chore(deps): bump zod from 3.25.76 to 4.4.3 in /vmark-mcp-server - #1037
Closed
dependabot[bot] wants to merge 2 commits into
Closed
dependabot[bot] wants to merge 2 commits into
dependabot[bot] wants to merge 2 commits into
Conversation
Bumps [zod](https://github.com/colinhacks/zod) from 3.25.76 to 4.4.3. - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v3.25.76...v4.4.3) --- updated-dependencies: - dependency-name: zod dependency-version: 4.4.3 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Dependabot bumped vmark-mcp-server's zod to ^4.4.3 in package.json but did not regenerate the workspace pnpm-lock.yaml, so `pnpm install --frozen-lockfile` (every CI job's first step) failed. Regenerate the lock, and fix the one zod 4 breaking change — z.record() now requires an explicit key type (z.record(z.string(), z.unknown())). mcp-server builds, lints, and all 185 sidecar tests pass.
Owner
|
Superseded by #1062, which performs this upgrade correctly (with the required code migration) and is verified green. Closing to avoid a duplicate bump. |
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/vmark-mcp-server/zod-4.4.3
branch
June 27, 2026 01:53
xiaolai
added a commit
that referenced
this pull request
Jun 27, 2026
…h, done correctly) (#1062) * chore(deps): upgrade rust-i18n 3→4, dirs 5→6, toml 0.8→0.9 All three are drop-in for VMark's usage — verified locally with `cargo check` + 728 passing tests: - rust-i18n 4: the 3→4 breaking changes are all trait-level (custom Backend impls + the dropped once_cell re-export). We use only the i18n!/t! macros and set_locale, which are unchanged. MSRV 1.80 is satisfied. - dirs 6: home_dir() is unchanged (our only call); we never use config_dir, so its macOS churn is irrelevant. - toml 0.9: we parse into toml::Table (not Value, sidestepping the FromStr-now-parses-values break) and use to_string_pretty (signature unchanged). Resolves to 0.9.10 — the +spec-1.1.0 suffix is build metadata on the published 0.9.10, not a separate preview track. Completes the intent of dependabot #1044 / #1042 / #1043, which failed as blind bumps, done correctly with verification. * chore(deps): upgrade JS majors — i18next 26, lucide-react 1, zod 4 (mcp), react-i18next 16.6 Done correctly with the code migrations dependabot's blind bumps couldn't do. Verified with the full `pnpm check:all` (tsc, lint, sidecar + content-server tests, build, coverage, size). - i18next 25 → 26: `initImmediate` was removed; renamed back to `initAsync` (same semantics). src/i18n.ts updated. react-i18next bumped 16.5 → 16.6 (peer `>= 25.10.9` admits i18next 26). - lucide-react 0.562 → 1.x: v1 removed all brand icons. AboutSettings imported the now-removed `Github`, so it ships the GitHub mark as a local inline SVG (GithubMark.tsx) matching the lucide render contract. All other 74 icons resolve unchanged. Settings-page size limit nudged 94 → 95 kB for the SVG. - zod 3 → 4 (vmark-mcp-server): single-arg `z.record()` was removed; cli.ts now passes an explicit key schema (`z.record(z.string(), z.unknown())`). The MCP SDK 1.27.1 peers `^3.25 || ^4.0`, so zod 4 is accepted. Completes the intent of dependabot #1052 / #1046 / #1037 / #1047. * chore(deps): dev-tooling majors (vite-plugin-react 5, react-hooks 7, globals 17) + cargo minor/patch group Verified with full `pnpm check:all` (lint, build, coverage, sidecar, content-server, size) + `cargo check` + 728 Rust tests. - @vitejs/plugin-react 4 → 5, globals 16 → 17: drop-in (dev/build only, no bundle impact). Replaces #1048, #1054. - eslint-plugin-react-hooks 5 → 7: v7 folded the React Compiler rule set into `recommended`, flagging 67 pre-existing sites (set-state-in-effect, refs, manual-memoization, immutability). Adopting those is a deliberate codebase refactor, not a version bump — so they're deferred in eslint.config.js (documented) to preserve the prior enforcement level, and exhaustive-deps is pinned to its historical `warn`. Replaces #1050. - cargo minor/patch updates within semver (`cargo update`): reproduces the cargo-minor-patch group (#1040), which failed as a blind bump against a stale base. Compiles clean + all Rust tests pass. Note: the root npm minor/patch group (#1045) is intentionally NOT swept in here — it carries a mermaid 11.12→11.16 (+~800 kB lazy chunk) and tiptap 3.18→3.27 growth that trips the size gate and warrants a separate, conscious decision rather than an automatic limit bump. Left to dependabot. * chore(deps): npm minor/patch sweep (root + mcp + content-server) `pnpm update -r` within semver — reproduces the dependabot minor/patch groups #1045 (root), #1036 (mcp), and #1051 (@eslint/js) as one verified change. Full `pnpm check:all` green. - Size growth accepted (approved): mermaid 11.12 → 11.16 (+~800 kB, lazy chunk — never in cold start) and tiptap 3.18 → 3.27 (+18 kB eager). Both size-limit ceilings bumped with documented reasons in .size-limit.cjs. - schema.ts: vscode-languageserver-types reached LSP 3.18, which widened Diagnostic.message to `string | MarkupContent`; flatten MarkupContent to its text via a messageText() helper. Completes #1045 / #1036 / #1051. * docs(eslint): link react-hooks-7 rule deferral to tracking issue #1063 * fix(deps): reconcile pnpm-lock with dompurify override so --frozen-lockfile passes The minor/patch sweep left pnpm-lock.yaml frozen-inconsistent: the direct dompurify dep (^3.4.11) and the pnpm.overrides entry (>=3.3.2) disagreed in a way non-frozen install tolerates but CI's --frozen-lockfile rejects (ERR_PNPM_OUTDATED_LOCKFILE). Plain pnpm install reconciles it. check:all green. * fix(knip): re-add mermaid + vitepress to website ignore lists The minor/patch sweep shifted node_modules hoisting enough that knip (on a clean --frozen-lockfile install, as CI runs) can no longer statically trace the website's mermaid usage (rendered via vitepress's component system) or resolve the `vitepress` binary — flagging both as error-level (Unused devDependencies / Unlisted binaries). Both are genuinely used; the earlier gate-fix removed these ignore entries as "stale," but they're load-bearing across hoisting states. Verified with a clean install + full check:all.
xiaolai
added a commit
that referenced
this pull request
Aug 12, 2026
…h, done correctly) (#1062) * chore(deps): upgrade rust-i18n 3→4, dirs 5→6, toml 0.8→0.9 All three are drop-in for VMark's usage — verified locally with `cargo check` + 728 passing tests: - rust-i18n 4: the 3→4 breaking changes are all trait-level (custom Backend impls + the dropped once_cell re-export). We use only the i18n!/t! macros and set_locale, which are unchanged. MSRV 1.80 is satisfied. - dirs 6: home_dir() is unchanged (our only call); we never use config_dir, so its macOS churn is irrelevant. - toml 0.9: we parse into toml::Table (not Value, sidestepping the FromStr-now-parses-values break) and use to_string_pretty (signature unchanged). Resolves to 0.9.10 — the +spec-1.1.0 suffix is build metadata on the published 0.9.10, not a separate preview track. Completes the intent of dependabot #1044 / #1042 / #1043, which failed as blind bumps, done correctly with verification. * chore(deps): upgrade JS majors — i18next 26, lucide-react 1, zod 4 (mcp), react-i18next 16.6 Done correctly with the code migrations dependabot's blind bumps couldn't do. Verified with the full `pnpm check:all` (tsc, lint, sidecar + content-server tests, build, coverage, size). - i18next 25 → 26: `initImmediate` was removed; renamed back to `initAsync` (same semantics). src/i18n.ts updated. react-i18next bumped 16.5 → 16.6 (peer `>= 25.10.9` admits i18next 26). - lucide-react 0.562 → 1.x: v1 removed all brand icons. AboutSettings imported the now-removed `Github`, so it ships the GitHub mark as a local inline SVG (GithubMark.tsx) matching the lucide render contract. All other 74 icons resolve unchanged. Settings-page size limit nudged 94 → 95 kB for the SVG. - zod 3 → 4 (vmark-mcp-server): single-arg `z.record()` was removed; cli.ts now passes an explicit key schema (`z.record(z.string(), z.unknown())`). The MCP SDK 1.27.1 peers `^3.25 || ^4.0`, so zod 4 is accepted. Completes the intent of dependabot #1052 / #1046 / #1037 / #1047. * chore(deps): dev-tooling majors (vite-plugin-react 5, react-hooks 7, globals 17) + cargo minor/patch group Verified with full `pnpm check:all` (lint, build, coverage, sidecar, content-server, size) + `cargo check` + 728 Rust tests. - @vitejs/plugin-react 4 → 5, globals 16 → 17: drop-in (dev/build only, no bundle impact). Replaces #1048, #1054. - eslint-plugin-react-hooks 5 → 7: v7 folded the React Compiler rule set into `recommended`, flagging 67 pre-existing sites (set-state-in-effect, refs, manual-memoization, immutability). Adopting those is a deliberate codebase refactor, not a version bump — so they're deferred in eslint.config.js (documented) to preserve the prior enforcement level, and exhaustive-deps is pinned to its historical `warn`. Replaces #1050. - cargo minor/patch updates within semver (`cargo update`): reproduces the cargo-minor-patch group (#1040), which failed as a blind bump against a stale base. Compiles clean + all Rust tests pass. Note: the root npm minor/patch group (#1045) is intentionally NOT swept in here — it carries a mermaid 11.12→11.16 (+~800 kB lazy chunk) and tiptap 3.18→3.27 growth that trips the size gate and warrants a separate, conscious decision rather than an automatic limit bump. Left to dependabot. * chore(deps): npm minor/patch sweep (root + mcp + content-server) `pnpm update -r` within semver — reproduces the dependabot minor/patch groups #1045 (root), #1036 (mcp), and #1051 (@eslint/js) as one verified change. Full `pnpm check:all` green. - Size growth accepted (approved): mermaid 11.12 → 11.16 (+~800 kB, lazy chunk — never in cold start) and tiptap 3.18 → 3.27 (+18 kB eager). Both size-limit ceilings bumped with documented reasons in .size-limit.cjs. - schema.ts: vscode-languageserver-types reached LSP 3.18, which widened Diagnostic.message to `string | MarkupContent`; flatten MarkupContent to its text via a messageText() helper. Completes #1045 / #1036 / #1051. * docs(eslint): link react-hooks-7 rule deferral to tracking issue #1063 * fix(deps): reconcile pnpm-lock with dompurify override so --frozen-lockfile passes The minor/patch sweep left pnpm-lock.yaml frozen-inconsistent: the direct dompurify dep (^3.4.11) and the pnpm.overrides entry (>=3.3.2) disagreed in a way non-frozen install tolerates but CI's --frozen-lockfile rejects (ERR_PNPM_OUTDATED_LOCKFILE). Plain pnpm install reconciles it. check:all green. * fix(knip): re-add mermaid + vitepress to website ignore lists The minor/patch sweep shifted node_modules hoisting enough that knip (on a clean --frozen-lockfile install, as CI runs) can no longer statically trace the website's mermaid usage (rendered via vitepress's component system) or resolve the `vitepress` binary — flagging both as error-level (Unused devDependencies / Unlisted binaries). Both are genuinely used; the earlier gate-fix removed these ignore entries as "stale," but they're load-bearing across hoisting states. Verified with a clean install + full check:all.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps zod from 3.25.76 to 4.4.3.
Release notes
Sourced from zod's releases.
... (truncated)
Commits
1fb56a5docs: document release procedure in AGENTS.mdf3c9ec04.4.3c2be4f8fix(v4): generalize optin/fallback to transform; restore preprocess on absent...1cab693fix(v4): restore catch handling for absent object keys (#5937) (#5939)b8dffe9docs: remove Numeric and Speakeasy (2+ missed monthly cycles)9195250docs: remove Mintlify from bronze sponsors (churned)2c70332docs: normalize bronze sponsor logos to github avatar pattern7391be8docs: prune lapsed silver/bronze sponsors and add active ones2aeec83docs: prune lapsed gold sponsors and rebalance logo sizing4c2fa95docs: use Zernio primary wordmark for gold sponsor logoMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)