From e097c140f7077e03f0fb4411ba7574343535e4b9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 25 Oct 2026 16:45:12 +0000 Subject: [PATCH 1/3] Bump zod from 4.6.5 to 4.6.6 Bumps [zod](https://github.com/colinhacks/zod) from 4.6.5 to 4.6.6. - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](https://github.com/colinhacks/zod/compare/v4.6.5...v4.6.6) --- updated-dependencies: - dependency-name: zod dependency-version: 4.6.6 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- diffr/diffr-ts/package.json | 2 +- diffr/packages/claude-code/package.json | 2 +- diffr/packages/viewer/package.json | 2 +- pnpm-lock.yaml | 65 ++++++++++++++----------- pnpm-workspace.yaml | 2 +- 5 files changed, 41 insertions(+), 32 deletions(-) diff --git a/diffr/diffr-ts/package.json b/diffr/diffr-ts/package.json index 70144aa18..366ed7d5b 100644 --- a/diffr/diffr-ts/package.json +++ b/diffr/diffr-ts/package.json @@ -46,7 +46,7 @@ "@types/node": "24.12.2", "typescript": "5.9.3", "vitest": "4.1.11", - "zod": "4.6.5" + "zod": "4.6.6" }, "engines": { "node": ">=20" diff --git a/diffr/packages/claude-code/package.json b/diffr/packages/claude-code/package.json index 987058af0..64e2df561 100644 --- a/diffr/packages/claude-code/package.json +++ b/diffr/packages/claude-code/package.json @@ -11,7 +11,7 @@ "devDependencies": { "@diffr/viewer": "workspace:*", "typescript": "5.9.3", - "zod": "4.6.5", + "zod": "4.6.6", "@types/node": "24.12.2", "vitest": "4.1.11", "esbuild": "0.28.1" diff --git a/diffr/packages/viewer/package.json b/diffr/packages/viewer/package.json index 2260f12e4..af8214eba 100644 --- a/diffr/packages/viewer/package.json +++ b/diffr/packages/viewer/package.json @@ -15,7 +15,7 @@ "get-east-asian-width": "1.4.0", "smol-toml": "1.9.0", "string-width": "8.1.0", - "zod": "4.6.5" + "zod": "4.6.6" }, "devDependencies": { "typescript": "5.9.3", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f58d5ed82..6fb11d621 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -13,8 +13,8 @@ catalogs: specifier: 4.10.2 version: 4.10.2 zod: - specifier: 4.6.5 - version: 4.6.5 + specifier: 4.6.6 + version: 4.6.6 overrides: '@dev.fast/local-vcs': workspace:0.1.0 @@ -52,7 +52,7 @@ importers: version: 7.0.2 zod: specifier: 'catalog:' - version: 4.6.5 + version: 4.6.6 apps/review-desktop: dependencies: @@ -103,8 +103,8 @@ importers: specifier: 4.1.11 version: 4.1.11(@types/node@24.12.2)(@vitest/browser-playwright@4.1.11)(esbuild@0.28.1)(jsdom@29.1.1)(tsx@4.21.0) zod: - specifier: 4.6.5 - version: 4.6.5 + specifier: 4.6.6 + version: 4.6.6 optionalDependencies: '@dev.fast/diffr-darwin-arm64': specifier: 0.1.21 @@ -140,8 +140,8 @@ importers: specifier: 4.1.11 version: 4.1.11(@types/node@24.12.2)(@vitest/browser-playwright@4.1.11)(esbuild@0.28.1)(jsdom@29.1.1)(tsx@4.21.0) zod: - specifier: 4.6.5 - version: 4.6.5 + specifier: 4.6.6 + version: 4.6.6 diffr/packages/tui: dependencies: @@ -192,8 +192,8 @@ importers: specifier: 8.1.0 version: 8.1.0 zod: - specifier: 4.6.5 - version: 4.6.5 + specifier: 4.6.6 + version: 4.6.6 devDependencies: '@types/node': specifier: 24.12.2 @@ -232,7 +232,7 @@ importers: dependencies: zod: specifier: 'catalog:' - version: 4.6.5 + version: 4.6.6 packages/local-vcs: dependencies: @@ -263,13 +263,13 @@ importers: dependencies: '@agentclientprotocol/claude-agent-acp': specifier: 0.84.0 - version: 0.84.0(@modelcontextprotocol/sdk@1.32.0(zod@4.6.5)) + version: 0.84.0(@modelcontextprotocol/sdk@1.32.0(zod@4.6.6)) '@agentclientprotocol/codex-acp': specifier: 2.0.0 version: 2.0.0 '@agentclientprotocol/sdk': specifier: 1.5.1 - version: 1.5.1(zod@4.6.5) + version: 1.5.1(zod@4.6.6) '@dev.fast/diffr': specifier: workspace:* version: link:../../diffr/diffr-ts @@ -281,7 +281,7 @@ importers: version: 0.35.5 '@modelcontextprotocol/sdk': specifier: 1.32.0 - version: 1.32.0(zod@4.6.5) + version: 1.32.0(zod@4.6.6) '@parcel/watcher': specifier: 'catalog:' version: 2.6.0 @@ -329,7 +329,7 @@ importers: version: 3.4.0 zod: specifier: 'catalog:' - version: 4.6.5 + version: 4.6.6 devDependencies: '@dev.fast/json': specifier: workspace:* @@ -390,7 +390,7 @@ importers: version: link:../trace-protocol zod: specifier: 'catalog:' - version: 4.6.5 + version: 4.6.6 devDependencies: esbuild: specifier: 0.28.1 @@ -403,7 +403,7 @@ importers: dependencies: zod: specifier: 'catalog:' - version: 4.6.5 + version: 4.6.6 devDependencies: vitest: specifier: 4.1.11 @@ -464,7 +464,7 @@ importers: version: 19.2.5(react@19.2.5) zod: specifier: 'catalog:' - version: 4.6.5 + version: 4.6.6 zustand: specifier: 5.0.15 version: 5.0.15(@types/react@19.2.14)(react@19.2.5)(use-sync-external-store@1.6.0(react@19.2.5)) @@ -528,7 +528,7 @@ importers: version: 14.0.3 zod: specifier: 'catalog:' - version: 4.6.5 + version: 4.6.6 devDependencies: '@types/node': specifier: 24.12.2 @@ -550,7 +550,7 @@ importers: dependencies: zod: specifier: 'catalog:' - version: 4.6.5 + version: 4.6.6 devDependencies: vitest: specifier: 4.1.11 @@ -3694,6 +3694,9 @@ packages: zod@4.6.5: resolution: {integrity: sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==} + zod@4.6.6: + resolution: {integrity: sha512-4UmzQUF5fxvfcYHlbjBmejU+w+hbDnWFx4aS8kBx7nPBHcO2SqPbpAG8snbdg+Xse4pRefR98hgjFgIMCI/UhA==} + zustand@4.5.7: resolution: {integrity: sha512-CHOUy7mu3lbD6o6LJLfllpjkzhHXSBlX8B9+qPddUsIfeF5S/UZ5q0kmCsnRqT1UHFQZchNFDDzMbQsuesHWlw==} engines: {node: '>=12.7.0'} @@ -3740,10 +3743,10 @@ ignoredOptionalDependencies: snapshots: - '@agentclientprotocol/claude-agent-acp@0.84.0(@modelcontextprotocol/sdk@1.32.0(zod@4.6.5))': + '@agentclientprotocol/claude-agent-acp@0.84.0(@modelcontextprotocol/sdk@1.32.0(zod@4.6.6))': dependencies: '@agentclientprotocol/sdk': 1.5.1(zod@4.6.5) - '@anthropic-ai/claude-agent-sdk': 0.3.284(@modelcontextprotocol/sdk@1.32.0(zod@4.6.5))(zod@4.6.5) + '@anthropic-ai/claude-agent-sdk': 0.3.284(@modelcontextprotocol/sdk@1.32.0(zod@4.6.6))(zod@4.6.5) diff: 9.0.0 zod: 4.6.5 transitivePeerDependencies: @@ -3767,9 +3770,13 @@ snapshots: dependencies: zod: 4.6.5 - '@anthropic-ai/claude-agent-sdk@0.3.284(@modelcontextprotocol/sdk@1.32.0(zod@4.6.5))(zod@4.6.5)': + '@agentclientprotocol/sdk@1.5.1(zod@4.6.6)': + dependencies: + zod: 4.6.6 + + '@anthropic-ai/claude-agent-sdk@0.3.284(@modelcontextprotocol/sdk@1.32.0(zod@4.6.6))(zod@4.6.5)': dependencies: - '@modelcontextprotocol/sdk': 1.32.0(zod@4.6.5) + '@modelcontextprotocol/sdk': 1.32.0(zod@4.6.6) zod: 4.6.5 '@asamuzakjp/css-color@5.1.11': @@ -4097,7 +4104,7 @@ snapshots: '@jridgewell/resolve-uri': 3.1.2 '@jridgewell/sourcemap-codec': 1.6.0 - '@modelcontextprotocol/sdk@1.32.0(zod@4.6.5)': + '@modelcontextprotocol/sdk@1.32.0(zod@4.6.6)': dependencies: '@hono/node-server': 2.0.12(hono@4.13.13) ajv: 8.20.0 @@ -4114,8 +4121,8 @@ snapshots: json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 raw-body: 3.0.2 - zod: 4.6.5 - zod-to-json-schema: 3.25.2(zod@4.6.5) + zod: 4.6.6 + zod-to-json-schema: 3.25.2(zod@4.6.6) transitivePeerDependencies: - supports-color @@ -6657,14 +6664,16 @@ snapshots: '@yuku-parser/binding-win32-arm64': 0.8.4 '@yuku-parser/binding-win32-x64': 0.8.4 - zod-to-json-schema@3.25.2(zod@4.6.5): + zod-to-json-schema@3.25.2(zod@4.6.6): dependencies: - zod: 4.6.5 + zod: 4.6.6 zod@3.25.76: {} zod@4.6.5: {} + zod@4.6.6: {} + zustand@4.5.7(@types/react@19.2.14)(react@19.2.5): dependencies: use-sync-external-store: 1.6.0(react@19.2.5) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index f0f2e3c41..a4895a6f1 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -11,7 +11,7 @@ packages: catalog: "@parcel/watcher": "2.6.0" "fast-check": "4.10.2" - zod: "4.6.5" + zod: "4.6.6" catalogMode: strict From 12afc8fe5756d3e063bccbd8c8fa83964338b0a6 Mon Sep 17 00:00:00 2001 From: thesiti92 Date: Mon, 26 Oct 2026 11:18:08 -0400 Subject: [PATCH 2/3] Rebuild Claude Code plugin bundle for zod 4.6.6 Agent-Session: e05d0ee1-ebec-4824-922f-319222ec3817 Agent-Session: 5625cb14-3381-4fef-8d68-2cdc27ef7155 Agent-Session: 02fbf542-41e9-4dde-86c4-2f75d6db972d Agent-Session: 68bb36cf-70f0-4091-b394-c4d52801007b Agent-Session: be3a7057-5bda-438f-b601-92bcb5ce9d59 Agent-Session: 7d7ae491-dbed-4fe3-8bc2-fe4851572ede Agent-Session: 20dda93e-2bdb-4f07-862a-aed55c261fb7 Agent-Session: b55ce6de-3b36-491c-8b23-9c215a3da7c3 --- .../claude-code/plugin/hooks/register.js | 51 ++++++++++++++++++- 1 file changed, 50 insertions(+), 1 deletion(-) diff --git a/diffr/packages/claude-code/plugin/hooks/register.js b/diffr/packages/claude-code/plugin/hooks/register.js index 7a65d01b3..47709d10b 100644 --- a/diffr/packages/claude-code/plugin/hooks/register.js +++ b/diffr/packages/claude-code/plugin/hooks/register.js @@ -1727,6 +1727,7 @@ __export(util_exports, { required: () => required, safeExtend: () => safeExtend, shallowClone: () => shallowClone, + sizeCaps: () => sizeCaps, slugify: () => slugify, stringifyPrimitive: () => stringifyPrimitive, toZod: () => toZod, @@ -2246,6 +2247,18 @@ function prefixIssues(path, issues) { function unwrapMessage(message) { return typeof message === "string" ? message : message?.message; } +function sizeCaps(defChecks) { + const caps = []; + for (const ch of defChecks ?? []) { + const d = ch._zod.def; + if (!/_(length|size)$|_equals$/.test(d.check)) + break; + const max = d.maximum ?? d.length ?? d.size; + if (max >= 0) + caps.push([max, ch]); + } + return caps; +} function attachSchema(issues, start, inst) { var _a3; for (let i = start; i < issues.length; i++) { @@ -3666,7 +3679,7 @@ ${content.join("\n")} var version = { major: 4, minor: 6, - patch: 5 + patch: 6 }; // ../../../node_modules/zod/v4/core/schemas.js @@ -4422,6 +4435,31 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => { return payload; }; }); +function capSize(inst, size) { + const caps = sizeCaps(inst._zod.def.checks); + if (!caps.length) + return; + const cap = Math.min(...caps.map((c) => c[0])); + const parse4 = inst._zod.parse; + inst._zod.parse = (payload, ctx) => { + const n = size(payload.value); + if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") { + for (const [max, ch] of sizeCaps(inst._zod.def.checks)) { + if (n > max && ch._zod.def.when(payload)) { + const start = payload.issues.length; + ch._zod.check(payload); + payload.issues[start].continue = false; + attachSchema(payload.issues, start, inst); + return payload; + } + } + } + return parse4(payload, ctx); + }; +} +var arraySize = (input3) => Array.isArray(input3) ? input3.length : -1; +var mapSize = (input3) => input3 instanceof Map ? input3.size : -1; +var setSize = (input3) => input3 instanceof Set ? input3.size : -1; function handleArrayResult(result, final, index) { if (result.issues.length) { final.issues.push(...prefixIssues(index, result.issues)); @@ -4465,6 +4503,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => { } return payload; }; + capSize(inst, arraySize); }); function handlePropertyResult(result, final, key, input3, optin, optout) { const isPresent = key in input3; @@ -5421,6 +5460,7 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => { return Promise.all(proms).then(() => payload); return payload; }; + capSize(inst, mapSize); }); function handleMapResult(keyResult, valueResult, final, key, input3, inst, ctx) { if (keyResult.issues.length) { @@ -5487,6 +5527,7 @@ var $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => { return Promise.all(proms).then(() => payload); return payload; }; + capSize(inst, setSize); }); function handleSetResult(result, final) { if (result.issues.length) { @@ -15017,9 +15058,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) { doc.write(`}`); return outputVar; } +function generateSizeGate(doc, schema, size) { + for (const [max, check3] of sizeCaps(schema._zod.def.checks)) { + doc.write(`if (${size} > ${numericOperand(max, check3._zod.def.check)}) return INVALID;`); + } +} function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) { const def = schema._zod.def; doc.write(`if (!Array.isArray(${accessor})) return INVALID;`); + generateSizeGate(doc, schema, `${accessor}.length`); const outputVar = buildsValue ? newVar(ctx) : null; const iVar = newVar(ctx); const elemVar = newVar(ctx); @@ -15419,6 +15466,7 @@ function literalPropertyKey(ctx, key) { function generateMapCheck(doc, ctx, schema, accessor) { const def = schema._zod.def; doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`); + generateSizeGate(doc, schema, `${accessor}.size`); const outputVar = newVar(ctx); const kVar = newVar(ctx); const valVar = newVar(ctx); @@ -15435,6 +15483,7 @@ function generateMapCheck(doc, ctx, schema, accessor) { function generateSetCheck(doc, ctx, schema, accessor) { const def = schema._zod.def; doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`); + generateSizeGate(doc, schema, `${accessor}.size`); const outputVar = newVar(ctx); const valVar = newVar(ctx); doc.write(`const ${outputVar} = new Set();`); From de2f29ccdea842c70c2346860b562f425f56c8a5 Mon Sep 17 00:00:00 2001 From: thesiti92 Date: Mon, 26 Oct 2026 11:33:40 -0400 Subject: [PATCH 3/3] Match the source path zod 4.6.6 reports for an over-long range list Agent-Session: e05d0ee1-ebec-4824-922f-319222ec3817 Agent-Session: 5625cb14-3381-4fef-8d68-2cdc27ef7155 Agent-Session: 02fbf542-41e9-4dde-86c4-2f75d6db972d Agent-Session: 68bb36cf-70f0-4091-b394-c4d52801007b Agent-Session: be3a7057-5bda-438f-b601-92bcb5ce9d59 Agent-Session: 7d7ae491-dbed-4fe3-8bc2-fe4851572ede Agent-Session: 20dda93e-2bdb-4f07-862a-aed55c261fb7 Agent-Session: b55ce6de-3b36-491c-8b23-9c215a3da7c3 --- packages/review/src/review-api/authoring-pitfalls.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/review/src/review-api/authoring-pitfalls.test.ts b/packages/review/src/review-api/authoring-pitfalls.test.ts index cf0e2c4d1..e850c4f8f 100644 --- a/packages/review/src/review-api/authoring-pitfalls.test.ts +++ b/packages/review/src/review-api/authoring-pitfalls.test.ts @@ -319,7 +319,7 @@ describe("diagram rules", () => { await expectRejected( () => insert(sequence([step([...lines, call])])), - "expected array to have <=4 items", + /steps\[0\]\.source/, ); await expectRejected( () => insert(sequence([step([call, call])])),