Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): Update dependency zod to v3.23.0 #791

Merged
merged 1 commit into from
Apr 22, 2024
Merged

fix(deps): Update dependency zod to v3.23.0 #791

merged 1 commit into from
Apr 22, 2024
+13 −13

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Apr 22, 2024 •
edited
Loading

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
zod (source) 3.22.5 -> 3.23.0 age adoption passing confidence

Release Notes

colinhacks/zod (zod)

v3.23.0

Compare Source

Zod 3.23 is now available. This is the final 3.x release before Zod 4.0. To try it out:

npm install zod

Features

z.string().date()

Zod can now validate ISO 8601 date strings. Thanks @​igalklebanov! https://github.com/colinhacks/zod/pull/1766

const schema = z.string().date();
schema.parse("2022-01-01"); // OK
z.string().time()

Zod can now validate ISO 8601 time strings. Thanks @​igalklebanov! https://github.com/colinhacks/zod/pull/1766

const schema = z.string().time();
schema.parse("12:00:00"); // OK

You can specify sub-second precision using the precision option:

const schema = z.string().time({ precision: 3 });
schema.parse("12:00:00.123"); // OK
schema.parse("12:00:00.123456"); // Error
schema.parse("12:00:00"); // Error
z.string().duration()

Zod can now validate ISO 8601 duration strings. Thanks @​mastermatt! https://github.com/colinhacks/zod/pull/3265

const schema = z.string().duration();
schema.parse("P3Y6M4DT12H30M5S"); // OK
Improvements to z.string().datetime()

Thanks @​bchrobot https://github.com/colinhacks/zod/pull/2522

You can now allow unqualified (timezone-less) datetimes using the local: true flag.

const schema = z.string().datetime({ local: true });
schema.parse("2022-01-01T12:00:00"); // OK

Plus, Zod now validates the day-of-month correctly to ensure no invalid dates (e.g. February 30th) pass validation. Thanks @​szamanr! https://github.com/colinhacks/zod/pull/3391

z.string().base64()

Zod can now validate base64 strings. Thanks @​StefanTerdell! https://github.com/colinhacks/zod/pull/3047

const schema = z.string().base64();
schema.parse("SGVsbG8gV29ybGQ="); // OK
Improved discriminated unions

The following can now be used as discriminator keys in z.discriminatedUnion():

  • ZodOptional
  • ZodNullable
  • ZodReadonly
  • ZodBranded
  • ZodCatch
const schema = z.discriminatedUnion("type", [
  z.object({ type: z.literal("A").optional(), value: z.number() }),
  z.object({ type: z.literal("B").nullable(), value: z.string() }),
  z.object({ type: z.literal("C").readonly(), value: z.boolean() }),
  z.object({ type: z.literal("D").brand<"D">(), value: z.boolean() }),
  z.object({ type: z.literal("E").catch("E"), value: z.unknown() }),
]);
Misc

Breaking changes

There are no breaking changes to the public API of Zod. However some changes can impact ecosystem tools that rely on Zod internals.

ZodFirstPartySchemaTypes

Three new types have been added to the ZodFirstPartySchemaTypes union. This may impact some codegen libraries. https://github.com/colinhacks/zod/pull/3247

+  | ZodPipeline<any, any>
+  | ZodReadonly<any>
+  | ZodSymbol;
Default generics in ZodType

The third argument of the ZodType base class now defaults to unknown. This makes it easier to define recursive schemas and write generic functions that accept Zod schemas.

- class ZodType<Output = any, Def extends ZodTypeDef = ZodTypeDef, Input = Output> {}
+ class ZodType<Output = unknown, Def extends ZodTypeDef = ZodTypeDef, Input = unknown> {}
Unrecognized keys in .pick() and .omit()

This version fixes a bug where unknown keys were accidentally accepted in .pick() and omit(). This has been fixed, which could cause compiler errors in some user code. https://github.com/colinhacks/zod/pull/3255

z.object({ 
  name: z.string() 
}).pick({
  notAKey: true // no longer allowed
})

Bugfixes and performance

Docs and ecosystem

New Contributors

Full Changelog: colinhacks/zod@v3.22.4...v3.23.0

Configuration

📅 Schedule: Branch creation - "before 3am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate using a curated preset maintained by Sanity. View repository job log here

Sorry, something went wrong.

@renovate renovate bot requested a review from a team as a code owner April 22, 2024 07:39
@socket-security Socket Security
Copy link

socket-security bot commented Apr 22, 2024 •
edited
Loading

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/browserslist-to-esbuild@2.1.1 None +1 427 kB marcofugaro
npm/chokidar@3.6.0 environment, filesystem +16 556 kB paulmillr
npm/commitizen@4.3.0 eval Transitive: environment, filesystem +26 753 kB commitizen-bot
npm/cpx@1.5.0 filesystem Transitive: environment, eval +71 4.93 MB mysticatea
npm/cz-conventional-changelog@3.3.0 environment Transitive: eval, filesystem, unsafe +19 1.91 MB commitizen-bot
npm/esbuild-register@3.5.0 environment, eval, filesystem, unsafe +2 232 kB egoist
npm/esbuild@0.20.2 environment, filesystem, network, shell 0 135 kB evanw
npm/eslint-config-prettier@9.1.0 None 0 20.8 kB lydell
npm/eslint-plugin-import@2.29.1 filesystem, unsafe Transitive: environment, eval +65 5.56 MB ljharb
npm/eslint-plugin-prettier@5.1.3 None 0 33.9 kB jounqin
npm/eslint-plugin-simple-import-sort@12.1.0 None 0 38.2 kB lydell
npm/eslint@8.57.0 environment, filesystem Transitive: eval, shell, unsafe +50 8.43 MB eslintbot
npm/find-config@1.0.0 filesystem 0 35 kB shannonmoeller
npm/get-latest-version@5.1.0 None 0 8.23 kB rexxars
npm/git-url-parse@14.0.0 None 0 31.5 kB ionicabizau
npm/globby@11.1.0 filesystem +2 76.7 kB sindresorhus
npm/husky@8.0.3 environment, filesystem, shell 0 6.44 kB typicode
npm/jsonc-parser@3.2.1 None 0 210 kB vscode-bot
npm/lint-staged@15.2.2 Transitive: environment, filesystem, shell +18 529 kB okonet
npm/mkdirp@3.0.1 environment, filesystem 0 107 kB isaacs
npm/npm-run-all2@6.1.2 environment, filesystem Transitive: shell +10 773 kB bret
npm/outdent@0.8.0 None 0 42.9 kB cspotcode
npm/parse-git-config@3.0.0 filesystem 0 15.5 kB jonschlinkert
npm/recast@0.23.6 filesystem +2 1.36 MB eventualbuddha
npm/rimraf@4.4.1 environment, filesystem +9 415 kB isaacs
npm/rollup-plugin-esbuild@6.1.1 filesystem Transitive: environment +4 216 kB egoist
npm/rollup-plugin-visualizer@5.12.0 filesystem Transitive: environment, network +8 1.48 MB btd
npm/treeify@1.1.0 None 0 22.2 kB notatestuser
npm/ts-node@10.9.2 environment, filesystem, unsafe +1 1.29 MB blakeembrey
npm/vitest-github-actions-reporter@0.11.1 environment 0 42 kB sapphi-red
npm/vitest@1.5.0 environment, eval Transitive: filesystem, shell +13 2.11 MB vitestbot
npm/zod-validation-error@3.1.0 None 0 57.3 kB jmike

View full report↗︎

@socket-security Socket Security
Copy link

socket-security bot commented Apr 22, 2024 •
edited
Loading

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSource
Install scripts npm/core-js@2.6.12
  • Install script: postinstall
  • Source: node -e "try{require('./postinstall')}catch(e){}"
Install scripts npm/esbuild@0.20.2
Install scripts npm/@swc/core@1.4.13
  • Install script: postinstall
  • Source: node postinstall.js
  • orphan: npm/@swc/core@1.4.13
Install scripts npm/@sveltejs/kit@2.5.7
  • Install script: postinstall
  • Source: node postinstall.js
  • orphan: npm/@sveltejs/kit@2.5.7

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore npm/core-js@2.6.12
  • @SocketSecurity ignore npm/esbuild@0.20.2
  • @SocketSecurity ignore npm/@swc/core@1.4.13
  • @SocketSecurity ignore npm/@sveltejs/kit@2.5.7

@renovate renovate bot force-pushed the renovate/zod-3.x branch from c534902 to 1edd535 Compare April 22, 2024 08:47
@renovate
fix(deps): Update dependency zod to v3.23.0
Loading
Loading status checks…
704e0fd
@renovate renovate bot force-pushed the renovate/zod-3.x branch from 1edd535 to 704e0fd Compare April 22, 2024 09:03
@stipsan stipsan merged commit d333760 into main Apr 22, 2024
8 of 9 checks passed
@stipsan stipsan deleted the renovate/zod-3.x branch April 22, 2024 09:16
@ecospark ecospark bot mentioned this pull request Apr 22, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
🤖 bot 📦 deps
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
1 participant
@stipsan