fix(deps): update dependency valibot to v1.2.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
valibot (source)	1.1.0 → 1.2.0

---

Valibot has a ReDoS vulnerability in EMOJI_REGEX

CVE-2025-66020 / GHSA-vqpr-j7v3-hqw9

More information

Details

Summary

The EMOJI_REGEX used in the emoji action is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. A short, maliciously crafted string (e.g., <100 characters) can cause the regex engine to consume excessive CPU time (minutes), leading to a Denial of Service (DoS) for the application.

Details

The ReDoS vulnerability stems from "catastrophic backtracking" in the EMOJI_REGEX. This is caused by ambiguity in the regex pattern due to overlapping character classes.

Specifically, the class \p{Emoji_Presentation} overlaps with more specific classes used in the same alternation, such as [\u{1F1E6}-\u{1F1FF}] (regional indicator symbols used for flags) and \p{Emoji_Modifier_Base}.

When the regex engine attempts to match a string that almost matches but ultimately fails (like the one in the PoC), this ambiguity forces it to explore an exponential number of possible paths. The matching time increases exponentially with the length of the crafted input, rather than linearly.

PoC

The following code demonstrates the vulnerability.

import * as v from 'valibot';

const schema = v.object({
  x: v.pipe(v.string(), v.emoji()),
});

const attackString = '\u{1F1E6}'.repeat(49) + '0';

console.log(`Input length: ${attackString.length}`);
console.log('Starting parse... (This will take a long time)');

// On my machine, a length of 99 takes approximately 2 minutes.
console.time();
try {
  v.parse(schema, {x: attackString });
} catch (e) {}
console.timeEnd();

Impact

Any project using Valibot's emoji validation on user-controllable input is vulnerable to a Denial of Service attack.

An attacker can block server resources (e.g., a web server's event loop) by submitting a short string to any endpoint that uses this validation. This is particularly dangerous because the attack string is short enough to bypass typical input length restrictions (e.g., maxLength(100)).

Recommended Fix

The root cause is the overlapping character classes. This can be resolved by making the alternatives mutually exclusive, typically by using negative lookaheads ((?!...)) to subtract the specific classes from the more general one.

The following modified EMOJI_REGEX applies this principle:

export const EMOJI_REGEX: RegExp =
  // eslint-disable-next-line redos-detector/no-unsafe-regex, regexp/no-dupe-disjunctions -- false positives
  /^(?:[\u{1F1E6}-\u{1F1FF}]{2}|\u{1F3F4}[\u{E0061}-\u{E007A}]{2}[\u{E0030}-\u{E0039}\u{E0061}-\u{E007A}]{1,3}\u{E007F}|(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|(?![\p{Emoji_Modifier_Base}\u{1F1E6}-\u{1F1FF}])\p{Emoji_Presentation})(?:\u200D(?:\p{Emoji}\uFE0F\u20E3?|\p{Emoji_Modifier_Base}\p{Emoji_Modifier}?|(?![\p{Emoji_Modifier_Base}\u{1F1E6}-\u{1F1FF}])\p{Emoji_Presentation}))*)+$/u;

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/open-circle/valibot/security/advisories/GHSA-vqpr-j7v3-hqw9
• https://nvd.nist.gov/vuln/detail/CVE-2025-66020
• https://github.com/open-circle/valibot/commit/cfb799db301a953a0950d5c05a34a3ab121262dc
• https://github.com/advisories/GHSA-vqpr-j7v3-hqw9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

open-circle/valibot (valibot)

v1.2.0

Compare Source

Many thanks to @​EskiMojo14, @​makenowjust, @​ysknsid25 and @​jacekwilczynski for contributing to this release.

Read the release notes on our website for a quick overview of the most exciting new features in this release.

• Add toBigint, toBoolean, toDate, toNumber and toString transformation actions (pull request #​1212)
• Add examples action to add example values to a schema (pull request #​1199)
• Add getExamples method to extract example values from a schema (pull request #​1199)
• Add isbn validation action to validate ISBN-10 and ISBN-13 strings (pull request #​1097)
• Add exports for RawCheckAddIssue, RawCheckContext, RawCheckIssueInfo, RawTransformAddIssue, RawTransformContext and RawTransformIssueInfo types for better developer experience with rawCheck and rawTransform actions (pull request #​1359)
• Change build step to tsdown
• Fix ReDoS vulnerability in EMOJI_REGEX used by emoji action

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
liam-app	Ready	Preview, Comment	Jul 12, 2026 1:20pm
liam-assets	Ready	Preview, Comment	Jul 12, 2026 1:20pm
liam-docs	Ready	Preview, Comment	Jul 12, 2026 1:20pm
liam-erd-sample	Ready	Preview, Comment	Jul 12, 2026 1:20pm
liam-storybook	Ready	Preview, Comment	Jul 12, 2026 1:20pm

[giselles-ai]

Finished running flow.

Step 1
🟢	On Pull Request Opened Status: Success Updated: Nov 30, 2025 4:06pm
Step 2
🟢	openai/gpt-5 Status: Success Updated: Nov 30, 2025 4:07pm
Step 3
🟢	Create Pull Request Comment Status: Success Updated: Nov 30, 2025 4:07pm

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[giselles-ai]

Check changeset necessity

Status: REQUIRED

Reason:

• Updates valibot dependency across several packages, including target packages: @liam-hq/cli, @liam-hq/erd-core, and @liam-hq/schema.
• The update includes a security fix (ReDoS in emoji validator) and new features, which are user-facing behavioral changes.
• Even if code changes are dependency-only, consumers of these packages may observe behavior differences in validation and performance.
• Ignored packages (e.g., @liam-hq/agent, @liam-hq/db, @liam-hq/github, @liam-hq/schema-bench) do not require changesets, but target packages do.

Changeset (copy & paste):

---
"@liam-hq/cli": patch
"@liam-hq/erd-core": patch
"@liam-hq/schema": patch
---
- 🐛 Update valibot to v1.2.0 with security fix and improvements
  - Bump valibot from 1.1.0 to 1.2.0 to address ReDoS in `emoji` validator and include upstream enhancements

[github-actions]

🤖 Agent Deep Modeling Execution

Started at: 2026-07-12 13:19:17 UTC

View Details

Command Output

@liam-hq/agent@0.1.0 execute-deep-modeling /home/runner/work/liam/liam/frontend/internal-packages/agent
pnpm test:integration src/createGraph.integration.test.ts

@liam-hq/agent@0.1.0 test:integration /home/runner/work/liam/liam/frontend/internal-packages/agent
vitest --watch=false --passWithNoTests --config vitest.config.integration.ts src/createGraph.integration.test.ts

RUN v3.2.4 /home/runner/work/liam/liam/frontend/internal-packages/agent

(node:7712) ExperimentalWarning: WASI is an experimental feature and might change at any time
(Use node --trace-warnings ... to show where the warning was created)

✅ [INFO] 2026-07-12T13:19:19.600Z
LangSmith Trace URL: https://smith.langchain.com/o/eed4d2d8-0bd8-4ca4-a452-4da88ef63fd6/projects/p/9324fe51-27a4-4604-a52b-c6cc240f6dcc?searchModel=%7B%22filter%22%3A%22and(eq(is_root%2C%20true)%2C%20and(eq(metadata_key%2C%20%5C%22thread_id%5C%22)%2C%20eq(metadata_value%2C%20%5C%2208052d9e-50e3-40c5-b7e5-278beb605786%5C%22)))%22%7D
stderr | src/createGraph.integration.test.ts > createGraph Integration > should execute complete workflow
Failed to Failed to send multipart request. Received status [403]: Forbidden. Message:

Context: trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=1c1c8a16-c8ef-438c-9d1b-be52e32eca15; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=8b06e3da-a9d6-4989-bfb0-c139f81a7acc; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=db6ec647-53aa-40b5-81d9-e1236652dc21; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=065e19fd-6563-46a7-8bff-10a16f0ac14d; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=4bb58d66-661d-444b-905d-92c644953d79; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=d36eecc9-b853-42f9-afeb-2760d6272f03; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=6c768b68-2ef1-456a-a335-63c973c73ba9; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=b0c356dd-3ceb-49f0-b832-d179d9a395b4; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=cf0c0578-287c-490c-845d-009df98d4b7a; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=2b38ad55-928c-41f0-b2ad-7d27370c4828; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=c56620f7-b694-41f1-810c-0ae2de8d5687; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=0fbf5cd0-9614-4be7-8cb9-55524fc9a255; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=c506224c-57fa-40f2-b392-8cb9528fe9b6; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=ae5752af-5b30-4372-9be9-bba86ef29a8f; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=7bc4a621-017e-4fb8-9617-4dbc5f6e0ca5; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=25dd04b5-2cb6-4715-a4d4-b213f4c9d7d1; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=a2eebc29-d2f9-45b4-998e-08c19526bbcb; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=9107483d-63d4-4e18-80ee-b41a6f7e4b58; trace=7e1bde3f-e9d0-4b84-a595-4e9e4aa3ce28,id=2e897cd7-921c-4f63-b1b0-d55a5f16dc63

x

⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯

FAIL src/createGraph.integration.test.ts > createGraph Integration > should execute complete workflow
WorkflowTerminationError: Error in analyzeRequirementsNode: 401 Incorrect API key provided: sk-proj-********************************************************************************************************************************************************N7kA. You can find your API key at https://platform.openai.com/account/api-keys.

Troubleshooting URL: https://js.langchain.com/docs/troubleshooting/errors/MODEL_AUTHENTICATION/

❯ RunnableCallable.analyzeRequirementsNode [as func] src/pm-agent/nodes/analyzeRequirementsNode.ts:38:11
36|
37| if (analysisResult.isErr()) {
38| throw new WorkflowTerminationError(
| ^
39| analysisResult.error,
40| 'analyzeRequirementsNode',
❯ RunnableCallable.invoke ../../../node_modules/.pnpm/@langchain+langgraph@0.4.9_@langchain+core@0.3.78_@opentelemetry+api@1.9.0_@opentelemet_cd940287faf0db93d41d5fc1f29067cc/node_modules/@langchain/langgraph/src/utils.ts:85:21
❯ RunnableSequence.invoke ../../../node_modules/.pnpm/@langchain+core@0.3.78_@opentelemetry+api@1.9.0_@opentelemetry+sdk-trace-base@2.2.0_@op_0a8880fa2f45d0308ed941fc53f9c9f1/node_modules/@langchain/core/dist/runnables/base.js:1308:33
❯ runWithRetry ../../../node_modules/.pnpm/@langchain+langgraph@0.4.9@langchain+core@0.3.78_@opentelemetry+api@1.9.0_@opentelemet_cd940287faf0db93d41d5fc1f29067cc/node_modules/@langchain/langgraph/src/pregel/retry.ts:103:16
❯ PregelRunner.executeTasksWithRetry ../../../node_modules/.pnpm/@langchain+langgraph@0.4.9@langchain+core@0.3.78_@opentelemetry+api@1.9.0_@opentelemet_cd940287faf0db93d41d5fc1f29067cc/node_modules/@langchain/langgraph/src/pregel/runner.ts:330:27
❯ PregelRunner.tick ../../../node_modules/.pnpm/@langchain+langgraph@0.4.9_@langchain+core@0.3.78_@opentelemetry+api@1.9.0_@opentelemet_cd940287faf0db93d41d5fc1f29067cc/node_modules/@langchain/langgraph/src/pregel/runner.ts:138:50
❯ CompiledStateGraph.runLoop ../../../node_modules/.pnpm/@langchain+langgraph@0.4.9@langchain+core@0.3.78_@opentelemetry+api@1.9.0_@opentelemet_cd940287faf0db93d41d5fc1f29067cc/node_modules/@langchain/langgraph/src/pregel/index.ts:2233:9
❯ createAndRunLoop ../../../node_modules/.pnpm/@langchain+langgraph@0.4.9_@langchain+core@0.3.78_@opentelemetry+api@1.9.0_@opentelemet_cd940287faf0db93d41d5fc1f29067cc/node_modules/@langchain/langgraph/src/pregel/index.ts:2092:9

⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/1]⎯

Test Files 1 failed (1)
Tests 1 failed (1)
Start at 13:19:17
Duration 2.24s (transform 483ms, setup 0ms, collect 1.41s, tests 598ms, environment 0ms, prepare 68ms)

 ELIFECYCLE  Command failed with exit code 1.
/home/runner/work/liam/liam/frontend/internal-packages/agent:
 ERR_PNPM_RECURSIVE_RUN_FIRST_FAIL  @liam-hq/agent@0.1.0 execute-deep-modeling: pnpm test:integration src/createGraph.integration.test.ts
Exit status 1