chore: update ai-sdk family and zod - #140
Conversation
Batch anti-rot bump: ai 7.0.84, @ai-sdk/anthropic 4.0.45, @ai-sdk/openai-compatible 3.0.40, @ai-sdk/provider-utils 5.0.33, @ai-sdk/react 4.0.87, @ai-sdk/harness 1.0.93, @ai-sdk/harness-claude-code 1.0.97, @ai-sdk/tui 1.0.85, zod 4.4.3 -> 4.5.1 (incl. the workspace-wide zod override pin). Published peerDependency ranges untouched. Change-Id: I81fd647fbbef24537a47990f5044db493c490cee Signed-off-by: Thomas Kosiewski <tk@coder.com>
|
@codex review |
|
@codex security review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ab530de145
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Change-Id: Icbe05e8aeb3bea98b942a7ddce498bd1056947c6 Signed-off-by: Thomas Kosiewski <tk@coder.com>
|
@codex review |
|
@codex security review |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Security review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
1 participant
Routine anti-rot batch update (minor/patch only): the Vercel AI SDK family and zod. No source changes required; all range styles preserved.
Bumps
ai^7.0.83→^7.0.84@ai-sdk/anthropic^4.0.44→^4.0.45@ai-sdk/openai-compatible^3.0.39→^3.0.40@ai-sdk/provider-utils^5.0.32→^5.0.33@ai-sdk/react4.0.86→4.0.87@ai-sdk/harness^1.0.92→^1.0.93@ai-sdk/harness-claude-code^1.0.96→^1.0.97@ai-sdk/tui^1.0.84→^1.0.85zod4.4.3→4.5.1Not touched:
typescript(#99 deferred),tsup(8.5.1),@ai-sdk/provider(4.0.8, not in this batch).zod peer-range decision
Published
peerDependenciesare a user-facing contract and were not narrowed:@coder/ai-sdk-agent:zod: ^3.23.0 || ^4.0.0— already includes 4.5.x, unchanged.@coder/ai-sdk-provider:zod: ^3.25.76 || ^4.1.8— already includes 4.5.x, unchanged.ai ^7.0.0,@ai-sdk/harness ^1.0.0,@ai-sdk/provider-utils ^5.0.0peers — unchanged.The workspace-wide
overrides: zodexact pin inpnpm-workspace.yaml(which exists to keep a single zod copy across the monorepo, avoiding duplicated@ai-sdk/provider-utilstype identity) moves4.4.3→4.5.1— that pin is what actually selects the installed version.zod 4.5 changelog review
Zod 4.5 is additive (z.compile(), z.creditCard(), z.validate(), 9x schema-memory reduction) plus soundness fixes that tighten behavior:
z.iso.datetime()now requires seconds, string.min()/.max()/.length()count Unicode code points (was UTF-16 code units), record-key/intersection semantics align with TypeScript,__proto__is always stripped, and stricterz.ipv6()/z.ulid()/z.httpUrl()formats. None of these apply here: our zod usage across all packages is limited toz.object/z.string/z.number/z.enum/z.arraywith no length checks, records, intersections, or string formats. Full test suite passes on 4.5.1.Validation
pnpm install✅ (lockfile refreshed; single zod 4.5.1 across the workspace)pnpm check✅ (oxfmt + oxlint + typecheck)pnpm -r build✅pnpm -r test✅ — 552 tests (agent 326, sandbox 191, provider 22, release-please-ai 13)pnpm publint✅,pnpm attw✅packages/agent test/e2e, temp token created and expired after the run)Generated with
mux• Model:anthropic:claude-fable-5• Thinking:xhigh