From 5ea43c5a90ca2f13406964d52e395624e1a0424c Mon Sep 17 00:00:00 2001
From: cb-alish <alish.sapkota@chargebee.com>
Date: Sun, 23 Aug 2026 13:13:35 +0530
Subject: [PATCH] Bump zod to 4.4.3 for prototype pollution hardening (v3.31.1)

zod 4.4.3 skips __proto__ keys on object catchall paths (colinhacks/zod#5898).
Every generated request schema in src/schema is built on z.looseObject, which is
the affected catchall variant, so pick the patch up as a precaution.

The caret range already resolved to 4.4.3 on a fresh install; this also moves the
committed lockfile off 4.3.6 so CI and contributors get the patched version.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 CHANGELOG.md       |  5 +++++
 VERSION            |  2 +-
 package-lock.json  | 12 ++++++------
 package.json       |  4 ++--
 src/environment.ts |  2 +-
 5 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2128750..146d0d9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,8 @@
+### v3.31.1 (2026-08-23)
+* * *
+### Security:
+- Bumped the [`zod`](https://www.npmjs.com/package/zod) runtime dependency from `4.3.6` to `4.4.3`, which skips `__proto__` keys on object catchall paths ([zod#5898](https://github.com/colinhacks/zod/pull/5898)). The generated request schemas in this SDK are built on `z.looseObject`, so this is picked up as a precaution. Request validation remains opt-in through `enableValidation` and is off by default, and the SDK discards the parsed result rather than sending it, so earlier releases had no known exploitable path.
+
 ### v3.31.0 (2026-08-19)
 * * *
 ### New Resources:
diff --git a/VERSION b/VERSION
index d9351e5..d23b171 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-3.31.0
+3.31.1
diff --git a/package-lock.json b/package-lock.json
index 97ee788..095fcad 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,14 +1,14 @@
 {
   "name": "chargebee",
-  "version": "3.31.0",
+  "version": "3.31.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "chargebee",
-      "version": "3.31.0",
+      "version": "3.31.1",
       "dependencies": {
-        "zod": "^4.3.6"
+        "zod": "^4.4.3"
       },
       "devDependencies": {
         "@opentelemetry/api": "^1.9.0",
@@ -1306,9 +1306,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "4.3.6",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.3.6.tgz",
-      "integrity": "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==",
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
diff --git a/package.json b/package.json
index b3b8fd1..73b1881 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "chargebee",
-  "version": "3.31.0",
+  "version": "3.31.1",
   "description": "A library for integrating with Chargebee.",
   "scripts": {
     "prepack": "npm ci && npm run build",
@@ -93,6 +93,6 @@
     "parser": "typescript"
   },
   "dependencies": {
-    "zod": "^4.3.6"
+    "zod": "^4.4.3"
   }
 }
diff --git a/src/environment.ts b/src/environment.ts
index 583ec3f..d08f457 100644
--- a/src/environment.ts
+++ b/src/environment.ts
@@ -9,7 +9,7 @@ export const Environment = {
   hostSuffix: '.chargebee.com',
   apiPath: '/api/v2',
   timeout: DEFAULT_TIME_OUT,
-  clientVersion: 'v3.31.0',
+  clientVersion: 'v3.31.1',
   port: DEFAULT_PORT,
   timemachineWaitInMillis: DEFAULT_TIME_MACHINE_WAIT,
   exportWaitInMillis: DEFAULT_EXPORT_WAIT,