[dielduarte]

zod below 4.6.6 can exhaust memory while validating oversized constrained collections (GHSA-mrhx-c7xc-m3w5, high). The catalog pins 4.3.6, used by @react-email/ui (bundled into the preview server) and apps/web.

Changes

• pnpm-workspace.yaml catalog: zod 4.3.6 → 4.6.7 (2026-10-12, the latest 4.6 patch; includes the 4.6.6 fix).
• pnpm-lock.yaml: re-locked. Only packages/ui and apps/web move.
• .changeset/ui-bump-zod.md: patch for @react-email/ui.

With #3834 removing zod 3 (via pkg-pr-new), this leaves no vulnerable zod in the lockfile.

Testing

Suite	Result
render	90/90
react-email	319/319
ui	113/113
editor (unit + browser)	540/540

• pnpm install --frozen-lockfile, pnpm build, pnpm typecheck, biome and scripts/check-dependency-versions.ts pass. The lockfile is stable under another pnpm install --lockfile-only.
• @react-email/ui server action: called exportSingleTemplate directly with no Resend API key (nothing reaches the network). validationErrors and the serverError fallback have the same shape as on 4.3.6.
• Preview server: email dev on apps/demo renders and hot-reloads, no page errors.
• apps/web tests: 36 passed, 68 skipped, same as canary on 4.3.6. That includes all 11 /api/send/test route tests (Resend, Supabase and rate limiters stubbed), among them the zod cases: an invalid to address and a missing field both return 400.
• apps/web API: ran next start and posted invalid bodies to /api/check-spam. Both return 400 with the ZodError issues, before any network call.

---

Summary by cubic

Bumps zod from 4.3.6 to 4.6.7 to fix a high-severity vulnerability (GHSA-mrhx-c7xc-m3w5) where zod below 4.6.6 can exhaust memory while validating oversized constrained collections.

• Updates the catalog entry in pnpm-workspace.yaml and re-locks pnpm-lock.yaml; only @react-email/ui and apps/web move.
• Adds a patch changeset for @react-email/ui.

^{Written for commit 9d91029. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
react-email	Ready	Preview	Oct 29, 2026 1:25pm UTC
react-email-demo	Ready	Preview	Oct 29, 2026 1:25pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: 9d91029

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@react-email/ui	Patch
react-email	Patch
@react-email/editor	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[klotty]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Auto-approved: Bumps zod 4.3.6 → 4.6.7 via catalog and lockfile, adding a patch changeset, to fix a high-severity memory exhaustion vulnerability. Bounded dependency update with a focused diff and test evidence.

View guided diff | Re-trigger cubic</sub>