PR 19716 review

rancher/dashboard PR 19716 (rak-phillip) at head e058ddd1, reviewed 2026-10-28. It bumps zod 3.24.3 → 4.6.6 in the root and shell/ manifests to clear GHSA-mrhx-c7xc-m3w5 (Dependabot alerts 1409 + 1397). It supersedes Dependabot PR 19700.

Preview: https://rancherpr19716r.mf-created-dashboard.ui.rancher.space/dashboard/, built from e058ddd1, backend mf Rancher v2.16.0.

Verdict: one should-fix before merge, then approve

The bump itself is right. No 3.x release has the fix (the advisory covers every version up to 4.6.5), so a major is the only way to close the alert. 4.6.6 was published 2026-10-11, which passes the 1-week hold. The lockfile integrity matches npm, and the provenance attestation verifies.
Should fix: the OIDC scope error lost its message. It now says Invalid input instead of The required scopes are missing: … (card 1). It's a one-spot fix in oidc.vue, which the PR doesn't touch. CI didn't catch it: that file is a plain JS <script>, so vue-tsc doesn't check it, and no unit test reads the message.
FYI: @vee-validate/zod@4.15.1 (the latest release) declares zod ^3.24.0. Two of its code paths break on zod 4. Today's forms don't use either, but the next schema that does will break (card 2).
FYI context in card 4: low real exposure (zod only runs on the user’s own form input in the browser), +11.6 KB gzip on every page, release-2.15 has the same zod and the same OIDC code, and no known extension imports zod.
Everything else behaves the same as master: the GitHub, LDAP, SAML, OIDC and namespace forms, the URL check, and the required check (card 3).

Test it yourself

The message only shows when you edit a saved Keycloak/OIDC config whose scope is missing a required scope. A new config pre-fills the required scopes and won't let you remove them. The mf Rancher has no Keycloak config, so I faked the API answer in Playwright: /v3/authconfig/keycloakoidc returns enabled: true, scope: "groups". All writes were blocked.

Open the Keycloak OIDC page on the PR or master preview, with a config that's missing openid profile email.
Click Edit Config, then Add a new row under Scopes. The red banner shows the message.

Without a browser: the PR's own oidc.test.ts setup, with oidcScope = ['something','else'] and then validateAllFields(), gives the ArrayList's effectiveValidationMessage = "Invalid input" on the PR and authConfig.oidc.scope.missingRequired… with zod 3.24.3.

Findings

The OIDC "missing required scopes" error is now just "Invalid input"

shell/edit/auth/oidc.vue:95–105 (not in the diff)

Should fix

What it's about

The scope schema passes a function as the second argument of .refine() to build the message from the missing scopes. Zod 3 supported that form. Zod 4 removed it: its param normaliser treats the function as an options object with no message/error key, so the issue falls back to zod's default text, Invalid input. No type error is raised either, because oidc.vue uses a plain <script>.

What I found

The real component under jest shows the same message as the live previews below. It's the only zod-3-only refine in the repo: I grepped shell/, pkg/ and storybook/.

master (zod 3.24.3)

Fix (tested)

Use zod 4's params form { error: (issue) => … } and compute the missing scopes from issue.input. With that change the probe gets the translated message back, and all 32 oidc.test.ts tests pass. It would be worth adding an assertion on the message to the existing "given missing required basic scopes" test, so the next zod bump can't drop it silently.

z.array(z.string()).refine(
  (arr) => requiredScopes.value?.every((s) => arr.includes(s)),
  {
    error: (issue) => {
      const arr = Array.isArray(issue.input) ? issue.input : [];
      const missing = requiredScopes.value?.filter((s) => !arr.includes(s));

      return t('authConfig.oidc.scope.missingRequired', { scopes: missing?.join(', '), count: missing?.length });
    }
  }
)

`@vee-validate/zod` is still built for zod 3

package.json:86 · shell/package.json:58

FYI

What it's about

@vee-validate/zod@4.15.1 is the last release (2025-06-07) and has peerDependencies: zod ^3.24.0. yarn install now warns has incorrect peer dependency "zod@^3.24.0". Its toTypedSchema reads zod 3 internals.

What I found (zod 3.24.3 vs 4.6.6, same adapter)

Adapter path	zod 3	zod 4	Used today?
`parse` with a failing `z.union` (`issue.unionErrors`)	errors	throws "reading 'flatMap'"	No
`cast` (runs in `useForm` setup) with a `.default()` field (`_def.defaultValue()`)	defaults	throws "not a function"	No
`describe` for flat names (`clientId`)	ok	ok	Yes
`describe` for nested/array paths (`scope[0]`)	ok	exists:false + dev warning	No

The forms in this PR are fine. I'm not asking for a change here, just a note for the next zod schema someone writes. Possible follow-ups: a comment next to zodValidators, or moving off the adapter. zod 4 implements Standard Schema, which vee-validate v5 consumes directly.

Supply chain and release notes

zod v4.6.6 / v4.6.7

FYI

The zod 4.6.6 release notes say six malicious commits were pushed to zod's main on 2026-09-21 with a compromised credential. They were reverted the same day and never published. The 4.6.6 provenance names 284243fb, and npm view confirms the same gitHead, a SLSA v1 attestation, and the same integrity as both lockfiles. 4.6.7 (2026-10-12) is a version bump only, so staying on 4.6.6 is fine.

Context for the merge decision: risk, size, backport

release-2.15 · chunk-vendors

FYI

Real exposure is low. The advisory is about memory exhaustion when a server validates a huge attacker-supplied array. Here zod only runs in the user’s own browser, on what they typed into a form. The bump mostly clears the alert rather than an exploitable path. That’s a reason not to rush the OIDC fix, not a reason to skip it.
Bundle size. zod lands in chunk-vendors, which loads on every page. For the APIs we use (object, preprocess, superRefine, url, array/refine), a minified esbuild bundle grows from 13.5 KB to 25.1 KB gzip (+11.6 KB, about 1.3% of the PR’s 911 KB gzip vendor chunk). Small, but zod 4’s zod/mini or narrower imports would shrink it if anyone cares.
release-2.15 has the same zod 3.24.3 (and @vee-validate/zod 4.15.0), plus the identical function-form .refine() in oidc.vue. Dependabot only scans master, so 2.15 has no alert. If this is backported, the OIDC fix has to go with it. 2.14 and older don’t use zod.
Extensions: zod is a dependency of @rancher/shell, so extensions that import zod without declaring it themselves would jump to zod 4 on the next shell release. GitHub code search found no extension in the rancher, harvester, kubewarden, neuvector or rancher-sandbox orgs importing zod, so I see no known breakage. Still worth a line in the shell release notes.

What was checked

Check	Result
Advisory GHSA-mrhx-c7xc-m3w5: first patched version	4.6.6, with no 3.x backport, so the major bump is needed
Release age (1-week hold)	4.6.6 published 2026-10-11, 17 days old
Alerts 1409 (yarn.lock) and 1397 (shell/yarn.lock)	both this GHSA; both manifests bumped; no other zod copy in either lockfile
CI at `e058ddd1`	38 pass, 16 skipped (type-check, unit, check-licenses, all e2e + a11y)
Jest: zod-helpers, every `shell/edit/auth` suite, namespace, ArrayList	10 suites, 228 tests pass
`zod-helpers.ts` `{ ...hasIssue }` change	same messages and paths as zod 3 (required, url, whitespace-only)
`.url()` on 17 inputs (no scheme, bad port, spaces, IDN, mailto, file, javascript, …)	same accept/reject as zod 3; issue code renamed (invalid_string → invalid_format), but our message is used
Live: GitHub Enterprise host "not a url", namespace empty name	same as master (error icon, Enable/Create disabled)
Live: OIDC missing-scope message	"Invalid input" (card 1)
Storybook zod stories (`z.custom`, `.nonempty` with a string message)	zod 4-compatible; storybook build green
Browser console during the live run	no zod/TypeError errors; only write blocked: the apps-plus extension's CRD PUT (unrelated)

Suggested review (Comment)

Preview: https://rancherpr19716r.mf-created-dashboard.ui.rancher.space/dashboard/, built from e058ddd1, backend mf Rancher v2.16.0

Thanks for picking up both manifests. The bump checks out. There's one zod 4 change outside the diff that I think needs fixing first.

Inline on shell/utils/validators/zod-helpers.ts:72

There's one more zod 4 break, outside the diff: the scope schema in shell/edit/auth/oidc.vue passes a function as the second argument of .refine(). Zod 4 dropped that form, so the "required scopes are missing" banner now just says "Invalid input" (master vs. this preview attached). vue-tsc doesn't check that file because it's a plain JS script. Switching to { error: (issue) => … } and reading the missing scopes from issue.input brings the message back, and the OIDC tests still pass. An assertion on the message in the "missing required basic scopes" test would catch this next time.

Inline on package.json:145 (non-blocking)

FYI: @vee-validate/zod 4.15.1 still declares zod ^3.24.0, and yarn warns about it. Its adapter throws on a failing z.union and on .default() fields under zod 4. Nothing in the dashboard uses those today, but it may be worth a note for whoever writes the next schema.

Cleanup

PR preview: bash preview/cleanup-branch.sh dashboard pr19716. Nothing was written to the mf Rancher.