[vvillait88]

Summary

Removes the zod 3.25.76 entry from osv-scanner.toml. Its own lift condition ("Lift when the x402 packages accept zod 4") is met: the x402 packages depend on zod 4 from 2.29.0, and the lock now holds a single zod, 4.6.7. The entry matched nothing, so it was suppressing nothing. The file keeps its header so the scanner config stays in place.

Worked with: Varun.

Not done: nothing else in the allowlist; this was its only entry.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None.

Test plan

• osv-scanner scan source --lockfile bun.lock --config osv-scanner.toml: 609 packages, no issues.
• The same scan with an empty config before the change: also no issues, which is what showed the entry was unused.
• No code changed, so no release.

Checklist

• Tests cover the new behavior, and the suite passes locally (no behavior change; the scan is the check)
• Lint, format, and type checks pass (no source touched; the pre-commit hook had nothing to inspect)
• Docs and README examples updated if the public surface changed (not changed)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review (head 7b78382)

Verdict: approve. I checked each claim against the lock, the registry and the scanner, and all of them hold. I found no defects.

Lift condition is met

• Lock: @x402/core@2.29.0 and @x402/evm@2.29.0 both declare "zod": "^4.6.6" in bun.lock.
• Registry: npm view @x402/core dependencies.zod and npm view @x402/evm dependencies.zod both return ^4.6.6 for the latest release, 2.29.0.
• Installed tree: neither package has a nested node_modules, so they resolve the hoisted copy.

Lock holds only zod 4.6.7

• grep -cE '"zod@[0-9]' bun.lock returns 1, the root key "zod": ["zod@4.6.7"], and there are no nested */zod keys.
• Every other zod consumer (incur, mppx, knip, @modelcontextprotocol/server, abitype) is a 4.x range or ^3 || ^4.
• The PR does not touch bun.lock, so main is already in this state.

Scan is clean with and without the entry (osv-scanner 2.7.0)

Run	Packages	Result
PR config	609	"No issues found", exit 0
main's config, with the zod entry	609	"No issues found", exit 0
Positive control: lock copy with zod rewritten to 3.25.76, PR config	609	exit 1, reports GHSA-mrhx-c7xc-m3w5 / zod 3.25.76 / fixed 4.6.6

The positive control shows the scanner does detect this advisory against this lock and config, so the clean result above is meaningful.

Other checks

• CI: the Dependency Scan job runs osv-scanner scan source --lockfile=bun.lock with no --config. The scanner picks up osv-scanner.toml from the lockfile's directory, so the job runs the same check I ran locally.
• Remaining config file: only the header comment is left. The scanner parses it cleanly.
• PR checks: all 9 pass.