@openclaw/slack 2026.9.9 → 2026.9.34

package/node_modules/@slack/bolt/node_modules/body-parser/README.md

@@ -37,6 +37,10 @@ This module provides the following parsers:
   * [Text body parser](#bodyparsertextoptions)
   * [URL-encoded form body parser](#bodyparserurlencodedoptions)
 
+All parsers support automatic inflation of `gzip`, `br` (brotli), `deflate`
+and `zstd` encodings. `zstd` is available in Node.js `^22.15.0` and
+`>=23.8.0`.
+
 Other body parsers you might be interested in:
 
 - [body](https://www.npmjs.com/package/body#readme)
@@ -65,6 +69,12 @@ The `bodyParser` object exposes various factories to create middlewares. All
 middlewares will populate the `req.body` property with the parsed body when
 the `Content-Type` request header matches the `type` option.
 
+**Note** As of v2, `req.body` is left `undefined` when no body is parsed (for
+example when the request has neither `Content-Length` nor `Transfer-Encoding`,
+or when `Content-Type` does not match). In v1, `req.body` was always initialized
+to `{}`. Code that assumes `req.body` is always an object should use optional
+chaining (for example `req.body?.username`) or set a default.
+
 The various errors returned by this module are described in the
 [errors section](#errors).
 
@@ -72,8 +82,7 @@ The various errors returned by this module are described in the
 
 Returns middleware that only parses `json` and only looks at requests where
 the `Content-Type` header matches the `type` option. This parser accepts any
-Unicode encoding of the body and supports automatic inflation of `gzip`,
-`br` (brotli) and `deflate` encodings.
+Unicode encoding of the body.
 
 A new `body` object containing the parsed data is populated on the `request`
 object after the middleware (i.e. `req.body`).
@@ -110,7 +119,7 @@ argument. You can find more information on this argument
 
 ##### strict
 
-When set to `true`, will only accept arrays and objects; when `false` will
+When set to `true`, it will only accept arrays and objects; when `false`, it will
 accept anything `JSON.parse` accepts. Defaults to `true`.
 
 ##### type
@@ -133,9 +142,7 @@ encoding of the request. The parsing can be aborted by throwing an error.
 ### bodyParser.raw([options])
 
 Returns middleware that parses all bodies as a `Buffer` and only looks at
-requests where the `Content-Type` header matches the `type` option. This
-parser supports automatic inflation of `gzip`, `br` (brotli) and `deflate`
-encodings.
+requests where the `Content-Type` header matches the `type` option.
 
 A new `body` object containing the parsed data is populated on the `request`
 object after the middleware (i.e. `req.body`). This will be a `Buffer` object
@@ -181,9 +188,7 @@ encoding of the request. The parsing can be aborted by throwing an error.
 ### bodyParser.text([options])
 
 Returns middleware that parses all bodies as a string and only looks at
-requests where the `Content-Type` header matches the `type` option. This
-parser supports automatic inflation of `gzip`, `br` (brotli) and `deflate`
-encodings.
+requests where the `Content-Type` header matches the `type` option.
 
 A new `body` string containing the parsed data is populated on the `request`
 object after the middleware (i.e. `req.body`). This will be a string of the
@@ -234,8 +239,7 @@ encoding of the request. The parsing can be aborted by throwing an error.
 
 Returns middleware that only parses `urlencoded` bodies and only looks at
 requests where the `Content-Type` header matches the `type` option. This
-parser accepts only UTF-8 and ISO-8859-1 encodings of the body and supports 
-automatic inflation of `gzip`, `br` (brotli) and `deflate` encodings.
+parser accepts only UTF-8 and ISO-8859-1 encodings of the body.
 
 A new `body` object containing the parsed data is populated on the `request`
 object after the middleware (i.e. `req.body`). This object will contain
@@ -346,7 +350,7 @@ the entity value that failed parsing.
 ### entity verify failed
 
 This error will occur when the request contained an entity that could not be
-failed verification by the defined `verify` option. The `status` property is
+verified by the defined `verify` option. The `status` property is
 set to `403`, the `type` property is set to `'entity.verify.failed'`, and the
 `body` property is set to the entity value that failed verification.
 
@@ -413,7 +417,7 @@ property is set to the encoding that is unsupported.
 
 ### The input exceeded the depth
 
-This error occurs when using `bodyParser.urlencoded` with the `extended` property set to `true` and the input exceeds the configured `depth` option. The `status` property is set to `400`. It is recommended to review the `depth` option and evaluate if it requires a higher value. When the `depth` option is set to `32` (default value), the error will not be thrown.
+This error occurs when using `bodyParser.urlencoded` with the `extended` property set to `true` and the input exceeds the configured `depth` option. The `status` property is set to `400`. It is recommended to review the `depth` option and evaluate if it requires a higher value. With the default `depth` of `32`, an input with 33 or more levels of nesting gets this error.
 
 ## Examples
 

package/node_modules/@slack/bolt/node_modules/body-parser/lib/read.js

@@ -17,7 +17,7 @@ const iconv = require('iconv-lite')
 const onFinished = require('on-finished')
 const zlib = require('node:zlib')
 const hasBody = require('type-is').hasBody
-const { getCharset } = require('./utils')
+const contentType = require('content-type')
 
 /**
  * Module exports.
@@ -25,6 +25,12 @@ const { getCharset } = require('./utils')
 
 module.exports = read
 
+/**
+ * @const
+ * whether current node version has zstandard support
+ */
+const hasZstandardSupport = 'createZstdDecompress' in zlib
+
 /**
  * Read a request into a buffer and parse.
  *
@@ -79,38 +85,53 @@ function read (req, res, next, parse, debug, options) {
   }
 
   let length
-  const opts = options
   let stream
 
-  // read options
-  const verify = opts.verify
+  const verify = options.verify
+
+  // assert charset is supported before creating the decompression stream, so an
+  // unsupported charset cannot leave a decoder piped with no error listener
+  if (verify && encoding !== null && !iconv.encodingExists(encoding)) {
+    return next(createError(415, 'unsupported charset "' + encoding.toUpperCase() + '"', {
+      charset: encoding.toLowerCase(),
+      type: 'charset.unsupported'
+    }))
+  }
 
   try {
+    const contentEncoding = (req.headers['content-encoding'] || 'identity').toLowerCase()
+
+    debug('content-encoding "%s"', contentEncoding)
+
+    if (options.inflate === false && contentEncoding !== 'identity') {
+      throw createError(415, 'content encoding unsupported', {
+        encoding: contentEncoding,
+        type: 'encoding.unsupported'
+      })
+    }
+
     // get the content stream
-    stream = contentstream(req, debug, opts.inflate)
-    length = stream.length
-    stream.length = undefined
+    if (contentEncoding === 'identity') {
+      length = req.headers['content-length']
+      stream = req
+    } else {
+      stream = createDecompressionStream(contentEncoding, debug)
+      req.pipe(stream)
+    }
   } catch (err) {
     return next(err)
   }
 
   // set raw-body options
-  opts.length = length
-  opts.encoding = verify
-    ? null
-    : encoding
-
-  // assert charset is supported
-  if (opts.encoding === null && encoding !== null && !iconv.encodingExists(encoding)) {
-    return next(createError(415, 'unsupported charset "' + encoding.toUpperCase() + '"', {
-      charset: encoding.toLowerCase(),
-      type: 'charset.unsupported'
-    }))
+  const rawBodyOptions = {
+    length,
+    encoding: verify ? null : encoding,
+    limit: options.limit
   }
 
   // read body
   debug('read body')
-  getBody(stream, opts, function (error, body) {
+  getBody(stream, rawBodyOptions, function (error, body) {
     if (error) {
       let _error
 
@@ -138,6 +159,17 @@ function read (req, res, next, parse, debug, options) {
       return
     }
 
+    // detach and destroy the decompression stream to
+    // avoid decompression errors on the finished stream
+    if (stream !== req) {
+      req.unpipe(stream)
+      stream.on('error', () => {})
+      stream.destroy()
+
+      // consume any remaining bytes so the HTTP request can finish
+      req.resume()
+    }
+
     // verify
     if (verify) {
       try {
@@ -145,7 +177,7 @@ function read (req, res, next, parse, debug, options) {
         verify(req, res, body, encoding)
       } catch (err) {
         next(createError(403, err, {
-          body: body,
+          body,
           type: err.type || 'entity.verify.failed'
         }))
         return
@@ -172,38 +204,6 @@ function read (req, res, next, parse, debug, options) {
   })
 }
 
-/**
- * Get the content stream of the request.
- *
- * @param {Object} req
- * @param {Function} debug
- * @param {boolean} inflate
- * @returns {Object}
- * @private
- */
-function contentstream (req, debug, inflate) {
-  const encoding = (req.headers['content-encoding'] || 'identity').toLowerCase()
-  const length = req.headers['content-length']
-
-  debug('content-encoding "%s"', encoding)
-
-  if (inflate === false && encoding !== 'identity') {
-    throw createError(415, 'content encoding unsupported', {
-      encoding: encoding,
-      type: 'encoding.unsupported'
-    })
-  }
-
-  if (encoding === 'identity') {
-    req.length = length
-    return req
-  }
-
-  const stream = createDecompressionStream(encoding, debug)
-  req.pipe(stream)
-  return stream
-}
-
 /**
  * Create a decompression stream for the given encoding.
  * @param {string} encoding
@@ -222,12 +222,16 @@ function createDecompressionStream (encoding, debug) {
     case 'br':
       debug('brotli decompress body')
       return zlib.createBrotliDecompress()
-    default:
-      throw createError(415, 'unsupported content encoding "' + encoding + '"', {
-        encoding: encoding,
-        type: 'encoding.unsupported'
-      })
+    case 'zstd':
+      if (hasZstandardSupport) {
+        debug('zstd decompress body')
+        return zlib.createZstdDecompress()
+      }
   }
+  throw createError(415, 'unsupported content encoding "' + encoding + '"', {
+    encoding,
+    type: 'encoding.unsupported'
+  })
 }
 
 /**
@@ -245,3 +249,16 @@ function dump (req, callback) {
     req.resume()
   }
 }
+
+/**
+ * Get the charset of a request.
+ *
+ * @param {Object} req
+ * @returns {string | undefined}
+ * @private
+ */
+function getCharset (req) {
+  const header = req.headers['content-type']
+  if (!header) return undefined
+  return contentType.parse(header).parameters.charset?.toLowerCase()
+}

package/node_modules/@slack/bolt/node_modules/body-parser/lib/types/json.js

@@ -23,7 +23,7 @@ const { normalizeOptions } = require('../utils')
 module.exports = json
 
 /**
- * RegExp to match the first non-space in a string.
+ * RegExp to match the first non-whitespace character in a string.
  *
  * Allowed whitespace is defined in RFC 7159:
  *
@@ -33,7 +33,7 @@ module.exports = json
  *            %x0A /              ; Line feed or New line
  *            %x0D )              ; Carriage return
  */
-const FIRST_CHAR_REGEXP = /^[\x20\x09\x0a\x0d]*([^\x20\x09\x0a\x0d])/ // eslint-disable-line no-control-regex
+const FIRST_NON_WHITESPACE_REGEXP = /^[\x20\x09\x0a\x0d]*([^\x20\x09\x0a\x0d]|$)/ // eslint-disable-line no-control-regex
 
 const JSON_SYNTAX_CHAR = '#'
 const JSON_SYNTAX_REGEXP = /#+/g
@@ -80,10 +80,12 @@ function createJsonParser (options) {
         return {}
       }
 
-      const first = firstchar(body)
-      if (first !== '{' && first !== '[') {
-        debug('strict violation')
-        throw createStrictSyntaxError(body, first)
+      if (body[0] !== '{' && body[0] !== '[') {
+        const first = firstNonWhitespaceChar(body)
+        if (first !== '{' && first !== '[') {
+          debug('strict violation')
+          throw createStrictSyntaxError(body, first)
+        }
       }
 
       try {
@@ -152,12 +154,10 @@ function createStrictSyntaxError (str, char) {
  * @returns {string|undefined}
  * @private
  */
-function firstchar (str) {
-  const match = FIRST_CHAR_REGEXP.exec(str)
+function firstNonWhitespaceChar (str) {
+  const match = FIRST_NON_WHITESPACE_REGEXP.exec(str)
 
-  return match
-    ? match[1]
-    : undefined
+  return match && match[1] ? match[1] : undefined
 }
 
 /**

package/node_modules/@slack/bolt/node_modules/body-parser/lib/types/urlencoded.js

@@ -98,12 +98,12 @@ function createQueryParser (options) {
     try {
       return qs.parse(body, {
         allowPrototypes: true,
-        arrayLimit: arrayLimit,
-        depth: depth,
-        charsetSentinel: charsetSentinel,
-        interpretNumericEntities: interpretNumericEntities,
+        arrayLimit,
+        depth,
+        charsetSentinel,
+        interpretNumericEntities,
         charset: encoding,
-        parameterLimit: parameterLimit,
+        parameterLimit,
         strictDepth: true
       })
     } catch (err) {

package/node_modules/@slack/bolt/node_modules/body-parser/lib/utils.js

@@ -5,31 +5,16 @@
  */
 
 const bytes = require('bytes')
-const contentType = require('content-type')
 const typeis = require('type-is')
 
 /**
  * Module exports.
  */
 module.exports = {
-  getCharset,
   normalizeOptions,
   passthrough
 }
 
-/**
- * Get the charset of a request.
- *
- * @param {Object} req
- * @returns {string | undefined}
- * @private
- */
-function getCharset (req) {
-  const header = req.headers['content-type']
-  if (!header) return undefined
-  return contentType.parse(header).parameters.charset?.toLowerCase()
-}
-
 /**
  * Get the simple type checker.
  *

package/node_modules/@slack/bolt/node_modules/body-parser/package.json

@@ -1,7 +1,7 @@
 {
   "name": "body-parser",
   "description": "Node.js body parsing middleware",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"
@@ -27,26 +27,21 @@
   },
   "dependencies": {
     "bytes": "^3.1.2",
-    "content-type": "^2.0.0",
+    "content-type": "^2.1.0",
     "debug": "^4.4.3",
     "http-errors": "^2.0.1",
-    "iconv-lite": "^0.7.2",
+    "iconv-lite": "^0.7.3",
     "on-finished": "^2.4.1",
-    "qs": "^6.15.2",
+    "qs": "^6.16.1",
     "raw-body": "^3.0.2",
     "type-is": "^2.1.0"
   },
   "devDependencies": {
-    "eslint": "^8.57.1",
-    "eslint-config-standard": "^14.1.1",
-    "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-markdown": "^3.0.1",
-    "eslint-plugin-node": "^11.1.0",
-    "eslint-plugin-promise": "^6.6.0",
-    "eslint-plugin-standard": "^4.1.0",
+    "eslint": "^9.39.5",
     "mocha": "^11.7.6",
+    "neostandard": "^0.13.0",
     "nyc": "^17.1.0",
-    "supertest": "^7.2.2"
+    "supertest": "7.3.0"
   },
   "files": [
     "lib/",

package/node_modules/zod/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zod",
-  "version": "4.6.5",
+  "version": "4.6.7",
   "type": "module",
   "license": "MIT",
   "author": "Colin McDonnell <zod@colinhacks.com>",

package/node_modules/zod/src/v4/classic/tests/array.test.ts

@@ -140,6 +140,33 @@ test("continue parsing despite array size error", () => {
   `);
 });
 
+test("an upper size bound fails before any element is parsed", () => {
+  let parsed = 0;
+  const el = z.string().refine(() => ++parsed);
+  let refined = 0;
+  const schema = z
+    .array(el)
+    .max(2, "too many")
+    .refine(() => ++refined);
+  expect(schema.safeParse([1, 2, 3]).error!.issues).toMatchObject([{ code: "too_big", path: [], message: "too many" }]);
+  expect(z.array(el).length(2).safeParse(["a", "b", "c"]).error!.issues).toMatchObject([
+    { code: "too_big", exact: true },
+  ]);
+  expect(z.object({ a: z.array(el).max(1) }).safeParse({ a: [1, 2] }).error!.issues).toMatchObject([
+    { code: "too_big", path: ["a"] },
+  ]);
+  expect([parsed, refined]).toEqual([0, 0]);
+
+  // a check that may rewrite the value ends the gate
+  expect(
+    z
+      .array(z.number())
+      .overwrite((a) => a.slice(0, 2))
+      .max(2)
+      .parse([1, 2, 3])
+  ).toEqual([1, 2]);
+});
+
 test("parse should fail given sparse array", () => {
   const schema = z.array(z.string()).nonempty().min(1).max(3);
   const result = schema.safeParse(new Array(3));

package/node_modules/zod/src/v4/classic/tests/map.test.ts

@@ -97,6 +97,13 @@ test("failing when map is bigger than max() ", () => {
   expect(result.success).toEqual(false);
   expect(result.error!.issues.length).toEqual(1);
   expect(result.error!.issues[0].code).toEqual("too_big");
+  const bad = new Map([
+    [1, 1],
+    [2, 2],
+  ]);
+  const capped = z.map(z.string(), z.string()).max(1);
+  expect(capped.safeParse(bad).error!.issues).toMatchObject([{ code: "too_big" }]);
+  expect(capped.safeParse(new Set([1, 2])).error!.issues[0]).toMatchObject({ code: "invalid_type", expected: "map" });
 });
 
 test("failing when map does not match size() ", () => {

package/node_modules/zod/src/v4/classic/tests/set.test.ts

@@ -83,6 +83,12 @@ test("failing when set is bigger than max() ", () => {
   expect(result.success).toEqual(false);
   expect(result.error!.issues.length).toEqual(1);
   expect(result.error!.issues[0].code).toEqual("too_big");
+  expect(
+    z
+      .set(z.string())
+      .max(1)
+      .safeParse(new Set([1, 2])).error!.issues
+  ).toMatchObject([{ code: "too_big" }]);
 });
 
 test("failing when set does not match size() ", () => {

package/node_modules/zod/src/v4/core/compile.ts

@@ -1551,6 +1551,12 @@ function generateNullableCheck(
   return outputVar;
 }
 
+function generateSizeGate(doc: Doc, schema: SomeType, size: string): void {
+  for (const [max, check] of util.sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check._zod.def.check)}) return INVALID;`);
+  }
+}
+
 function generateArrayCheck(
   doc: Doc,
   ctx: CompileContext,
@@ -1560,6 +1566,7 @@ function generateArrayCheck(
 ): string | null {
   const def = schema._zod.def as unknown as { element: SomeType };
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
 
   // Build a new array with validated/transformed elements.
   const outputVar = buildsValue ? newVar(ctx) : null;
@@ -2094,6 +2101,7 @@ function generateMapCheck(doc: Doc, ctx: CompileContext, schema: SomeType, acces
   const def = schema._zod.def as unknown as { keyType: SomeType; valueType: SomeType };
 
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
 
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
@@ -2115,6 +2123,7 @@ function generateSetCheck(doc: Doc, ctx: CompileContext, schema: SomeType, acces
   const def = schema._zod.def as unknown as { valueType: SomeType };
 
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
 
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);

package/node_modules/zod/src/v4/core/schemas.ts

@@ -1844,6 +1844,34 @@ export interface $ZodArrayInternals<T extends SomeType = $ZodType> extends _$Zod
 
 export interface $ZodArray<T extends SomeType = $ZodType> extends $ZodType<any, any, $ZodArrayInternals<T>> {}
 
+// an oversized container fails its leading size checks before any element is parsed
+function capSize(inst: $ZodType, size: (input: any) => number): void {
+  const caps = util.sizeCaps(inst._zod.def.checks);
+  if (!caps.length) return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of util.sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when!(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload as ParsePayload<never>);
+          // the value is still the raw input, so no later check may read it
+          (payload.issues[start] as { continue?: boolean }).continue = false;
+          util.attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse(payload, ctx);
+  };
+}
+
+const arraySize = (input: unknown): number => (Array.isArray(input) ? input.length : -1);
+const mapSize = (input: unknown): number => (input instanceof Map ? input.size : -1);
+const setSize = (input: unknown): number => (input instanceof Set ? input.size : -1);
+
 function handleArrayResult(result: ParsePayload<any>, final: ParsePayload<any[]>, index: number) {
   if (result.issues.length) {
     final.issues.push(...util.prefixIssues(index, result.issues));
@@ -1899,6 +1927,7 @@ export const $ZodArray: core.$constructor<$ZodArray> = /*@__PURE__*/ core.$const
 
     return payload; //handleArrayResultsAsync(parseResults, final);
   };
+  capSize(inst, arraySize);
 });
 
 //////////////////////////////////////////
@@ -3218,8 +3247,11 @@ export type $InferZodRecordInput<
     : Record<core.input<Key> & PropertyKey, core.input<Value>>;
 
 export interface $ZodRecordInternals<Key extends $ZodRecordKey = $ZodRecordKey, Value extends SomeType = $ZodType>
-  extends $ZodTypeInternals<$InferZodRecordOutput<Key, Value>, $InferZodRecordInput<Key, Value>> {
+  extends $ZodTypeInternals {
   def: $ZodRecordDef<Key, Value>;
+  // members rather than base type arguments, which TypeScript 7.1 reports as circular for `z.json()`
+  output: $InferZodRecordOutput<Key, Value>;
+  input: $InferZodRecordInput<Key, Value>;
   isst: errors.$ZodIssueInvalidType | errors.$ZodIssueInvalidKey<Record<PropertyKey, unknown>>;
   optin?: "optional" | undefined;
   optout?: "optional" | undefined;
@@ -3480,6 +3512,7 @@ export const $ZodMap: core.$constructor<$ZodMap> = /*@__PURE__*/ core.$construct
     if (proms.length) return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 
 function handleMapResult(
@@ -3582,6 +3615,7 @@ export const $ZodSet: core.$constructor<$ZodSet> = /*@__PURE__*/ core.$construct
     if (proms.length) return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 
 function handleSetResult(result: ParsePayload, final: ParsePayload<Set<any>>) {

package/node_modules/zod/src/v4/core/util.ts

@@ -935,6 +935,19 @@ export function unwrapMessage(message: string | { message: string } | undefined
 }
 
 /* A check holds no link back to the schema it is attached to — the same check instance is shared by every clone of that schema — so the owner is stamped onto the issues a check just raised, at the only point where both are in scope. Runs on the failure path only; `start` is the issue count from before the check ran. */
+/** The leading size checks of `defChecks` that set an upper bound, each paired with it. */
+export function sizeCaps(defChecks: checks.$ZodCheck<never>[] | undefined): [number, checks.$ZodCheck<never>][] {
+  const caps: [number, checks.$ZodCheck<never>][] = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def as any;
+    // a later check may rewrite the value
+    if (!/_(length|size)$|_equals$/.test(d.check)) break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0) caps.push([max, ch]);
+  }
+  return caps;
+}
+
 export function attachSchema(issues: errors.$ZodRawIssue[], start: number, inst: schemas.$ZodType): void {
   for (let i = start; i < issues.length; i++) {
     (issues[i] as any).schema ??= inst;

package/node_modules/zod/src/v4/core/versions.ts

@@ -1,5 +1,5 @@
 export const version = {
   major: 4,
   minor: 6,
-  patch: 5 as number,
+  patch: 7 as number,
 } as const;

package/node_modules/zod/v4/core/compile.cjs

@@ -1241,9 +1241,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
     doc.write(`}`);
     return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+    for (const [max, check] of util.sizeCaps(schema._zod.def.checks)) {
+        doc.write(`if (${size} > ${numericOperand(max, check._zod.def.check)}) return INVALID;`);
+    }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
     const def = schema._zod.def;
     doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.length`);
     // Build a new array with validated/transformed elements.
     const outputVar = buildsValue ? newVar(ctx) : null;
     const iVar = newVar(ctx);
@@ -1707,6 +1713,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
     const def = schema._zod.def;
     doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.size`);
     const outputVar = newVar(ctx);
     const kVar = newVar(ctx);
     const valVar = newVar(ctx);
@@ -1723,6 +1730,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
     const def = schema._zod.def;
     doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+    generateSizeGate(doc, schema, `${accessor}.size`);
     const outputVar = newVar(ctx);
     const valVar = newVar(ctx);
     doc.write(`const ${outputVar} = new Set();`);