[zahin-mohammad]

Summary

• Resolve GHSA-mrhx-c7xc-m3w5, the CVSS 8.2 Zod memory-exhaustion advisory blocking releases.
• Upgrade the dev-only Puppeteer browser-test dependency from 23.11.1 to 25.16.0, whose Chromium BiDi protocol dependency natively supports Zod 4.
• Pin Zod to patched version 4.6.7 in the root Yarn resolution and npm override.
• Remove the obsolete web3-utils resolution and override. No workspace manifest depends on it; the resolution itself was retaining web3-utils, web3-validator, and the second vulnerable Zod 3 entry in yarn.lock.
• Await Puppeteer 25 asynchronous executable discovery in the Karma browser-test configuration.

Linear: WCN-3807

Security verification

Ran OSV-Scanner 2.3.8 with the same repository configuration as release CI after rebasing onto current master:

osv-scanner scan source --config=osv-scanner.toml --format=json --output-file=<temp>/osv-results.json ./

Results:

• Zod advisory findings: 0
• Advisory groups at or above CVSS 7.0: 0 of 38
• Lockfile Zod versions: 4.6.7 only

Verification

• yarn install --frozen-lockfile --ignore-scripts --non-interactive — passed
• yarn check-deps — passed
• yarn prettier --check package.json modules/bitgo/package.json modules/bitgo/karma.conf.js — passed
• yarn eslint modules/bitgo/karma.conf.js — passed
• yarn workspace bitgo build — passed
• yarn workspace bitgo compile-test — passed
• yarn workspace bitgo browser-test — 2 tests passed on Chrome Headless 156 before and after the rebase

Risk

Puppeteer crosses two major versions, but it is a dev-only dependency used here only to locate Chrome for Karma. The affected browser build and full browser test suite pass with the new asynchronous API.

[linear-code]

WCN-3807

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[github-actions]

⚠️ Unit tests are failing on Node 26.x (Current release line, non-blocking). This is not an LTS version yet, so it does not block merge, but it signals an incompatibility to fix before Node 26.x becomes LTS.

View run

[zahin-mohammad]

@claude review

[github-actions]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[claude]

Code review found no issues

No high-confidence issues detected in this change.

[s84krish]

lgtm:

Upgrading Puppeteer to 25 removes the only sources of the vulnerable zod
(chromium-bidi@0.11.0 and web3-validator via web3-utils), and 
the exact zod@4.6.7 pin keeps a re-resolve from falling back
to 4.6.5. The async karma.conf.js is correct for Karma 6.4.4, which 
accepts a promise-returning config.

 Two non-blocking notes:
 - Puppeteer 25 requires Node >=22.12, while root engines says >=22. This is fine for CI, but the floor could be raised.
 - The extract-zip reasons in osv-scanner.toml still mention @puppeteer/browsers, which no longer pulls it in. Only Cypress does now.

[zahin-mohammad]

• Puppeteer 25 requires Node >=22.12, while root engines says >=22. This is fine for CI, but the floor could be raised.

• Puppeteer 25 requires Node >=22.12, while root engines says >=22. This is fine for CI, but the floor could be raised.

floor will be raised next week anyways when we deprecate node 22