diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 68054df07..b22647ae1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -24,17 +24,6 @@ updates: - "patch" - "minor" ignore: - # zod 4.5 made `z.iso.datetime()` require seconds, so a request carrying - # `2026-01-01T06:15Z` that passes today would be refused with a 422 on - # every route that validates a timestamp, and 4.6 rewrites nullable and - # primitive unions in the generated JSON Schema from `anyOf` to `type` - # arrays, which reshapes the OpenAPI document and every MCP tool schema. - # Both are contract changes for the web client, the iOS app and MCP - # callers, not a routine bump, so the move past 4.4 gets its own change - # with the timestamp producers audited. Patch releases on 4.4 still - # arrive. - - dependency-name: "zod" - versions: [">=4.5.0"] # Next 16.4.0 breaks URL state after history traversal: with a sheet # opened through `?doc=`, Back leaves it open, and `[` / `]` sometimes # do not move `?day=`. Reproduced in three end-to-end journeys (3 of 40 diff --git a/package.json b/package.json index b27b8a46b..7bd1ae075 100644 --- a/package.json +++ b/package.json @@ -103,7 +103,7 @@ "undici": "^8.11.2", "web-push": "^3.6.7", "yaml": "^2.9.1", - "zod": "^4.4.3", + "zod": "^4.6.7", "zod-openapi": "^6.0.2", "zxcvbn-typescript": "^5.0.1" }, diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 979bf89d3..1714c6142 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -58,10 +58,10 @@ importers: version: 3.2.2(react@19.3.0) '@hookform/resolvers': specifier: ^5.9.1 - version: 5.9.1(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(effect@3.20.0)(react-hook-form@7.89.0(@types/react@19.3.0)(react@19.3.0))(valibot@1.4.2(typescript@6.0.3))(zod@4.4.3) + version: 5.9.1(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(effect@3.20.0)(react-hook-form@7.89.0(@types/react@19.3.0)(react@19.3.0))(valibot@1.4.2(typescript@6.0.3))(zod@4.6.7) '@modelcontextprotocol/sdk': specifier: ^1.32.1 - version: 1.32.1(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@4.4.3) + version: 1.32.1(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@4.6.7) '@napi-rs/canvas': specifier: 1.0.10 version: 1.0.10 @@ -192,11 +192,11 @@ importers: specifier: ^2.9.1 version: 2.9.1 zod: - specifier: ^4.4.3 - version: 4.4.3 + specifier: ^4.6.7 + version: 4.6.7 zod-openapi: specifier: ^6.0.2 - version: 6.0.2(zod@4.4.3) + version: 6.0.2(zod@4.6.7) zxcvbn-typescript: specifier: ^5.0.1 version: 5.0.1 @@ -6918,11 +6918,8 @@ packages: zod@3.25.76: resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==} - zod@4.4.3: - resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==} - - zod@4.6.5: - resolution: {integrity: sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==} + zod@4.6.7: + resolution: {integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==} zxcvbn-typescript@5.0.1: resolution: {integrity: sha512-If2a6jdm278dfWmn6NL7oC1lNYRHOthBw0C78LsKvtAHHFNsMudvFhDn2fF/b74txWtSosJJiuJ7jBPn/xP6HQ==} @@ -7507,7 +7504,7 @@ snapshots: dependencies: hono: 4.13.7 - '@hookform/resolvers@5.9.1(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(effect@3.20.0)(react-hook-form@7.89.0(@types/react@19.3.0)(react@19.3.0))(valibot@1.4.2(typescript@6.0.3))(zod@4.4.3)': + '@hookform/resolvers@5.9.1(@standard-schema/spec@1.1.0)(ajv-formats@2.1.1(ajv@8.20.0))(ajv@8.20.0)(effect@3.20.0)(react-hook-form@7.89.0(@types/react@19.3.0)(react@19.3.0))(valibot@1.4.2(typescript@6.0.3))(zod@4.6.7)': dependencies: '@standard-schema/utils': 0.3.0 react-hook-form: 7.89.0(@types/react@19.3.0)(react@19.3.0) @@ -7517,7 +7514,7 @@ snapshots: ajv-formats: 2.1.1(ajv@8.20.0) effect: 3.20.0 valibot: 1.4.2(typescript@6.0.3) - zod: 4.4.3 + zod: 4.6.7 '@humanfs/core@0.19.2': dependencies: @@ -7738,7 +7735,7 @@ snapshots: transitivePeerDependencies: - supports-color - '@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@4.4.3)': + '@modelcontextprotocol/sdk@1.32.1(@cfworker/json-schema@4.1.1)(supports-color@7.2.0)(zod@4.6.7)': dependencies: '@hono/node-server': 1.19.17(hono@4.13.7) ajv: 8.20.0 @@ -7755,8 +7752,8 @@ snapshots: json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 raw-body: 3.0.2 - zod: 4.4.3 - zod-to-json-schema: 3.25.2(zod@4.4.3) + zod: 4.6.7 + zod-to-json-schema: 3.25.2(zod@4.6.7) optionalDependencies: '@cfworker/json-schema': 4.1.1 transitivePeerDependencies: @@ -10899,8 +10896,8 @@ snapshots: '@babel/parser': 7.29.9 eslint: 9.39.3(jiti@2.7.0)(supports-color@7.2.0) hermes-parser: 0.25.1 - zod: 4.6.5 - zod-validation-error: 4.0.2(zod@4.6.5) + zod: 4.6.7 + zod-validation-error: 4.0.2(zod@4.6.7) transitivePeerDependencies: - supports-color @@ -11760,7 +11757,7 @@ snapshots: tinyglobby: 0.2.17 unbash: 4.0.12 yaml: 2.9.1 - zod: 4.6.5 + zod: 4.6.7 language-subtag-registry@0.3.23: {} @@ -13895,26 +13892,24 @@ snapshots: zlibjs@0.3.1: {} - zod-openapi@6.0.2(zod@4.4.3): + zod-openapi@6.0.2(zod@4.6.7): dependencies: - zod: 4.4.3 + zod: 4.6.7 zod-to-json-schema@3.25.2(zod@3.25.76): dependencies: zod: 3.25.76 - zod-to-json-schema@3.25.2(zod@4.4.3): + zod-to-json-schema@3.25.2(zod@4.6.7): dependencies: - zod: 4.4.3 + zod: 4.6.7 - zod-validation-error@4.0.2(zod@4.6.5): + zod-validation-error@4.0.2(zod@4.6.7): dependencies: - zod: 4.6.5 + zod: 4.6.7 zod@3.25.76: {} - zod@4.4.3: {} - - zod@4.6.5: {} + zod@4.6.7: {} zxcvbn-typescript@5.0.1: {}