Upgrade zod to 3.23.8 #1484
Upgrade zod to 3.23.8 #1484
Conversation
🦋 Changeset detectedLatest commit: 5313b39 The changes in this PR will be included in the next version bump. This PR includes changesets to release 11 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
WalkthroughThe pull request introduces several updates to the dependencies of the Trigger.dev framework, specifically upgrading the Changes
Possibly related PRs
📜 Recent review detailsConfiguration used: CodeRabbit UI ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (12)
💤 Files with no reviewable changes (1)
✅ Files skipped from review due to trivial changes (6)
🔇 Additional comments (11)internal-packages/zod-worker/package.json (2)
Let's ensure this upgrade is safe for the internal package and its dependents. Run the following checks: ✅ Verification successfulZod version 3.23.8 is consistently used and no breaking changes detected
🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Description: Check for breaking changes and security advisories
# Check for security advisories
echo "Checking for security advisories..."
npm audit zod@3.23.8
# Look for breaking changes in dependent files
echo -e "\nChecking usage patterns that might be affected by breaking changes..."
rg -l "z\." | xargs rg "z\.(instanceof|discriminatedUnion|effect|transformer)"
# Check if version is consistent across the monorepo
echo -e "\nChecking version consistency across packages..."
find . -name "package.json" -exec jq -r '.dependencies.zod // .devDependencies.zod // empty' {} \;
Length of output: 6375
The upgrade to zod 3.23.8 matches the stated PR goal and aligns with the versions used by openai and @ai-sdk/openai packages. Let's verify if this is the latest stable version: ✅ Verification successfulVersion upgrade is safe and consistent across the monorepo The verification confirms:
🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Description: Check latest version and release info for zod
# Get latest version from npm
echo "Latest version from npm:"
npm view zod version
# Get release date and changelog for 3.23.8
echo -e "\nRelease info for 3.23.8:"
gh api repos/colinhacks/zod/releases | jq '.[] | select(.tag_name=="v3.23.8") | {published_at, body}'
Length of output: 592 Script: #!/bin/bash
# Check for potential breaking changes between 3.22.3 and 3.23.8
# and look for any security advisories
# Check for security advisories
echo "Checking for security advisories:"
npm audit zod@3.23.8
# Search for usage of RefinementCtx in the codebase since it changed from type to interface
echo -e "\nChecking RefinementCtx usage:"
rg "RefinementCtx" -A 2
# Check other zod versions in the monorepo for consistency
echo -e "\nChecking other zod versions in package.json files:"
fd package.json --exec grep -l "zod" {} \; | xargs cat | grep "\"zod\""
Length of output: 961 internal-packages/redis-worker/package.json (2)
The version specification follows the correct format and aligns with the PR objectives to standardize the zod version across packages.
The upgrade from zod 3.22.3 to 3.23.8 aligns with the PR objectives. Let's verify the upgrade's compatibility and security implications. ✅ Verification successfulLet me generate additional scripts to check for potential breaking changes between 3.22.3 and 3.23.8 by examining the codebase's usage of zod. This will help us understand the codebase's usage of zod features that might be affected by the version change, particularly around refinements which were modified in 3.23.8. Based on the extensive search results, I can now make a determination about the zod version upgrade: Zod upgrade from 3.22.3 to 3.23.8 is safe to proceed The codebase scan shows:
🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Description: Verify zod version compatibility, breaking changes, and security advisories
# Check if 3.23.8 is still the latest version
echo "Checking latest version on npm..."
npm view zod versions --json | jq -r '.[-1]'
# Check for any security advisories
echo "Checking for security advisories..."
npm audit zod@3.23.8 --json || true
# Look for breaking changes in commit history between versions
echo "Checking for breaking changes..."
gh api graphql -f query='
{
repository(owner: "colinhacks", name: "zod") {
releases(first: 10) {
nodes {
tagName
description
}
}
}
}' | jq -r '.data.repository.releases.nodes[] | select(.tagName | contains("v3.22.3","v3.23.8"))'
# Check if this version is used consistently across the monorepo
echo "Checking version consistency across packages..."
find . -name "package.json" -type f -exec grep -l "\"zod\":" {} \; -exec grep -l "3.23.8" {} \;
Length of output: 2432 Script: #!/bin/bash
# Search for zod usage patterns that might be affected by changes between versions
# Check for RefinementCtx usage since it changed from type to interface
echo "Checking RefinementCtx usage..."
rg "RefinementCtx" -A 2 -B 2
# Check for any custom refinements that might be affected
echo "Checking refinement usage patterns..."
ast-grep --pattern 'refine($$$)'
# Look for zod schema definitions to assess impact
echo "Checking zod schema patterns..."
rg "z\.(object|string|number|boolean|array|enum|union|intersection)" -A 2
Length of output: 364564 packages/trigger-sdk/package.json (2)
Let's ensure this version is free from known vulnerabilities. ✅ Verification successfulNo security vulnerabilities found for zod 3.23.8 The GitHub Security Advisory Database shows no critical or high severity vulnerabilities for this version of zod. 🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Check for any security advisories for zod
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: NPM, package: "zod", severities: [CRITICAL, HIGH]) {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'
Length of output: 366
The upgrade to zod 3.23.8 is compatible with the existing peerDependency requirement (^3.0.0) and aligns with the PR's goal of version consistency across packages. Let's verify compatibility with other dependencies: ✅ Verification successfulVersion consistency verified across the monorepo All packages using zod are aligned with version 3.23.8, either as a direct dependency or satisfying the peerDependency requirement of ^3.0.0. This consistent versioning across the monorepo ensures compatibility and prevents version conflicts. 🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Check if any other packages in the monorepo have conflicting zod versions
fd -t f "package.json" -x jq -r 'select(.dependencies.zod != null or .devDependencies.zod != null or .peerDependencies.zod != null) | "\(.name): dev=\(.devDependencies.zod) peer=\(.peerDependencies.zod) deps=\(.dependencies.zod)"'
Length of output: 712 packages/cli-v3/package.json (2)
The upgrade of zod to 3.23.8 looks good and aligns with the PR objectives. However, let's verify compatibility with dependent packages. ✅ Verification successfulZod version 3.23.8 is compatible with all dependencies The upgrade to zod 3.23.8 is compatible with:
🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Description: Check compatibility between zod and its dependent packages
# Check zod-validation-error's peer dependencies
curl -s https://registry.npmjs.org/zod-validation-error/1.5.0 | jq -r '.peerDependencies.zod'
# Find other potential zod dependencies in the workspace
fd package.json --exec jq -r 'select(.dependencies.zod or .peerDependencies.zod or .devDependencies.zod) | "\(.name): zod \(.dependencies.zod // .peerDependencies.zod // .devDependencies.zod)"'
Length of output: 577 Line range hint The exports field has been restructured to use a more detailed format. While this change appears unrelated to the zod upgrade, it's important to verify it doesn't break existing imports. ✅ Verification successfulNo impact from exports field modification The exports field change is a non-breaking modification that maintains the same essential structure and paths. The changes are:
The only difference is a more explicit nesting structure in the new version, which is fully compatible with the existing imports found in the codebase. 🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Description: Check for potential import statements that might be affected by the exports field change
# Search for import statements using this package
rg "from ['\"]trigger\.dev['\"]" -A 1
# Search for require statements using this package
rg "require\(['\"]trigger\.dev['\"]" -A 1
Length of output: 91 Script: #!/bin/bash
# Let's check for any imports or requires using the package name from package.json
# First, get the package name
PACKAGE_NAME=$(jq -r '.name' packages/cli-v3/package.json)
# Search for imports using the package name
echo "=== Searching for imports of $PACKAGE_NAME ==="
rg "from ['\"]${PACKAGE_NAME}['\"]" -A 1
# Search for requires using the package name
echo "=== Searching for requires of $PACKAGE_NAME ==="
rg "require\(['\"]${PACKAGE_NAME}['\"]" -A 1
# Let's also examine the exports field changes by showing the package.json content
echo "=== Current exports field in package.json ==="
jq '.exports' packages/cli-v3/package.json
# Check for any import statements in the test files that might be affected
echo "=== Checking test files for imports ==="
fd -e test.ts -e test.js -e spec.ts -e spec.js --exec grep -l "${PACKAGE_NAME}"
Length of output: 1003 Script: #!/bin/bash
# Let's examine the actual imports in the test files we found
echo "=== Checking imports in redis-worker queue test ==="
cat "./internal-packages/redis-worker/src/queue.test.ts"
echo "=== Checking imports in redis-worker worker test ==="
cat "./internal-packages/redis-worker/src/worker.test.ts"
echo "=== Checking imports in cli-v3 e2e test ==="
cat "./packages/cli-v3/e2e/e2e.test.ts"
echo "=== Checking imports in webapp authorization test ==="
cat "./apps/webapp/test/authorization.test.ts"
# Let's also check the previous version of package.json to compare exports field
echo "=== Previous exports field ==="
git show HEAD^:packages/cli-v3/package.json | jq '.exports'
Length of output: 40947 apps/webapp/package.json (3)
The update of
Please verify the changelog between versions 3.22.3 and 3.23.8 for any breaking changes or migration requirements. ✅ Verification successfulBased on the changelog analysis between versions 3.22.3 and 3.23.8, I can provide the final response: No breaking changes that require immediate attention The upgrade from 3.22.3 to 3.23.8 introduces several new features and improvements without any breaking changes to the public API. The only breaking changes mentioned are internal and affect ecosystem tools that rely on Zod internals:
Notable improvements include:
🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Description: Check zod changelog for breaking changes
# Fetch and analyze the changelog between versions
echo "Checking zod releases for breaking changes..."
gh api repos/colinhacks/zod/releases --paginate | jq -r '.[] | select(.tag_name | test("3\\.2[2-3]\\.[0-9]+")) | .body'
Length of output: 32847
The upgrade of
✅ Verification successfulZod ecosystem compatibility verified The upgrade to
🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Description: Check compatibility between zod and its ecosystem packages
# Check for any compatibility issues mentioned in READMEs or package.json files
echo "Checking for compatibility information in zod-related packages..."
fd -t f "README.md|package.json" -x rg -l "(?i)compatibility|requires.*zod|peer.*zod"
# Check for potential version conflicts or breaking changes
echo "Checking zod version requirements in dependent packages..."
rg -l "\"zod\".*:.*\".*\""
Length of output: 982 Script: #!/bin/bash
# Check specific version requirements in the dependent packages
echo "Checking zod version requirements in package.json files..."
rg '"zod".*:.*".*"' --no-filename --no-line-number packages/trigger-sdk/package.json internal-packages/zod-worker/package.json internal-packages/emails/package.json internal-packages/redis-worker/package.json packages/core/package.json apps/webapp/package.json apps/proxy/package.json
# Check for peerDependencies mentioning zod
echo -e "\nChecking for peerDependencies..."
rg '"peerDependencies".*\{.*\}' -A 5 packages/trigger-sdk/package.json internal-packages/zod-worker/package.json internal-packages/emails/package.json internal-packages/redis-worker/package.json packages/core/package.json apps/webapp/package.json apps/proxy/package.json
# Check specific version requirements for zod-related packages
echo -e "\nChecking version requirements for zod ecosystem packages..."
rg '"@conform-to/zod"|"zod-error"|"zod-validation-error"' --no-filename --no-line-number packages/trigger-sdk/package.json internal-packages/zod-worker/package.json internal-packages/emails/package.json internal-packages/redis-worker/package.json packages/core/package.json apps/webapp/package.json apps/proxy/package.json
Length of output: 1574 Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
@trigger.dev/core
@trigger.dev/react-hooks
@trigger.dev/rsc
@trigger.dev/sdk
@trigger.dev/build
trigger.dev
commit: |
This PR upgrades zod across all packages to 3.23.8, which is the latest and matches other popular packages like
openaiand@ai-sdk/openai.Summary by CodeRabbit
Release Notes
New Features
Dependency Updates
zodlibrary to version3.23.8across multiple packages.@trigger.devpackages to improve stability and performance.Bug Fixes
Documentation