Bump zod to 4.4.3 for prototype pollution hardening (v3.31.1)

CHANGELOG.md

@@ -1,3 +1,8 @@
+### v3.31.1 (2026-08-23)
+* * *
+### Security:
+- Bumped the [`zod`](https://www.npmjs.com/package/zod) runtime dependency from `4.3.6` to `4.4.3`, which skips `__proto__` keys on object catchall paths ([zod#5898](https://github.com/colinhacks/zod/pull/5898)). The generated request schemas in this SDK are built on `z.looseObject`, so this is picked up as a precaution. Request validation remains opt-in through `enableValidation` and is off by default, and the SDK discards the parsed result rather than sending it, so earlier releases had no known exploitable path.
+
 ### v3.31.0 (2026-08-19)
 * * *
 ### New Resources:

VERSION

@@ -1 +1 @@
-3.31.0
+3.31.1

package.json

@@ -1,6 +1,6 @@
 {
   "name": "chargebee",
-  "version": "3.31.0",
+  "version": "3.31.1",
   "description": "A library for integrating with Chargebee.",
   "scripts": {
     "prepack": "npm ci && npm run build",
@@ -93,6 +93,6 @@
     "parser": "typescript"
   },
   "dependencies": {
-    "zod": "^4.3.6"
+    "zod": "^4.4.3"
   }
 }

src/environment.ts

@@ -9,7 +9,7 @@ export const Environment = {
   hostSuffix: '.chargebee.com',
   apiPath: '/api/v2',
   timeout: DEFAULT_TIME_OUT,
-  clientVersion: 'v3.31.0',
+  clientVersion: 'v3.31.1',
   port: DEFAULT_PORT,
   timemachineWaitInMillis: DEFAULT_TIME_MACHINE_WAIT,
   exportWaitInMillis: DEFAULT_EXPORT_WAIT,