional" | undefined;