chore(deps): zod 4.6, the version the MCP server library can share - #1784
Conversation
The MCP server library needs zod 4.2 or newer; the workspace held 4.1.12 in four manifests, and pnpm would have installed a second zod beside it for the peer, so no schema of one would satisfy the other. The range the manifests already stated permitted the current release; only the lockfile held it back. Every lockfile line that changed names zod: the four importers, the package itself, and the peer suffixes drizzle-orm and zod-validation-error carry. zod's JSON Schema converter now refuses a schema whose registrations collide on an id, which is the corruption the block document emitter already refused after the fact; the emitter gives that refusal its own shape, so a caller sees one error for one reason, and a document checked against a derivation that cannot be made is answered, not thrown at.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reachedNext included review available in 42 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (6)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
@nextlyhq/adapter-drizzle
@nextlyhq/adapter-mysql
@nextlyhq/adapter-postgres
@nextlyhq/adapter-sqlite
@nextlyhq/admin
@nextlyhq/admin-css
@nextlyhq/blocks-engine
@nextlyhq/blocks-react
@nextlyhq/builder
create-nextly-app
@nextlyhq/eslint-plugin
nextly
@nextlyhq/plugin-form-builder
@nextlyhq/plugin-page-builder
@nextlyhq/plugin-sdk
@nextlyhq/plugin-seo
@nextlyhq/storage-s3
@nextlyhq/storage-uploadthing
@nextlyhq/storage-vercel-blob
@nextlyhq/ui
commit: |
|
@codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
github-actions
Bot
added
scope: core
1 participant
Decision D11, Phase 5.1. The MCP server library (
@modelcontextprotocol/server@2.0.0) peers onzod ^4.2.0; the workspace held 4.1.12 in four manifests (root,nextly,admin,plugin-form-builder; 69 files import it), and pnpm would have installed a second zod beside it for the peer, so no schema of one would satisfy the other'sinstanceof. The ranges already stated (^4.1.12) permitted the current release, 4.6.2; only the lockfile held it back. One zod everywhere is what lets the coming MCP plugin describe its tools in the same language the rest of Nextly describes content.What changes
^4.6.2, the version tested here. Every lockfile line that changed names zod: the four importers, the package itself, and the peer suffixesdrizzle-ormandzod-validation-errorcarry.pnpm install --frozen-lockfileis clean.idinz.toJSONSchema("Duplicate schema id") rather than emitting a shorter schema. That is exactly the corruption the block-document emitter already guarded after the fact (prototype pollution ofid). The emitter turns that refusal into its ownSCHEMA_DERIVATION_FAILED, so a caller sees one error for one reason, andparseBlockDocumentanswers "cannot be checked" rather than throwing when its field list is derived cold under the corruption; its after-the-fact guard stays for a corruption zod does not see. One test updated, one added (a fresh module loaded with the pollution present), two mutation controls red and restored..changeset/one-zod-the-mcp-server-can-share.md, patch across the group as every changeset here is.What was read before bumping
The release notes 4.2 to 4.6 name real behaviour changes; the suites are the gate and these were checked by hand:
.pick()/.omit()/.merge()on refined objects now throw (the two.merge()receivers here are plainz.objects; the.omitis generated text); string.min/.max/.lengthcount code points; the email regex and its JSON-Schema pattern changed (no test here asserts on either); tuple defaults; CUID tightened (unused).Verified
pnpm buildgreen;pnpm lintgreen after the build (before it,import-x/no-unresolvedon@nextlyhq/builderis an ordering artefact);pnpm testgreen apart from the one block-document case this PR fixes;pnpm test:integration:sqlite265 files green, 42 dialect-skipped.pnpm check-typesis red on ONE line that is not this PR's:collection-mutation.test.ts(345,9)from docs(nextly): field hooks run last and see the whole record #1754, which test(nextly): type the hook-order callback so check-types passes on main #1780 fixes. This branch takes it by mergingmainonce test(nextly): type the hook-order callback so check-types passes on main #1780 lands; the CI typecheck job is red until then.