Repository navigation
Conversation
Bumps zod 4.6.5 -> 4.6.6 in all 21 workspace manifests and refreshes bun.lock. Resolves Dependabot alerts #423-#443 (high): zod can exhaust memory while validating oversized constrained collections. All manifests move together because Sherif's multiple-dependency-versions check fails on a partial bump. This replaces #8824 and #8825.
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Align Zod versions apps/*/package.json, packages/*/package.json |
The Zod dependency version changes from 4.6.5 to 4.6.6 across the listed app and package manifests. |
Priority:
Estimated code review effort: 1 (Trivial) | ~4 minutes
Change: Bug fix
Suggested reviewers: saddlepaddle
Merge Risk: 
47b6f
-
No actionable merge-blocking risk was identified.
Pre-merge checks: 
-
Check name Status Explanation Title check The title names the main change: zod is bumped from 4.6.5 to 4.6.6 across the workspace manifests to resolve Dependabot alerts. It follows conventional commit format and is specific. It does not menti… Description check The description covers the required template sections. The 'What & why' content is present: it states the zod bump from 4.6.5 to 4.6.6 across 8 apps and 13 packages, lists the Dependabot alerts resolv… Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Title check
-
Explanation
The title names the main change: zod is bumped from 4.6.5 to 4.6.6 across the workspace manifests to resolve Dependabot alerts. It follows conventional commit format and is specific. It does not mention the lockfile refresh, but that detail is expected to be omitted.
Full details: Description check
-
Explanation
The description covers the required template sections. The 'What & why' content is present: it states the zod bump from 4.6.5 to 4.6.6 across 8 apps and 13 packages, lists the Dependabot alerts resolved, and gives the reasons for the coordinated bump. It also replaces PRs
#8824and#8825. The 'How I tested it' section is present with a concrete test plan (bun install, lint, lint:fix, typecheck). The checklist from the template is absent. The description also does not include a screenshot section, which is not needed for a dependency bump with no user-visible change. It does not link an issue in the template form, but it does reference Dependabot alerts. The missing checklist and the unchecked CI item are minor gaps.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (21 skipped: 21 unsupported.)
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
 [High impact] The PR appears safe to merge; no actionable issues were found. SummaryUpdates
Reviews (1) · Last reviewed commit: "fix(deps): bump zod to 4.6.6 to resolve ..." · Reviewed by Greptile |
🚀 Preview Deployment🔗 Preview Links
Preview updates automatically with new commits |
|
Preview update published for development build |
Summary
Bumps
zod4.6.5 → 4.6.6 in every workspace manifest that pins it (8 apps, 13 packages). Lockfile refreshed.Alerts resolved, all high: "Zod can exhaust memory while validating oversized constrained collections" (
< 4.6.6):This also replaces #8825 (
packages/mcp) and #8824 (packages/sandbox). They bump one directory each, so Sherif'smultiple-dependency-versionscheck fails on both. The zod pin can only move in all workspaces at once.@agentclientprotocol/claude-agent-acppinszod4.6.5 exactly, so the lockfile keeps one nested 4.6.5 copy for it. A manifest bump here cannot change that; it needs an upstream release.Not in this PR (already covered by open PRs):
next,@sentry/nextjs,vite: fix(deps): bump next, @sentry/nextjs and vite to resolve Dependabot alerts #8821storybook,@modelcontextprotocol/sdk,hono: fix(deps): bump storybook, @modelcontextprotocol/sdk and hono to resolve Dependabot alerts #8776, plus chore(deps-dev): bump storybook from 10.4.2 to 10.6.2 in /packages/chat-ui #8740, chore(deps): bump @modelcontextprotocol/sdk from 1.31.0 to 1.32.0 in /packages/mcp #8696, chore(deps): bump @modelcontextprotocol/sdk from 1.31.0 to 1.32.0 in /packages/trpc #8693 and chore(deps): bump hono from 4.13.7 to 4.13.11 in /apps/usercontent #8695 for the manifests fix(deps): bump storybook, @modelcontextprotocol/sdk and hono to resolve Dependabot alerts #8776 leaves out@azure/msal-node5.5.0 → 7.1.0 (Update finding Claude #444): chore(deps): bump @azure/msal-node from 5.5.0 to 7.1.0 in /packages/trpc #8836Test plan
bun install(Bun 1.4.3, the repo'spackageManager); Sherif postinstall clean, native modules rebuiltbun run lint:fix(clean, no fixes)bun run lint(clean)bun run typecheck(root, all workspaces)Summary by CodeRabbit