Uh oh!
There was an error while loading. Please reload this page.
[deps] Dedupe zod and undici by publishing caret ranges - #3498
[deps] Dedupe zod and undici by publishing caret ranges#3498VaguelySerious wants to merge 1 commit into
Conversation
The catalog pinned `undici` exactly and `zod` to a tilde, so the ranges our packages publish can only ever match one version. Any dependency asking for a compatible-but-different version installs a second copy. Carets let pnpm collapse them onto one. Moving to `^4.3.6` resolves zod to 4.4.3 in this repo, which surfaced two places relying on parse-time looseness that zod 4.4 removed: `any`, `unknown` and `undefined` object keys are no longer implicitly optional. Both are restored to their previous behavior, so the code runs on 4.3.6 and 4.4.3 alike.
🦋 Changeset detectedLatest commit: d97b375 The changes in this PR will be included in the next version bump. This PR includes changesets to release 21 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
🧪 E2E Test Results✅ All tests passed E2E Test SummarySummary
Details by Category✅ ▲ Vercel Production
✅ 💻 Local Development
✅ 📦 Local Production
✅ 🐘 Local Postgres
✅ 🪟 Windows
✅ vercel-multi-region
|
📊 Workflow Benchmarkscommit Backend:
📈 STSO distribution vs main (inline / queue-hop histograms)1020 steps (inline) Cumulative STSO time: main 204038ms → this run 175049ms (Δ -28989ms, -14%) ℹ️ Metric definitions & methodologyThe collapsed STSO distribution section above buckets every step gap of the sequential-steps run (not a sampled window), split by whether the step ending the gap ran inline — in the same warm process as the step before it, so the gap is pure framework overhead — or after a queue-hop — the first step of a fresh process, which pays queue dispatch, client reinit and event-log replay. Bars overlay the two runs: Best/P75/P90/P99 deltas compare against the most recent benchmark run on Metrics — TTFS: time to first step body (in-deployment start() → first step body, deployment clocks) · STSO: step-to-step overhead (gap between consecutive step bodies) · WO: workflow overhead (whole-run time outside step bodies, in-deployment anchored) · SL: stream latency (in-deployment write → read propagation, readAt - writtenAt) · SO: stream overhead (end-to-end write+consume time beyond the modelled generation window) Scenarios — step: one trivial no-op step, no stream; no hooks, so the run stays in turbo mode (in-process fast path) · stream: one streaming step; no hooks, so the run stays in turbo mode (in-process fast path) · hook + stream: registers a hook before one step, which exits turbo mode (dispatch path) · 1020 steps: 1020 trivial sequential steps; STSO is measured between consecutive steps in the given step ranges, and WO is the whole-run overhead outside step bodies · stream latency: parallel reader/writer steps on a dedicated stream; SL is the in-deployment write->read propagation (readAt - writtenAt) · stream overhead (text): writer streams 300 variable-length text token deltas paced at 100/s for 3s (a haiku-size LLM's token throughput) while a parallel reader drains the whole stream; SO is the end-to-end write+consume time beyond the 3s generation window (overhead/backpressure) · stream overhead (structured): same workload as stream overhead (text), but each delta is an AI-SDK-style structured object ({ type: 'text-delta', id, text }) instead of a raw string, so the SO gap vs the text scenario is the added serialization cost 🔴 marks a percentile over its target (within target is left unmarked). Targets (p75/p90/p99, ms) — TTFS 200/300/600 · SL 50/60/125 · SO 250/500/1000 All metrics are measured from deployment-side timestamps only. Runs are triggered by an in-deployment route that stamps the anchor ( Cold starts are kept in the numbers on purpose — they are part of real bursty-workload latency. The workbench deployment cold-starts the |
Sim WorldSimulated world deterministic testing for races. Traces 🟠 Mint-ordered log — 6 fail of 41 total
Full trace: 🟢 Append-only log — 0 fail of 41 total
Full trace: |
VaguelySerious
commented
Aug 12, 2026
parking for now, doesn't actually change bundle size |
What
Catalog change:
undici: 7.29.0→^7.29.0,zod: ~4.3.6→^4.3.6.Those catalog entries become the literal ranges in the published manifests of
@workflow/core,@workflow/world,@workflow/world-local,@workflow/world-vercel,@workflow/world-postgres,@workflow/world-testing,@workflow/cliand@workflow/ai. An exact pin or a tilde can only ever match one version, so any other dependency in the app asking for a compatible-but-different version gets its own copy.The exact
undicipin dedupes with@ai-sdk/provider-utils'^7.28.0today only because 7.29.0 happens to be the newest 7.x. It splits the moment 7.30.0 ships.zod 4.4
^4.3.6resolves to 4.4.3 in this repo. zod 4.4 stopped treatingany,unknownandundefinedobject keys as implicitly optional, which broke 43 tests across@workflow/world-verceland@workflow/world-local. Two places relied on that looseness:SerializedDataSchema(packages/world/src/serialization.ts). Serialized payloads are routinely absent, since they travel in a frame body rather than the metadata object. Thez.any()branch used to make every key holding this schema optional at parse time while the inferred type stayed required. The.optional()plus cast restores exactly that split.CreateEventV4PageSchema's no-page branch (packages/world-vercel/src/events-v4.ts), where the three page keys are omitted outright.Verified against both zod 4.3.6 (via a temporary override) and 4.4.3, so the
^4.3.6floor is accurate.What this does not fix
Neither remaining duplicate in a
workflow+aiinstall is ours:@vercel/cli-auth@0.0.1and@vercel/cli-config@0.2.3, both of which pin zod exactly. Needs an upstream unpin.@ai-sdk/provider-utils@4, which wants^5.29.0. Different major, no range on our side bridges it.Test plan
pnpm build,pnpm typecheck,pnpm testgreen on zod 4.4.3pnpm testgreen again with a temporaryzod: 4.3.6override, confirming the floorzod: ^4.3.6/undici: ^7.29.0