Deps/zod update #1560
Deps/zod update #1560
Conversation
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
2 Skipped Deployments
|
📝 WalkthroughWalkthroughThis PR upgrades Zod from v3 to v4, removes the Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
|
@greptile review |
tk-o
left a comment
tk-o
left a comment
There was a problem hiding this comment.
Self-review completed.
| "@hono/node-server": "^1.19.5", | ||
| "@hono/otel": "^0.2.2", | ||
| "@hono/standard-validator": "^0.2.2", | ||
| "@hono/zod-validator": "^0.7.2", |
There was a problem hiding this comment.
This was an unused dependency.
| "tar@<=7.5.3": ">=7.5.4", | ||
| "lodash-es@>=4.0.0 <=4.17.22": ">=4.17.23", | ||
| "lodash@>=4.0.0 <=4.17.22": ">=4.17.23" |
There was a problem hiding this comment.
Addressing security audit issues.
There was a problem hiding this comment.
Pull request overview
Updates Zod to a newer major version and normalizes Zod import style across the repo, alongside applying dependency security overrides.
Changes:
- Bumped
zodworkspace catalog version to^4.3.6. - Standardized Zod imports to
import { z } from "zod/v4"across multiple packages/apps. - Added security-focused overrides for
tar,lodash, andlodash-es; removed@hono/zod-validatorfromensapi.
Reviewed changes
Copilot reviewed 17 out of 18 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| pnpm-workspace.yaml | Bumps workspace-catalog Zod version. |
| packages/ensnode-sdk/src/tokenscope/zod-schemas.ts | Switches Zod import to named z export. |
| packages/ensnode-sdk/src/api/shared/pagination/zod-schemas.ts | Switches Zod import to named z export. |
| packages/ensnode-sdk/src/api/shared/errors/zod-schemas.ts | Switches Zod import to named z export. |
| packages/ensnode-sdk/src/api/shared/errors/response.ts | Updates type-only Zod import form. |
| packages/ensnode-sdk/src/api/resolution/zod-schemas.ts | Switches Zod import to named z export. |
| packages/ensnode-sdk/src/api/registrar-actions/zod-schemas.ts | Switches Zod import to named z export. |
| packages/ensnode-sdk/src/api/name-tokens/zod-schemas.ts | Switches Zod import to named z export. |
| packages/ensnode-sdk/src/api/indexing-status/zod-schemas.ts | Switches Zod import to named z export. |
| packages/ens-referrals/src/api/zod-schemas.ts | Switches Zod import to named z export. |
| package.json | Expands security overrides to include lodash/lodash-es and bumps tar constraint. |
| apps/ensindexer/src/lib/ponder-helpers.ts | Switches Zod import from namespace to named z export. |
| apps/ensindexer/src/lib/indexing-status/ponder-metadata/zod-schemas.ts | Switches Zod import to named z export. |
| apps/ensapi/src/handlers/registrar-actions-api.ts | Switches Zod import to named z export. |
| apps/ensapi/src/handlers/name-tokens-api.ts | Switches Zod import to named z export. |
| apps/ensapi/src/handlers/amirealtime-api.ts | Switches Zod import to named z export. |
| apps/ensapi/package.json | Removes @hono/zod-validator dependency. |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Greptile OverviewGreptile SummaryUpdated Zod dependency from v3.25.7 to v4.3.6 across the monorepo, standardized import styles, removed unused dependencies, and applied security patches. Key Changes
Mixed Version StateThe lockfile currently contains both
Testing CoverageAuthor tested with full test suite, typechecks, and manual API testing on both ENSApi and ENSIndexer services. Confidence Score: 5/5
Important Files Changed
Sequence DiagramsequenceDiagram
participant Dev as Developer
participant Catalog as pnpm catalog (workspace)
participant Lock as pnpm-lock.yaml
participant Packages as App/Package Files
participant Security as Security Overrides
Dev->>Catalog: Update zod from ^3.25.7 to ^4.3.6
Catalog->>Lock: Resolve zod@4.3.6 dependencies
Lock->>Lock: Update viem, @ensdomains/ensjs, @ponder/utils to use zod@4.3.6
Lock->>Lock: Keep zod@3.25.76 for docs packages (@namehash/namekit-react, ponder)
Dev->>Security: Add tar, lodash, lodash-es security overrides
Security->>Lock: Apply security patches to dependencies
Dev->>Packages: Remove unused @hono/zod-validator from ensapi
Packages->>Lock: Remove @hono/zod-validator dependency chain
Dev->>Packages: Align import style across 14 files
Note over Packages: Changed "import z from" to "import { z } from"
Note over Packages: Changed "import * as z from" to "import { z } from"
Lock-->>Dev: Final lockfile with zod 4.3.6 + security patches
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/ens-referrals/src/api/zod-schemas.ts (1)
180-186: Consider usingz.discriminatedUnion()for tagged response schemas.Both
makeReferrerLeaderboardPageResponseSchemaandmakeReferrerDetailResponseSchemausez.union()for schemas with a clear discriminator field (responseCode). Usingz.discriminatedUnion("responseCode", [...])would provide better performance and clearer error messages, as noted in the PR objectives about fixing OpenAPI mapping (discriminated unions now map tooneOf).♻️ Suggested refactor
export const makeReferrerLeaderboardPageResponseSchema = ( valueLabel: string = "ReferrerLeaderboardPageResponse", ) => - z.union([ + z.discriminatedUnion("responseCode", [ makeReferrerLeaderboardPageResponseOkSchema(valueLabel), makeReferrerLeaderboardPageResponseErrorSchema(valueLabel), ]);Apply similarly to
makeReferrerDetailResponseSchemaat lines 240-244.
lightwalker-eth
left a comment
lightwalker-eth
left a comment
There was a problem hiding this comment.
@tk-o Looks nice, thanks!
Lite PR
Tip: Review docs on the ENSNode PR process
Summary
Why
z.discriminatedUnionZod schema were mapped intoanyOfinstead ofoneOf.Testing
CI=1 pnpm testCI=1 pnpm typecheckNotes for Reviewer (Optional)
zodversion was3.25.7, it already implemented Zod's v4 spec. All Zod dependency imports across ENSNode codebase were linked tozod/v4which lets us assume that no breaking changes are to be expected.Pre-Review Checklist (Blocking)