chore(dependabot): ignore zod major bumps until v4 migration is scheduled by mikemolinet · Pull Request #28 · cueapi/cueapi-mcp

mikemolinet · 2026-05-06T21:07:39Z

Summary

Adds an ignore rule to .github/dependabot.yml's npm ecosystem entry pinning zod to v3 majors. Minor + patch updates still flow through (and group via the existing npm-minor-patch rule). Supersedes #17 — the chore(deps): bump zod 3.25.76 → 4.4.3 Dependabot PR that failed CI with ~20 TS errors.

Context

Routed to CMA via cue-pm-pr-watcher per Mike's "get all PRs Argus-ready before review agent comes online" directive (2026-05-06 21:00 PT).

PR #17 surfaced real zod 4 breaking type changes:

Site	Symptom
`src/http-entry.ts:459` + `src/stdio-entry.ts:60`	`ZodObject<...>` no longer assignable to `ZodType<any, ZodTypeDef, any>` (entry-point conversion type)
`src/tools.ts` × ~14 lines	`Record<string, unknown>` tightening + new `TS2554 Expected 2-3 arguments, but got 1` on several handlers

These are zod v4's real type-system breaking changes (released 2025) — the migration is non-trivial because it needs to land alongside @modelcontextprotocol/sdk's zod-4 readiness + zod-to-json-schema's zod-4 compat track. Until that's deliberately scheduled, Dependabot will keep opening + failing this PR every week, adding queue noise without value.

Pattern

Mirrors what cueapi engineer used today on cueapi-core#51 (pytest-asyncio 1.x major-bump deferral) — same shape: add ignore rule to the dependabot config, close the failing major-bump PR as superseded.

Behavior after merge

Dependabot stops opening zod major-version PRs
Minor + patch zod updates still flow through (grouped via npm-minor-patch)
All other npm packages unaffected
When ready to migrate to zod 4: remove the ignore entry → Dependabot re-opens the bump PR on its next weekly run → do the migration in a dedicated commit alongside the SDK + zod-to-json-schema compat work

Test plan

CI passes (this PR doesn't touch source code; only .github/dependabot.yml — the typecheck + tests should be green)
After merge: confirm next Dependabot weekly run does NOT re-open a zod major bump
Confirm minor/patch zod updates would still flow (currently zod is at 3.25.76; next 3.x update should be picked up)

…uled Adds an ``ignore`` rule to ``.github/dependabot.yml``'s npm ecosystem entry pinning zod to v3 majors. Minor + patch updates still flow through (and group via the existing ``npm-minor-patch`` rule). Why now: PR #17 (chore(deps): bump zod 3.25.76 → 4.4.3) failed CI with ~20 TS errors across src/tools.ts (TS2554 + TS2345 + TS2322), src/http-entry.ts (line 459), and src/stdio-entry.ts (line 60). zod v4 (2025) reshapes the type hierarchy: * ZodObject<...> is no longer assignable to ZodType<any, ZodTypeDef, any> (the entry-point types in http-entry.ts + stdio-entry.ts both depend on this conversion). * Output types tightened from Record<string, primitive> to Record<string, unknown> — the tools.ts handlers feed into TextContent's Record<string, string|number|boolean|undefined> expectation. * Several methods now require additional arguments (TS2554 Expected 2-3 arguments, but got 1). Migrating to zod 4 is real work that needs to land alongside the @modelcontextprotocol/sdk's zod-4 readiness + zod-to-json-schema's zod-4 compat track — non-trivial, non-urgent. Until that's scheduled deliberately, Dependabot will keep opening + failing this PR every week, which adds queue noise without value. PR #17 will be closed as superseded by this ignore rule. To pick up zod 4 later, remove the ignore entry and Dependabot will re-open the bump PR on its next scheduled run; do the migration in a dedicated commit alongside the SDK + zod-to-json-schema compat work. Pattern matches what cueapi engineer used today on cueapi-core#51 (pytest-asyncio 1.x major-bump deferral). Routed to CMA via cue-pm-pr-watcher per Mike's "get all PRs Argus-ready before review agent comes online" directive 2026-05-06 21:00 PT. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

govindkavaturi-art

Reasonable — zod v4 type-system reshape requires deliberate migration; pinning the major-bump ignore until that work is scheduled prevents weekly Dependabot churn. Comment block explains the why for the next reviewer. Approve.

Adds the agent-directory identity-layer surface to cueapi-mcp, parallel to the cueapi-python ports for PR #630 (roster) and #662 (presence). Read-only on purpose — agents are typically managed by humans via dashboard or CLI, not by automated MCP callers; adding write-surface (create/update/delete) would create the wrong abstraction. - cueapi_list_agents — GET /v1/agents with status / online_only / limit / offset filters. online_only takes precedence over status when both are passed (server contract; pinned in tests). - cueapi_get_agent — GET /v1/agents/{ref}. Accepts opaque agt_xxx ID or slug-form 'agent_slug@user_slug'. Path-encoded so '@' survives. - cueapi_get_agent_presence — GET /v1/agents/{ref}/presence (PR #662). Cheap-poll variant; lighter than get_agent. Used by UIs/schedulers needing per-agent status refresh. - cueapi_get_agent_roster — GET /v1/agents/roster (PR #630). Full directory with presence blocks for every agent the calling key owns. ETag-aware via if_none_match → If-None-Match header. 8 new tests under "agent directory tools — HTTP contract" pinning: - list defaults (no filter) - list online_only takes precedence over status (mutex contract) - list passes status + limit/offset - get encodes path correctly - get url-encodes @ in slug-form ref - presence path - roster: no header by default - roster: If-None-Match flows when if_none_match set All 79 tests pass post-add (71 existing + 8 new). Source: drift audit handoff/cueapi-package-drift-2026-05-06; Backlog rows "Parity port: PR #630 → cueapi-mcp" + "PR #662 → cueapi-mcp" (both p2). list_agents + get_agent fold in as the natural cueapi-cli PR #28 + #40 parity at the same time. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…er) (#30) * feat(agents): add 4 read-only directory tools (list/get/presence/roster) Adds the agent-directory identity-layer surface to cueapi-mcp, parallel to the cueapi-python ports for PR #630 (roster) and #662 (presence). Read-only on purpose — agents are typically managed by humans via dashboard or CLI, not by automated MCP callers; adding write-surface (create/update/delete) would create the wrong abstraction. - cueapi_list_agents — GET /v1/agents with status / online_only / limit / offset filters. online_only takes precedence over status when both are passed (server contract; pinned in tests). - cueapi_get_agent — GET /v1/agents/{ref}. Accepts opaque agt_xxx ID or slug-form 'agent_slug@user_slug'. Path-encoded so '@' survives. - cueapi_get_agent_presence — GET /v1/agents/{ref}/presence (PR #662). Cheap-poll variant; lighter than get_agent. Used by UIs/schedulers needing per-agent status refresh. - cueapi_get_agent_roster — GET /v1/agents/roster (PR #630). Full directory with presence blocks for every agent the calling key owns. ETag-aware via if_none_match → If-None-Match header. 8 new tests under "agent directory tools — HTTP contract" pinning: - list defaults (no filter) - list online_only takes precedence over status (mutex contract) - list passes status + limit/offset - get encodes path correctly - get url-encodes @ in slug-form ref - presence path - roster: no header by default - roster: If-None-Match flows when if_none_match set All 79 tests pass post-add (71 existing + 8 new). Source: drift audit handoff/cueapi-package-drift-2026-05-06; Backlog rows "Parity port: PR #630 → cueapi-mcp" + "PR #662 → cueapi-mcp" (both p2). list_agents + get_agent fold in as the natural cueapi-cli PR #28 + #40 parity at the same time. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test: cache-bust trailing comment to retrigger CI parser --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

mikemolinet mentioned this pull request May 6, 2026

chore(deps): bump zod from 3.25.76 to 4.4.3 #17

Closed

govindkavaturi-art approved these changes May 6, 2026

View reviewed changes

govindkavaturi-art merged commit 34c392b into main May 6, 2026
2 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(dependabot): ignore zod major bumps until v4 migration is scheduled#28

chore(dependabot): ignore zod major bumps until v4 migration is scheduled#28
govindkavaturi-art merged 1 commit into
mainfrom
chore/dependabot-ignore-zod-major

mikemolinet commented May 6, 2026

Uh oh!

govindkavaturi-art left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

mikemolinet commented May 6, 2026

Summary

Context

Pattern

Behavior after merge

Test plan

Related

Uh oh!

govindkavaturi-art left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants