fix(deps): update zod to 4.6.7 for cve-2023-54404 by pauldambra · Pull Request #115271 · PostHog/posthog

pauldambra · 2026-10-12T09:26:48Z

Problem

An attacker can crash a service that checks input with a zod array schema. A very large array makes zod build one issue per bad element until the process runs out of memory.
This is CVE-2023-54404. It affects zod up to 4.6.5, and zod 4.6.6 fixes it (colinhacks/zod#6652). This PR uses 4.6.7, the latest patch.
The main app used 4.3.6. products/desktop and packages/agent used 4.4.3.
The MCP server and nodejs check outside input with zod and have many z.array schemas with no .max().
The zod fix stops early only on arrays that have a .max(), so it does not protect the unbounded MCP arrays on its own.

Changes

All zod 4.x consumers now resolve to exactly 4.6.7, through a zod@^4.0.0 override in each of the three pnpm workspaces. The two sub-workspaces already had this override, set to 4.4.3.
MCP tool calls with more than 50,000 values now fail with one clear error before zod runs. Real tool calls are far smaller. All five tool-argument validation paths share one function, validateToolArguments, which also runs the repairs.
The MCP server now applies its 1 MiB body limit on the first read of the request, while the body streams in. That first read is in the Cloudflare worker for public traffic, and in authenticateAndParse on the Hono server. Before, both read the whole body before any size check, and the check used only the Content-Length header.
Error messages for rejected tool arguments list at most 20 problems, then say how many more there are.
Both rejections are now observable. A tool call above the value cap records $mcp_error_code: too_many_values. An oversized body increments mcp_request_body_too_large_total and logs one [RequestBody] body too large warning, with the token cut to its last 4 characters.
No minimumReleaseAgeExclude entry is needed. 4.6.7 is older than the 7-day minimum release age, so the normal quarantine applies.
The npm tarball of 4.6.6 does not contain the malicious preinstall dropper that was pushed to the zod repo history on 2026-09-21 and then removed (colinhacks/zod#6658). The publish has provenance and maintainer approval.
zod 3.25.76 is unchanged. zod 3 has no fix yet (colinhacks/zod#6653). Its users here are dev, test and build tools (@cloudflare/vitest-pool-workers, chromium-bidi, Expo CLI, jimp) and canvas_builder, which does not use z.array. None of them checks outside input.
MCP tools still accept ISO date-times without seconds, such as 2026-10-12T10:00Z. zod 4.5.0 made z.iso.datetime() require seconds (colinhacks/zod#6457). A new repair adds :00 only to the values zod rejected, and keeps the change only when the full parse then passes. It also works when the call is nested one level off. All four tool-argument validation paths use repairToolArguments.
MCP tool input schemas now write simple unions as "type": ["string", "null"] instead of anyOf. This is valid JSON Schema 2020-12, and the schemas get smaller.
The agent harness now converts a type array into a union of every listed type. Before, it kept only the first non-null type, so insight-get rejected short IDs like AaVQ8Ijw.
The z.email() pattern in the schemas also changed (zod 4.6.0).
Heatmap backgrounds from a replay keep working when the replay has no start time or URL. zod 4.6 rejects a missing key for z.union([z.string(), z.undefined()]), and JSON.stringify drops undefined keys. The schema now uses .optional() for these two keys. The existing heatmapCreationLogic and replayIframeData tests caught this.
Mechanical: the three lockfiles, 213 regenerated MCP tool schema snapshots, and the regenerated services/mcp/schema/tool-inputs.json.
The packages/agent lockfile has only its zod entries changed, because a full re-resolve there swaps unrelated vite entries. zod has no dependencies, and pnpm install --frozen-lockfile accepts all three lockfiles.

MCP Analytics: an errored $mcp_tool_call for a call above the value cap now carries $mcp_error_code: too_many_values. The server sets $mcp_error_code through its existing error classification, which already does this for other validation codes, so no new event or property is added. The reason is to let an alert count calls that hit the cap.

How did you test this code?

services/mcp: typecheck and the unit suite pass. The 222 schema snapshots were regenerated on top of current master.
@posthog/harness converter tests and typecheck pass.
frontend and products/desktop (with packages/agent) typechecks pass. The web_analytics heatmaps Jest suites pass.
nodejs typecheck has errors only in files that import the Rust-built @posthog/replay-anonymizer and @posthog/ai-research-v4-native, which this sandbox did not build.
New exec.test.ts rows cover the value cap. The first row fails when the cap is removed.
The body-size test in the shared MCP protocol suite now also streams a body with no Content-Length. That row fails without the dispatcher change, and the suite runs on both the Hono and Cloudflare runtimes.
A new Hono test streams a body that errors once more than 4 MiB has been read. It fails with the old full read and checks the warning line.
A new worker test posts 1.5 MiB to the Cloudflare entry and fails without the worker change.
A new tool-executor test checks $mcp_error_code: too_many_values on the event. Each new test fails when its wiring is removed.
Not run: the full frontend Jest suite, the nodejs test suites, and the desktop tests. CI runs them.

Test rationale:

The CVE fix is upstream, with its own tests. The existing MCP schema snapshot test caught every schema change this PR makes.
exec.test.ts has new cases for the date-time repair, next to the nesting repair cases. They catch a repair that stops adding seconds, or one that accepts a date with no time or with no offset. One case goes through the generated annotation-create schema.
In schema.test.ts, the nullable-array case is now a table with multi-type cases. It catches a converter that drops a later type.

👉 Stay up-to-date with PostHog coding conventions for a smoother review.

Release status

No feature flag controls this change

Docs update

None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: PostHog Desktop (Claude Code), claude-opus-5-5

The vulnerability report and the zod repo history came from public sources: the GitHub advisory database, OSV.dev, and the zod repository.
Skills invoked: /writing-pr-descriptions, /writing-tests, and the skills-store pr-shepherd and qa-swarm.
Review fixes: the bot reviewers found the harness converter break and the stricter date-time rule. Both are fixed in this PR.
No duplicate: an open PR search for "zod" found no other zod update.
Adoption: the branch had a bad lockfile edit (debug@4.6.6, which does not exist) and conflicts with master. The branch is now one commit rebuilt on master, with zod 4.6.7, the heatmap schema fix, and the new tool-executor.ts call path switched to repairToolArguments. Skills invoked for this: adopting-prs, writing-pr-descriptions.

Created with PostHog Desktop

🤖 Generated with Claude Code

trunk-io · 2026-10-12T09:26:51Z

Merging to master in this repository is managed by Trunk.

To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

posthog · 2026-10-12T09:26:56Z

PostHog Review · Standard · reviewed `926c956`

Nothing to post.

Step	Status	Result
Prepare the diff	done	225 files
Main review and lenses	done	0 issues
Merge and cap	done	0 → 0
Publish	done	Nothing to post

github-actions · 2026-10-12T09:28:16Z

🤖 CI report

⚠️

Trunk lane — backend Python lane

This PR is assigned to the backend Python lane. It runs backend Python tests and may merge in parallel with PRs in other lanes.

✅ Complexity (TypeScript) — clean

Cyclomatic complexity above the limit in changed typescript files (10 for production files, 15 for test files). Warn only: worth simplifying when you next touch these functions.

✅ Duplication (Python) — clean

New Python code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

✅ Duplication (TypeScript) — clean

New TypeScript code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

🚨 Comment density — 8% of added code lines are comments (41 of 513)

This section warns when comments are more than 3% of the code lines a PR adds, and alerts above 6%. Before agent-assisted PRs, the typical share was about 2%. Only full-line comments count. Docstrings, generated files, snapshots, migrations, and workflow files are left out.

Comments that restate the code, record how the change came about, or narrate the next line add noise for the next reader. Keep the comments that explain a reason the code cannot show, and remove the rest. See .agents/skills/writing-code-comments/SKILL.md for the house rules.

Files with the most added comment lines:

File	Comment lines	Added lines
`services/mcp/src/tools/exec.ts`	23	171
`services/mcp/tests/integration/mcp-protocol-suite.ts`	7	30
`services/mcp/src/hono/request-body.ts`	2	13
`services/mcp/src/lib/request-body.ts`	2	42
`services/mcp/tests/unit/exec.test.ts`	2	94
`services/mcp/src/hono/request-utils.ts`	1	11
`services/mcp/src/index.ts`	1	9
`services/mcp/src/lib/errors.ts`	1	4

This check does not block merging. It updates on every push and clears when the share drops.

⚠️

Bundle size — 🔺 +118.7 KiB (+0.2%)

Uncompressed size of every built .js bundle, compared against the base branch.

Total: 77.07 MiB · 🔺 +118.7 KiB (+0.2%)

File	Size	Δ vs base
`render-query/src/render-query/render-query.js`	24.99 MiB	🔺 +67.8 KiB (+0.3%)
`posthog-app/_parent/products/workflows/frontend/Transactional/TransactionalScene.js`	32.5 KiB	🔺 +32.5 KiB (new)
`posthog-app/src/scenes/web-analytics/WebAnalyticsScene.js`	247.8 KiB	🔺 +10.3 KiB (+4.3%)
`posthog-app/src/scenes/experiments/Experiment.js`	418.0 KiB	🔺 +6.5 KiB (+1.6%)
`exporter/src/queries/schema.js`	1.27 MiB	🟢 -2.1 KiB (-0.2%)
`posthog-app/src/queries/schema.js`	1.27 MiB	🟢 -2.1 KiB (-0.2%)
`posthog-app/src/scenes/analytics/AnalyticsList.js`	29.9 KiB	🔺 +1.1 KiB (+3.7%)

_{Posted automatically by build-bundle-size-report · uncompressed bytes from dist-report}

⚠️

Eager graph — 3 over budget

How much code each root ships on the eager path — downloaded and parsed before the surface is interactive. Measured from the esbuild output chunks (post-tree-shake, static imports only); lazy import() / React.lazy chunks are not counted.

Root	Eager (shipped)	Δ vs base	Budget
entry (logged-out pages, app bootstrap) `src/index.tsx`	1.01 MiB · 24 files	🔺 +1.4 KiB (+0.1%)	`█████████░` 87.9% of 1.14 MiB
logged-out boot: index + App + bootApp (preloaded by every page, including /login) `src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts`	2.97 MiB · 620 files	🔺 +3.3 KiB (+0.1%)	`██████████` 98.0% of 3.03 MiB
🟡 authenticated shell (every logged-in page) `src/scenes/AuthenticatedShell.tsx`	7.56 MiB · 2,568 files	🔺 +66.8 KiB (+0.9%)	`██████████` 100.8% of 7.50 MiB
dashboard scene `src/scenes/dashboard/Dashboard.tsx`	10.01 MiB · 3,735 files	🔺 +68.6 KiB (+0.7%)	`██████████` 100.0% of 10.01 MiB
🟡 today home path `src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx`	7.74 MiB · 2,661 files	🔺 +69.2 KiB (+0.9%)	`██████████` 100.0% of 7.74 MiB
🟡 AI-first home path `src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx`	7.98 MiB · 2,654 files	🔺 +68.7 KiB (+0.8%)	`██████████` 101.0% of 7.91 MiB
events scene `src/scenes/activity/explore/EventsScene.tsx`	9.45 MiB · 3,517 files	🔺 +69.0 KiB (+0.7%)	`██████████` 98.6% of 9.59 MiB
web analytics scene `src/scenes/web-analytics/WebAnalyticsScene.tsx`	10.39 MiB · 3,768 files	🔺 +79.4 KiB (+0.8%)	`██████████` 95.9% of 10.83 MiB
replay detail scene `src/scenes/session-recordings/detail/SessionRecordingDetail.tsx`	8.48 MiB · 3,093 files	🔺 +66.7 KiB (+0.8%)	`█████████░` 89.5% of 9.47 MiB

🟢 node_modules/monaco-editor/ stays out of src/index.tsx
🟢 src/lib/components/ActivityLog/describers stays out of src/index.tsx
🟢 node_modules/@posthog/brand/dist/generated/hoggies/svg/ stays out of src/index.tsx
🟢 node_modules/@posthog/brand/dist/generated/hoggies/components/ stays out of src/index.tsx
🟢 node_modules/monaco-editor/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/layout/navigation-3000/navigationLogic.tsx stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/scenes/dashboard/dashboardLogic.tsx stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/lib/lemon-ui/LemonMarkdown/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/lib/components/RichContentEditor/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/lib/components/CodeSnippet/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/taxonomy/core-filter-definitions-by-group.json stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 node_modules/zod/ stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/scenes/billing/billingLogic.tsx stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 src/lib/components/ProductEmptyState/productSetupPreloadLogic.ts stays out of src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts
🟢 node_modules/monaco-editor/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/lib/components/ActivityLog/describers stays out of src/scenes/AuthenticatedShell.tsx
🟢 products/dashboards/frontend/widgets/previews/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/scenes/session-recordings/player/sessionRecordingPlayerLogic.ts stays out of src/scenes/AuthenticatedShell.tsx
🟢 products/wizard/frontend/runs/WizardRunDetailsDrawer.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/layout/today/TodayShell.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/layout/today/TodayContextPanelFloating.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/layout/today/TodaySidePanel.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/layout/today/TodayTopBar.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/layout/today/todayRailItems.tsx stays out of src/scenes/AuthenticatedShell.tsx
🟢 zod/v4/locales/de.js stays out of src/scenes/AuthenticatedShell.tsx
🟢 node_modules/@posthog/brand/dist/generated/hoggies/svg/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 node_modules/@posthog/brand/dist/generated/hoggies/components/ stays out of src/scenes/AuthenticatedShell.tsx
🟢 src/scenes/session-recordings/playlist/SessionRecordingsPlaylist.tsx stays out of src/scenes/dashboard/Dashboard.tsx
🟢 src/scenes/web-analytics/tiles/WebAnalyticsTile.tsx stays out of src/scenes/dashboard/Dashboard.tsx
🟢 src/queries/validators.js stays out of src/scenes/dashboard/Dashboard.tsx
🟢 src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx
🟢 src/scenes/project-homepage/today/TodayReportPage.tsx stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx
🟢 src/queries/Query/Query.tsx stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx
🟢 packages/quill/packages/charts/ stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx
🟢 products/posthog_ai/frontend/components/tool/widgets/VisualizationWidget.tsx stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx
🟢 products/posthog_ai/frontend/components/tool/widgets/RecordingsWidget.tsx stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx
🟢 src/queries/Query/Query.tsx stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx
🟢 products/posthog_ai/frontend/api/primitives.ts stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx
🟢 src/scenes/notebooks/Notebook/notebookLogic.ts stays out of src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx
🟢 src/scenes/session-recordings/playlist/SessionRecordingsPlaylist.tsx stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 src/scenes/web-analytics/tiles/WebAnalyticsTile.tsx stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 src/queries/validators.js stays out of src/scenes/activity/explore/EventsScene.tsx
🟢 src/scenes/web-analytics/LiveMetricsDashboard/LiveWebAnalyticsMetrics.tsx stays out of src/scenes/web-analytics/WebAnalyticsScene.tsx
🟢 products/product_analytics/frontend/insights/trends/WorldMap/countryVectors.tsx stays out of src/scenes/web-analytics/WebAnalyticsScene.tsx
🟢 src/scenes/settings/SettingsMap.tsx stays out of src/scenes/session-recordings/detail/SessionRecordingDetail.tsx
🟢 @jspm/core/nodelibs/browser/fs stays out of src/scenes/session-recordings/detail/SessionRecordingDetail.tsx

Largest files eagerly shipped from src/index.tsx

Size	File
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
24.6 KiB	`../node_modules/.pnpm/buffer@6.0.3/node_modules/buffer/index.js`
6.3 KiB	`../node_modules/.pnpm/react@18.3.1/node_modules/react/cjs/react.production.min.js`
4.7 KiB	`../node_modules/.pnpm/@jspm+core@2.1.0/node_modules/@jspm/core/nodelibs/browser/process.js`
4.0 KiB	`../node_modules/.pnpm/scheduler@0.23.2/node_modules/scheduler/cjs/scheduler.production.min.js`
1.7 KiB	`../node_modules/.pnpm/base64-js@1.5.1/node_modules/base64-js/index.js`
1.6 KiB	`src/lib/utils/bootTiming.ts`
1.6 KiB	`src/index.tsx`
1.2 KiB	`src/RootErrorBoundary.tsx`
949 B	`src/scenes/ChunkLoadErrorBoundary.tsx`

Largest files eagerly shipped from src/index.tsx + src/scenes/App.tsx + src/scenes/bootApp.ts

Size	File
322.9 KiB	`../node_modules/.pnpm/posthog-js@1.438.23_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
217.5 KiB	`../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
102.1 KiB	`src/products.tsx`
86.1 KiB	`src/lib/api.ts`
68.3 KiB	`src/lib/lemon-ui/icons/icons.tsx`
41.9 KiB	`../node_modules/.pnpm/@dnd-kit+core@6.0.8_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@dnd-kit/core/dist/core.esm.js`
36.4 KiB	`../node_modules/.pnpm/kea@4.0.0-pre.6_patch_hash=139b8d1f1304f9d9da452a9a1244c94ea679dbcb85687d8999563146879fb6f5_react@18.3.1/node_modules/kea/lib/index.cjs.js`
27.0 KiB	`../node_modules/.pnpm/tailwind-merge@2.2.2/node_modules/tailwind-merge/dist/bundle-mjs.mjs`
24.6 KiB	`../node_modules/.pnpm/buffer@6.0.3/node_modules/buffer/index.js`

Largest files eagerly shipped from src/scenes/AuthenticatedShell.tsx

Size	File
322.9 KiB	`../node_modules/.pnpm/posthog-js@1.438.23_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
286.4 KiB	`src/taxonomy/core-filter-definitions-by-group.json`
239.9 KiB	`../packages/quill/packages/quill/dist/index.js`
217.5 KiB	`../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
153.8 KiB	`../node_modules/.pnpm/re2js@0.4.1/node_modules/re2js/build/index.esm.js`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
102.1 KiB	`src/products.tsx`
94.5 KiB	`../node_modules/.pnpm/@tiptap+core@3.20.6_@tiptap+pm@3.20.6/node_modules/@tiptap/core/dist/index.js`
92.5 KiB	`../node_modules/.pnpm/prosemirror-view@1.40.1/node_modules/prosemirror-view/dist/index.js`
86.1 KiB	`src/lib/api.ts`

Largest files eagerly shipped from src/scenes/dashboard/Dashboard.tsx

Size	File
322.9 KiB	`../node_modules/.pnpm/posthog-js@1.438.23_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
286.4 KiB	`src/taxonomy/core-filter-definitions-by-group.json`
239.9 KiB	`../packages/quill/packages/quill/dist/index.js`
217.5 KiB	`../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
153.8 KiB	`../node_modules/.pnpm/re2js@0.4.1/node_modules/re2js/build/index.esm.js`
144.1 KiB	`../packages/quill/packages/primitives/dist/index.js`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
102.1 KiB	`src/products.tsx`
94.5 KiB	`../node_modules/.pnpm/@tiptap+core@3.20.6_@tiptap+pm@3.20.6/node_modules/@tiptap/core/dist/index.js`
92.5 KiB	`../node_modules/.pnpm/prosemirror-view@1.40.1/node_modules/prosemirror-view/dist/index.js`

Largest files eagerly shipped from

src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/today/TodayHome.tsx

Size	File
322.9 KiB	`../node_modules/.pnpm/posthog-js@1.438.23_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
286.4 KiB	`src/taxonomy/core-filter-definitions-by-group.json`
239.9 KiB	`../packages/quill/packages/quill/dist/index.js`
217.5 KiB	`../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
153.8 KiB	`../node_modules/.pnpm/re2js@0.4.1/node_modules/re2js/build/index.esm.js`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
102.1 KiB	`src/products.tsx`
94.5 KiB	`../node_modules/.pnpm/@tiptap+core@3.20.6_@tiptap+pm@3.20.6/node_modules/@tiptap/core/dist/index.js`
92.5 KiB	`../node_modules/.pnpm/prosemirror-view@1.40.1/node_modules/prosemirror-view/dist/index.js`
86.1 KiB	`src/lib/api.ts`

Largest files eagerly shipped from

src/scenes/AuthenticatedShell.tsx + src/scenes/project-homepage/ProjectHomepage.tsx + src/scenes/project-homepage/ai-first/AiFirstHomepage.tsx

Size	File
322.9 KiB	`../node_modules/.pnpm/posthog-js@1.438.23_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
286.4 KiB	`src/taxonomy/core-filter-definitions-by-group.json`
239.9 KiB	`../packages/quill/packages/quill/dist/index.js`
217.5 KiB	`../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
153.8 KiB	`../node_modules/.pnpm/re2js@0.4.1/node_modules/re2js/build/index.esm.js`
144.1 KiB	`../packages/quill/packages/primitives/dist/index.js`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
102.1 KiB	`src/products.tsx`
94.5 KiB	`../node_modules/.pnpm/@tiptap+core@3.20.6_@tiptap+pm@3.20.6/node_modules/@tiptap/core/dist/index.js`
92.5 KiB	`../node_modules/.pnpm/prosemirror-view@1.40.1/node_modules/prosemirror-view/dist/index.js`

Largest files eagerly shipped from src/scenes/activity/explore/EventsScene.tsx

Size	File
322.9 KiB	`../node_modules/.pnpm/posthog-js@1.438.23_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
286.4 KiB	`src/taxonomy/core-filter-definitions-by-group.json`
239.9 KiB	`../packages/quill/packages/quill/dist/index.js`
217.5 KiB	`../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
153.8 KiB	`../node_modules/.pnpm/re2js@0.4.1/node_modules/re2js/build/index.esm.js`
144.1 KiB	`../packages/quill/packages/primitives/dist/index.js`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
102.1 KiB	`src/products.tsx`
94.5 KiB	`../node_modules/.pnpm/@tiptap+core@3.20.6_@tiptap+pm@3.20.6/node_modules/@tiptap/core/dist/index.js`
92.5 KiB	`../node_modules/.pnpm/prosemirror-view@1.40.1/node_modules/prosemirror-view/dist/index.js`

Largest files eagerly shipped from src/scenes/web-analytics/WebAnalyticsScene.tsx

Size	File
322.9 KiB	`../node_modules/.pnpm/posthog-js@1.438.23_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
286.4 KiB	`src/taxonomy/core-filter-definitions-by-group.json`
239.9 KiB	`../packages/quill/packages/quill/dist/index.js`
217.5 KiB	`../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
182.9 KiB	`src/queries/validators.js`
153.8 KiB	`../node_modules/.pnpm/re2js@0.4.1/node_modules/re2js/build/index.esm.js`
144.1 KiB	`../packages/quill/packages/primitives/dist/index.js`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
102.1 KiB	`src/products.tsx`
94.5 KiB	`../node_modules/.pnpm/@tiptap+core@3.20.6_@tiptap+pm@3.20.6/node_modules/@tiptap/core/dist/index.js`

Largest files eagerly shipped from src/scenes/session-recordings/detail/SessionRecordingDetail.tsx

Size	File
322.9 KiB	`../node_modules/.pnpm/posthog-js@1.438.23_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/module.mjs`
316.1 KiB	`../node_modules/.pnpm/posthog-js@1.438.23_@types+react@18.3.27_react@18.3.1/node_modules/posthog-js/dist/rrweb.js`
286.4 KiB	`src/taxonomy/core-filter-definitions-by-group.json`
239.9 KiB	`../packages/quill/packages/quill/dist/index.js`
217.5 KiB	`../node_modules/.pnpm/@posthog+icons@0.39.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js`
153.8 KiB	`../node_modules/.pnpm/re2js@0.4.1/node_modules/re2js/build/index.esm.js`
126.8 KiB	`../node_modules/.pnpm/react-dom@18.3.1_react@18.3.1/node_modules/react-dom/cjs/react-dom.production.min.js`
102.1 KiB	`src/products.tsx`
94.5 KiB	`../node_modules/.pnpm/@tiptap+core@3.20.6_@tiptap+pm@3.20.6/node_modules/@tiptap/core/dist/index.js`
92.5 KiB	`../node_modules/.pnpm/prosemirror-view@1.40.1/node_modules/prosemirror-view/dist/index.js`

_{Posted automatically by check-eager-graph · sizes are eager output bytes (shipped, post-tree-shake) from the esbuild metafile · part of #32479}

✅ Toolbar bundle — eager 2.30 MiB within budget

What the toolbar ships to customer pages, measured from the esbuild output (minified, post-tree-shake). The eager set is the entry plus everything statically imported from it — fetched before any feature runs; deferred chunks load lazily. The eager guardrail is 5.72 MiB. Each output file must also stay below 10 MB, where CloudFront stops compressing it. The module boundary is enforced separately by check-toolbar-graph.

Metric	Size	Δ vs base	Budget
Eager (shipped) entry + static imports	2.30 MiB · 18 files	🔺 +1.4 KiB (+0.1%)	`████░░░░░░` 40.2% of 5.72 MiB
Deferred (lazy)	2.11 MiB · 40 files	no change	n/a — loads on demand
Loader `dist/toolbar.js`	1.2 KiB	no change	`█░░░░░░░░░` 6.0% of 19.5 KiB

Largest eagerly-shipped chunks

Size	File
913.0 KiB	`dist/toolbar/toolbar-app-LVCKUXVA.css`
694.6 KiB	`dist/toolbar/chunk-chunk-KNRAWEQQ.js`
259.9 KiB	`dist/toolbar/chunk-chunk-ONRHJSKR.js`
131.8 KiB	`dist/toolbar/chunk-chunk-FDH2IBXT.js`
130.4 KiB	`dist/toolbar/chunk-chunk-YOHNATS2.js`
74.8 KiB	`dist/toolbar/toolbar-app-ESLXDX7E.js`
69.0 KiB	`dist/toolbar/chunk-chunk-TSAL54PB.js`
35.6 KiB	`dist/toolbar/chunk-chunk-YFQRBJ2B.js`
21.7 KiB	`dist/toolbar/chunk-chunk-FFPYKUY4.js`
6.8 KiB	`dist/toolbar/chunk-chunk-DV7IWQNF.js`

_{Posted automatically by check-toolbar-size · sizes are toolbar output bytes (shipped, post-tree-shake) from the esbuild metafile}

✅ Dist folder size — 🔺 +2.08 MiB (+0.2%)

Total size of the built frontend/dist folder (all assets), compared against the base branch.

Total: 972.33 MiB · 🔺 +2.08 MiB (+0.2%)

ℹ️ MCP agent API — agent-facing tool changes

What this PR changes for agents, from the tool schema snapshots and tool definitions.

Tools changed (223):

Tool	Params	Scopes	Annotations	Schema chars
`access-control-default-rule-set-prepare`				1,791 -> 1,753
`access-control-member-rule-set-prepare`				1,932 -> 1,894
`access-control-role-rule-set-prepare`				1,908 -> 1,870
`action-create`				14,775 -> 14,618
`action-update`				14,881 -> 14,724
`advanced-activity-logs-list`				4,108 -> 4,060
`aeo-prompts-list`				637 -> 618
`aeo-prompts-update`				1,584 -> 1,546
`alert-create`				35,509 -> 32,787
`alert-simulate`				29,819 -> 27,140
`alert-update`				35,564 -> 32,842
`annotation-create`				1,956 -> 1,894
`annotations-partial-update`				2,065 -> 2,003
`apm-attribute-breakdown`				4,182 -> 4,125
`apm-service-health`				2,269 -> 2,174
`apm-spans-aggregate`				3,558 -> 3,501
`apm-spans-count`				4,457 -> 4,419
`apm-spans-duration-histogram`				2,628 -> 2,590
`apm-spans-latency-heatmap`				2,625 -> 2,587
`apm-spans-sparkline`				2,594 -> 2,556
`apm-spans-tree`				3,208 -> 3,151
`apm-trace-get`				1,000 -> 962
`batch-export-create`				27,660 -> 27,052
`batch-export-update`				27,419 -> 26,811
`billing-spend-get`				3,659 -> 3,602
`billing-usage-get`				3,903 -> 3,846
`broadcasts-create`				19,647 -> 19,628
`canvas-edit-create`				5,277 -> 5,239
`canvas-layout-patch`				5,483 -> 5,350
`canvas-layout-publish`				3,580 -> 3,504
`canvas-promote-create`				520 -> 501
`canvas-publish-create`				6,651 -> 6,632
`cdp-functions-create`				9,382 -> 9,344
`cdp-functions-invocations-create`				17,532 -> 17,326
`cdp-functions-list`				1,150 -> 1,140
`cdp-functions-logs-retrieve`				1,600 -> 1,590
`cdp-functions-partial-update`				10,222 -> 10,179
`change-feed-list`				1,551 -> 1,541
`cohorts-create`				4,275 -> 3,791
`cohorts-partial-update`				4,409 -> 3,925

...and 183 more changed tools.

⚠️

Playwright — 1 failed, 1 flaky

🎭 Playwright report · View test results →

❌ 1 failed test:

Logout in another tab results in logout in the current tab too (chromium)

⚠️ 1 flaky test:

View persons list, navigate to detail, and browse tabs (chromium)

These issues are not necessarily caused by your changes.
Annoyed by this section? Help fix flakies and failures and it will go green!

✅ Hogbox preview — ready, open the preview

▶ Open the preview


🔑 Login	`test@posthog.com` / `12345678` (demo data)
🧩 Running	this PR's backend and frontend, on the PostHog `:master` base
🔗 Link	stable across rebuilds: a re-push swaps the box underneath, the URL stays
🔒 Access	tailnet only (PostHog VPN)
🛠️ Admin	inspect & debug state in hogland
💤 Idle	sleeps after ~30 min idle (snapshot to S3, zero node cost) and wakes on your next visit in ~30s, behind a brief "waking up" screen

_{commit 9535319 · box box-f0146bcfc99c · ready in 1120s (push → usable) · build log · rebuilds on every push, torn down on close}

posthog · 2026-10-12T09:31:07Z

PostHog Review alpha 🦔 If you find any issues helpful - please reply "valid", "invalid", etc., for evaluation purposes 🙏

parameterai · 2026-10-12T09:34:10Z

Risk: No findings

This increment moves the 1 MiB body cap from the Hono-only module into shared lib/request-body.ts and, critically, applies it at the Cloudflare edge entry point (index.ts:173) before the client-info parse and the proxy forward — the first time the cap holds on the production entry path. I traced every body read in the worker (logging, metadata, asset, and proxy branches) and each is either header-only or now behind the streaming cap; the Hono second layer is unchanged. No new issues introduced.

_{Sentinel reviewed d70dc77 · Review settings}

chatgpt-codex-connector · 2026-10-12T09:34:16Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T09:38:57.999175Z	`6f65c22`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

pr-assigner-resolver-posthog · 2026-10-12T09:34:35Z

👀 Auto-assigned reviewers

These soft owners were skipped because they only have minor changes here. Nothing blocks merge, so self-assign if you'd like a look:

@PostHog/team-surfaces (products/desktop/product.yaml)

Soft owners come from each directory's owners.yaml and each product's product.yaml (resolved nearest-file-wins). For a skipped owner, the locator is the file that decided it. Generated files and lockfiles are ignored when deciding ownership.

trunk-io · 2026-10-12T09:37:04Z

Failed Test	Failure Summary	Logs
`Persons › View persons list, navigate to detail, and browse tabs`	The test failed because an element expected to be visible was not visible.	Logs ↗︎

_{View Full Report ↗︎ ⋅ Docs}

posthog-security-review-bot · 2026-10-12T09:37:43Z

✅ Security review complete — 6f65c221df8c

1 finding posted as a review, in 15 min.

_{Add the security-review label to run again on the latest commit.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6f65c221df

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

pauldambra

Note

🤖 Automated comment by QA Swarm — not written by a human

QA Swarm review complete. See inline comments.

pauldambra · 2026-10-12T09:45:19Z

Note

🤖 Automated comment by QA Swarm — not written by a human

Multi-perspective review: router (cheap-first pass) + delegated lenses (qa-team, paul-reviewer, xp-reviewer, security-audit, engineering-systems-thinking as warranted)

Verdict: ✅ APPROVE _{(round 8 @ 38f9ad4)}

This round reviewed the message cap and the body cap on the first read. No actionable finding is left.

Key findings

🟢 Not changed: an oversized body is now rejected before the rate limiter runs. The limiter keys on a hash of the token, and the token is only checked for its prefix at that point, so it never bounded this path. Each rejected request now costs at most about 1 MiB of reading, where before it read the whole body.
🟢 Not changed: the "and N more" count can include an issue whose message repeats one already shown. The count stays an upper bound, which is enough for the agent.

Convergence

None.

Reviewer summaries

Reviewer	Assessment
🧭 router (Sonnet 5)	Low danger, high confidence. Confirmed that the response shape matches the dispatcher's, that no other code reads the body before `preserveBody`, and that no existing test asserts a message with more than 20 problems.

Previous rounds (7)

round 7 @ 7b59f78 — 💬 APPROVE WITH NITS: two MEDIUM findings (body read outside try, unbounded validation message), fixed in 5036156.

round 6 @ 167dd7a — ✅ APPROVE: the rebuilt branch kept the reviewed repair logic. A router point about prototype pollution was refuted.
round 5 @ 1258a37 — ✅ APPROVE: the datetime repair finds every edit first and applies them in one pass.
round 4 @ 6be43d2 — 💬 APPROVE WITH NITS: union datetimes were skipped and one test gap was named. 1258a37 fixed the union case.
round 3 @ bebc1cf — ✅ APPROVE: the combined repair fixed the case where a call needs both repairs.
round 2 @ 40bdeb0 — ✅ APPROVE: one LOW point about combining the repairs. Bots then reported it as a regression, and bebc1cf fixed it.
round 1 @ 6f65c22 — 💬 APPROVE WITH NITS: the date-time contract change (fixed in 40bdeb0) and the zod 3 scope (now in the PR description).

Automated by QA Swarm — not a human review

posthog-security-review-bot

Agent-driven security review - findings inline.

pauldambra

Note

🤖 Automated comment by QA Swarm — not written by a human

QA Swarm review complete. See inline comments.

posthog · 2026-10-19T04:35:03Z

👋 Visual changes detected for this PR.

Review and approve in PostHog Visual Review

If these changes are unexpected, they may be caused by a flaky test or a broken snapshot on master. Don't approve — rerun the job or wait for a fix.

_{Install the Visual Review Chrome extension to see visual review results at the top of your pull requests.}

scheduled-actions-posthog · 2026-10-27T07:49:02Z

This PR hasn't seen activity in a week! Should it be merged, closed, or further worked on? If you want to keep it open, please remove the stale label – otherwise this will be closed in another week. If you want to permanently keep it open, use the waiting label.

Rebuilt on current master with the lockfiles and MCP schemas regenerated. - zod 4.6.7 in all three pnpm workspaces. - MCP tool calls with more than 50,000 values fail with one issue before zod runs, because zod 4.6.7 bounds only arrays that declare a .max(). - The MCP dispatcher enforces its 1 MiB body limit while the body streams in. - The MCP datetime repair, the harness union converter, the heatmap replay schema and the jitless plugin follow zod 4.6 behaviour. - explain-chart's evidence url uses .regex() instead of .startsWith(), because zod 4.6 writes startsWith into JSON Schema as an invalid format. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Generated-By: PostHog Desktop Task-Id: 35d30538-8415-4552-8f25-b8bf18c75bb3

posthog

PostHog Review · Standard · reviewed 7b59f78: 1 Must fix.

This is review round 5 on this pull request. When findings keep coming back in the same code, the approach is usually the problem. Before the next fix, check whether a different design would remove the whole class of findings.

…errors - formatInputValidationError lists the first 20 problems and counts the rest. A call just under the value cap could otherwise return a message of several megabytes to the agent and to analytics. - The streamed body read runs inside the try block again, so a client that drops mid-upload gets a JSON-RPC parse error, as with req.json(), instead of an HTTP 500 and a captured exception. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Generated-By: PostHog Desktop Task-Id: 35d30538-8415-4552-8f25-b8bf18c75bb3

authenticateAndParse buffered the whole body with raw.text() before the dispatcher checked its size, so a large body was held in memory before it was rejected. preserveBody now reads through readBodyWithinLimit and returns the same "Request body too large" JSON-RPC error. The limit, the reader and the error response live in src/hono/request-body.ts, and the dispatcher keeps its own check for callers that skip authenticateAndParse. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Generated-By: PostHog Desktop Task-Id: 35d30538-8415-4552-8f25-b8bf18c75bb3

- A tool call above the value cap now records $mcp_error_code too_many_values on its errored $mcp_tool_call, through the existing ToolInputValidationError classification. Before, it was a generic "(root):custom" validation field that other checks also produce. - A request body above the 1 MiB cap increments mcp_request_body_too_large_total and logs one "[RequestBody] body too large" warning with the token cut to its last 4 characters, like the rate limiter. Before, this rejection left no signal at all. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Generated-By: PostHog Desktop Task-Id: 35d30538-8415-4552-8f25-b8bf18c75bb3

Public traffic reaches the Cloudflare worker first, and the worker read the whole body with request.clone().text() for client info before it proxied to Hono. So the Hono cap ran only after the edge had buffered the body. The worker now reads the body once within MAX_BODY_BYTES, after the token format check, and returns the same "Request body too large" JSON-RPC error above the cap. The client info parse and the proxy use the bounded body. The reader and the response move to src/lib/request-body.ts so the worker can import them; the Hono metric and log wrapper stays in src/hono. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Generated-By: PostHog Desktop Task-Id: 35d30538-8415-4552-8f25-b8bf18c75bb3

pauldambra · 2026-10-27T21:19:43Z

🤖 Automated comment from an agent, not written by a human.

Closed at the request of the PR owner. The branch posthog/zod-4-6-6 is kept, so the PR can be reopened. Open points at closing: an audit of zod 4.4 to 4.6 behaviour changes across the repo, a smoke test of the main MCP clients against the new "type": [...] schema shape, and forwarding raw bytes in the worker body cap.

pauldambra self-assigned this Oct 12, 2026

posthog Bot reviewed Oct 12, 2026

View reviewed changes

Comment thread services/mcp/tests/unit/__snapshots__/tool-schemas/insight-get.json

Comment thread pnpm-workspace.yaml Outdated

pauldambra marked this pull request as ready for review October 12, 2026 09:34

pr-assigner-resolver-posthog Bot requested a review from a team October 12, 2026 09:34

pauldambra added the security-review Request a security review label Oct 12, 2026

chatgpt-codex-connector Bot reviewed Oct 12, 2026

View reviewed changes

Comment thread services/mcp/tests/unit/__snapshots__/tool-schemas/advanced-activity-logs-list.json

pauldambra commented Oct 12, 2026

View reviewed changes

Comment thread services/mcp/tests/unit/__snapshots__/tool-schemas/action-create.json

Comment thread pnpm-workspace.yaml

posthog-security-review-bot Bot reviewed Oct 12, 2026

View reviewed changes

Comment thread pnpm-workspace.yaml Outdated

posthog-security-review-bot Bot removed the security-review Request a security review label Oct 12, 2026

posthog Bot reviewed Oct 12, 2026

View reviewed changes

Comment thread services/mcp/src/tools/exec.ts Outdated

Comment thread services/mcp/src/tools/exec.ts Outdated

tatoalo approved these changes Oct 12, 2026

View reviewed changes

posthog Bot reviewed Oct 12, 2026

View reviewed changes

Comment thread services/mcp/src/tools/exec.ts Outdated

posthog Bot reviewed Oct 12, 2026

View reviewed changes

Comment thread services/mcp/src/tools/exec.ts Outdated

langesven mentioned this pull request Oct 12, 2026

fix(ci): include frontend/plugins in the docker build context #115335

Merged

pauldambra commented Oct 12, 2026

View reviewed changes

Comment thread services/mcp/src/tools/exec.ts Outdated

Comment thread services/mcp/src/tools/exec.ts

github-actions Bot deployed to preview-pr-115271 October 12, 2026 12:57

View deployment

github-actions Bot added the feature/agent-infra Feature Tag: Agent infra label Oct 19, 2026

github-actions Bot deployed to hogbox-preview October 19, 2026 04:14

View deployment

scheduled-actions-posthog Bot added the stale label Oct 27, 2026

pauldambra force-pushed the posthog/zod-4-6-6 branch from 9535319 to 2b29130 Compare October 27, 2026 14:01

pauldambra changed the title ~~fix(deps): update zod to 4.6.6 for cve-2023-54404~~ fix(deps): update zod to 4.6.7 for cve-2023-54404 Oct 27, 2026

parameterai Bot reviewed Oct 27, 2026

View reviewed changes

Comment thread pnpm-workspace.yaml

pauldambra force-pushed the posthog/zod-4-6-6 branch from 975c36a to 7b59f78 Compare October 27, 2026 17:15

posthog Bot reviewed Oct 27, 2026

View reviewed changes

Comment thread services/mcp/src/hono/dispatcher.ts Outdated

pauldambra added 2 commits October 27, 2026 17:23

parameterai Bot reviewed Oct 27, 2026

View reviewed changes

Comment thread services/mcp/src/hono/request-utils.ts

pauldambra requested a review from a team October 27, 2026 18:06

charlesvien approved these changes Oct 27, 2026

View reviewed changes

pauldambra closed this Oct 27, 2026

Conversation

pauldambra commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Changes

How did you test this code?

Release status

Docs update

🤖 Agent context

Uh oh!

trunk-io Bot commented Oct 12, 2026

Uh oh!

posthog Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PostHog Review · Standard · reviewed 926c956

Uh oh!

github-actions Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 CI report

▶ Open the preview

Uh oh!

posthog Bot commented Oct 12, 2026

Uh oh!

Uh oh!

Uh oh!

parameterai Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

pr-assigner-resolver-posthog Bot commented Oct 12, 2026

👀 Auto-assigned reviewers

Uh oh!

trunk-io Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

posthog-security-review-bot Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

pauldambra left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

pauldambra commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Verdict: ✅ APPROVE (round 8 @ 38f9ad4)

Key findings

Convergence

Reviewer summaries

Uh oh!

posthog-security-review-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pauldambra left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

posthog Bot commented Oct 19, 2026

Uh oh!

scheduled-actions-posthog Bot commented Oct 27, 2026

Uh oh!

Uh oh!

posthog Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pauldambra commented Oct 12, 2026 •

edited

Loading

posthog Bot commented Oct 12, 2026 •

edited

Loading

PostHog Review · Standard · reviewed `926c956`

github-actions Bot commented Oct 12, 2026 •

edited

Loading

parameterai Bot commented Oct 12, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 12, 2026 •

edited

Loading

trunk-io Bot commented Oct 12, 2026 •

edited

Loading

posthog-security-review-bot Bot commented Oct 12, 2026 •

edited

Loading

pauldambra commented Oct 12, 2026 •

edited

Loading

Verdict: ✅ APPROVE _{(round 8 @ 38f9ad4)}