Zod Maintainer Rejects v3 CVE Backport Over Agent-Generated Advisory

The maintainer of the TypeScript validation library Zod declined to backport a CVE fix to version 3, pointing out that the advisory originated from an AI agent. As automated tools increasingly audit repositories and churn out synthetic vulnerability notices en masse, maintainers are facing a steep rise in review fatigue. The decision highlights emerging friction in open-source governance as automated agent outputs meet unpaid human labor.