Bump zod to 4.4.3 for prototype pollution hardening (v3.31.1)

[cb-alish]

Summary

Patch release that moves the zod runtime dependency from 4.3.6 to 4.4.3, which skips __proto__ keys on object catchall paths.

Every generated request schema in src/schema is built on z.looseObject, the catchall variant the fix touches, so we pick the patch up as a precaution.

Scope of the actual exposure

Worth being precise here, since the advisory sounds worse than what applies to this SDK:

• Request validation is opt-in via enableValidation and is off by default, so zod never parses params unless an integrator turns it on.
• Even when enabled, RequestWrapper._validateParams only reads result.success and discards result.data. The original params object is what gets serialized and sent, so a poisoned parse output never reaches the request.

Prior releases therefore had no known exploitable path. This is dependency hygiene and defense in depth, not a fix for a live hole.

Because the range was already a caret, fresh installs were resolving to 4.4.3 anyway. The meaningful part of this change is moving the committed lockfile off 4.3.6 so CI and contributors get the patched version.

Changes

• package.json / package-lock.json: zod ^4.3.6 -> ^4.4.3
• VERSION, package.json, package-lock.json, src/environment.ts: 3.31.0 -> 3.31.1 (via make increment-patch)
• CHANGELOG.md: v3.31.1 entry under a Security: heading

Test plan

• npm run build succeeds
• npm test — 135 passing
• Verified the hardening directly: parsing {"id":"cus_1","__proto__":{...}} through a z.looseObject schema drops the key, leaves the output prototype as Object.prototype, and does not pollute {}
• End-to-end against a live test site with enableValidation: true:
  • real customer.list({ limit: 2 }) returned HTTP 200 with live records
  • limit: 500 correctly rejected pre-flight with ChargebeeZodValidationError (limit Too big: expected number to be <=100)
  • params carrying an own __proto__ key completed a full request cycle with ({}).polluted still undefined

Notes for the reviewer

• No source changes beyond the generated clientVersion bump, so no behavioral change to the SDK itself.
• Publishing is driven by pushing a v3* tag, not by merging this PR — a v3.31.1 tag still needs to be pushed after merge.
• Dependabot flags remaining advisories on master; those I looked at are all transitive devDependencies under mocha (brace-expansion, js-yaml, minimatch, picomatch, serialize-javascript). Since zod is the only runtime dependency, they do not reach consumers of the published package. Clearing them requires a breaking mocha bump, so I left it out to keep this release focused.

Made with Cursor

Updates zod to 4.4.3 for __proto__ hardening and refreshes the lockfile. Bumps the SDK to 3.31.1, updates Environment.clientVersion, and adds a security changelog entry. Validation reports 135 passing tests.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: e1e79292-299a-40a2-8348-256e532dda00

📥 Commits

Reviewing files that changed from the base of the PR and between 31f906a and 5ea43c5.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (4)

• CHANGELOG.md
• VERSION
• package.json
• src/environment.ts

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The release updates the SDK version to 3.31.1, upgrades zod to 4.4.3, updates the runtime client version, and adds a changelog entry describing validation safeguards.

Changes

Release version and dependency update

Layer / File(s)	Summary
Version and dependency alignment package.json, VERSION, src/environment.ts, CHANGELOG.md	The package and runtime versions change to 3.31.1. The zod dependency changes to 4.4.3. The changelog records the dependency update and validation behavior.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 5ea43

This change updates the locked zod version and release metadata without altering SDK request behavior; no actionable merge-blocking risk remains after normal checks.

Suggested reviewers: cb-karthikp

🚥 Pre-merge checks | ✅ 1

✅ Passed checks (1 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.

---

_{Comment @coderabbitai help to get the list of available commands.}