From 2b41521506075c46dc1e08d84a449c708c698b62 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 16 Jun 2026 23:00:22 +0000 Subject: [PATCH 1/2] chore(deps): bump zod from 3.25.76 to 4.4.3 in /vmark-mcp-server Bumps [zod](https://github.com/colinhacks/zod) from 3.25.76 to 4.4.3. - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](https://github.com/colinhacks/zod/compare/v3.25.76...v4.4.3) --- updated-dependencies: - dependency-name: zod dependency-version: 4.4.3 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- vmark-mcp-server/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vmark-mcp-server/package.json b/vmark-mcp-server/package.json index 49cc3cc88..fa135302c 100644 --- a/vmark-mcp-server/package.json +++ b/vmark-mcp-server/package.json @@ -32,7 +32,7 @@ "dependencies": { "@modelcontextprotocol/sdk": "^1.27.1", "ws": "^8.18.0", - "zod": "^3.24.0" + "zod": "^4.4.3" }, "devDependencies": { "@types/node": "^22.14.0", From ca4872b480a9e9c73d101ca8cbc44338dfbbaa1a Mon Sep 17 00:00:00 2001 From: xiaolai Date: Sat, 20 Jun 2026 16:45:41 +0800 Subject: [PATCH 2/2] fix(mcp-server): regenerate lockfile + adapt z.record for zod 4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependabot bumped vmark-mcp-server's zod to ^4.4.3 in package.json but did not regenerate the workspace pnpm-lock.yaml, so `pnpm install --frozen-lockfile` (every CI job's first step) failed. Regenerate the lock, and fix the one zod 4 breaking change — z.record() now requires an explicit key type (z.record(z.string(), z.unknown())). mcp-server builds, lints, and all 185 sidecar tests pass. --- pnpm-lock.yaml | 32 +++++++++++++++++++++++++++++--- vmark-mcp-server/src/cli.ts | 3 ++- 2 files changed, 31 insertions(+), 4 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 34bb9ba5c..38e595462 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -402,13 +402,13 @@ importers: dependencies: '@modelcontextprotocol/sdk': specifier: '>=1.27.1' - version: 1.27.1(zod@3.25.76) + version: 1.27.1(zod@4.4.3) ws: specifier: ^8.18.0 version: 8.18.3 zod: - specifier: ^3.24.0 - version: 3.25.76 + specifier: ^4.4.3 + version: 4.4.3 devDependencies: '@types/node': specifier: ^22.14.0 @@ -6277,6 +6277,28 @@ snapshots: transitivePeerDependencies: - supports-color + '@modelcontextprotocol/sdk@1.27.1(zod@4.4.3)': + dependencies: + '@hono/node-server': 1.19.11(hono@4.12.8) + ajv: 8.18.0 + ajv-formats: 3.0.1(ajv@8.18.0) + content-type: 1.0.5 + cors: 2.8.6 + cross-spawn: 7.0.6 + eventsource: 3.0.7 + eventsource-parser: 3.0.6 + express: 5.2.1 + express-rate-limit: 8.3.1(express@5.2.1) + hono: 4.12.8 + jose: 6.1.3 + json-schema-typed: 8.0.2 + pkce-challenge: 5.0.1 + raw-body: 3.0.2 + zod: 4.4.3 + zod-to-json-schema: 3.25.1(zod@4.4.3) + transitivePeerDependencies: + - supports-color + '@napi-rs/wasm-runtime@1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)': dependencies: '@emnapi/core': 1.10.0 @@ -10742,6 +10764,10 @@ snapshots: dependencies: zod: 3.25.76 + zod-to-json-schema@3.25.1(zod@4.4.3): + dependencies: + zod: 4.4.3 + zod@3.25.76: {} zod@4.4.3: {} diff --git a/vmark-mcp-server/src/cli.ts b/vmark-mcp-server/src/cli.ts index b14fe7ab8..b62b02166 100644 --- a/vmark-mcp-server/src/cli.ts +++ b/vmark-mcp-server/src/cli.ts @@ -398,7 +398,8 @@ function jsonSchemaPropertyToZod(prop: JsonSchemaProperty): ZodTypeAny { } schema = z.object(shape); } else { - schema = z.record(z.unknown()); + // zod 4 requires an explicit key type for z.record(). + schema = z.record(z.string(), z.unknown()); } break; default: