[js] Update lockfile for synced public dependency changes - #106
[js] Update lockfile for synced public dependency changes#106github-actions[bot] wants to merge 1 commit into
Conversation
7d1ab77 to
2580243
Compare
3444f9d to
e7ea5f1
Compare
6cbf92f to
d71b98b
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Free Tier Details
Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
| resolution: "zod@npm:4.3.6" | ||
| checksum: 10/25fc0f62e01b557b4644bf0b393bbaf47542ab30877c37837ea8caf314a8713d220c7d7fe51f68ffa72f0e1018ddfa34d96f1973d23033f5a2a5a9b6b9d9da01 | ||
| languageName: node | ||
| linkType: hard |
There was a problem hiding this comment.
Zod v3 and v4 may conflict at runtime
Medium Severity
The lockfile resolves two separate zod versions: 3.25.76 (for @buildonspark/spark-mcp's ^3.24.0) and 4.3.6 (for @modelcontextprotocol/sdk's ^3.25 || ^4.0). Since spark-mcp creates zod schemas and passes them to MCP SDK tools, and the MCP SDK internally uses zod v4, runtime instanceof checks and schema validation may fail due to incompatible zod instances. Zod 3 and 4 have breaking API differences.
Additional Locations (1)
|
Bugbot is not enabled for this team, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
3 similar comments
|
Bugbot is not enabled for this team, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
Bugbot is not enabled for this team, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
Bugbot is not enabled for this team, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
Bugbot is not enabled for this team, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
1 participant
This PR updates
sdks/js/yarn.lockto match dependency changes synced from the private repository.