Repository navigation
fix(check): detect Zod errors through local schema imports (UPT-68) - #185
Merged
lucasbraum merged 1 commit intoOct 17, 2026
Conversation
Signed-off-by: Lucas Braum <lucasbraum@gmail.com>
lucasbraum
deleted the
lucasbraum/upt-68-zod-detect-errors-reads-in-files-that-import-schemas-from
branch
October 17, 2026 03:59
Merged
lucasbraum
pushed a commit
that referenced
this pull request
Oct 17, 2026
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or [setup this action to publish automatically](https://github.com/changesets/action#with-publishing). If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## uptide@0.14.3 ### Patch Changes - [#191](#191) [`db1d384`](db1d384) Thanks [@lucasbraum](https://github.com/lucasbraum)! - The ai pack now reports AI SDK 7 renames in tests that `vi.mock('ai')` or `jest.mock('ai')` without importing it: the mock factory's `stepCountIs` key, and `onFinish` and the other renamed options read by fakes of `ai` calls such as `toUIMessageStreamResponse`. - [#196](#196) [`fa6f788`](fa6f788) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `fix` no longer runs out of memory type-checking monorepos whose root tsconfig includes every package: each workspace's program holds only the files that workspace owns, and the baseline check releases one workspace's program before building the next. When the analysis thread does run out of memory, `fix` says the repository is too large for analysis instead of crashing, and its temporary clone is removed on every exit path, a crashed or out-of-memory analysis thread included. - [#190](#190) [`cdf7f69`](cdf7f69) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `check <pkg>` no longer returns nothing for an outdated dependency used only through config files (typescript through tsconfig): it is always reported, with the reason, including when its workspace's analysis fails or the time budget runs out. Analysis no longer fails with ENAMETOOLONG on a package that links itself (Yarn `link:.`). - [#186](#186) [`5e01ef3`](5e01ef3) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Keep the migration's starting branch and commit in reports and diff hints, including after re-verification. Default hints to `npx uptide`, use `uptide` only when the command on PATH resolves to the running binary, keep shared reports portable, and preserve explicit flags accepted by suggested commands, including peer retry budgets and workspace-root retries. - [#197](#197) [`b51ca9b`](b51ca9b) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Suggested commands no longer print `uptide` when the launcher found is a project-local `node_modules/.bin` entry (as under `pnpm run`/`pnpm exec` or npm scripts); only a real global install does, otherwise `npx uptide`. - [#187](#187) [`6fe81b4`](6fe81b4) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Prevent `fix` from failing with `spawnSync git ENOBUFS` when Git output exceeds 1 MiB in large repositories. Raise the buffered output limit to 256 MiB for shared Git operations and source-version status checks. - [#185](#185) [`98a3119`](98a3119) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Detect removed Zod error members on local results of schemas imported through repository modules, including awaited safeParseAsync calls, so their `.errors` reads can migrate to `.issues`. - [#193](#193) [`a68fea3`](a68fea3) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `fix` no longer refuses on lockfile changes the upgrade didn't cause. When the install guard finds resolutions outside the upgrade's subtree, it runs the same install at the parent commit and judges the upgrade against that lockfile. Churn the parent install already produces is listed as "Lockfile churn the parent commit already has" and never blocks; changes only the upgrade makes are still refused, or listed for review in agent-led runs. - [#180](#180) [`549edc3`](549edc3) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Update conflicting root pins automatically when preparing draft PRs, including App/Action runs, and list the changes at the top of the PR under "Root pins changed: review". Add `updatePins: false` in `uptide.yml` to opt out. Local runs still require explicit `--update-pins` consent. - [#188](#188) [`69b1c88`](69b1c88) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Continue `fix` as an agent-led draft instead of exiting 2 when a preflight refusal has an assisting agent: peer blockers that need a major run as the plan's suggested command, root pins without consent are updated (an explicit `updatePins: false` still refuses), companions that cannot move together leave the lead alone, and the install check reports out-of-scope resolutions for review. The reason heads the PR body and the terminal summary, next to feedback rounds and spend. Without an agent, with `--no-llm`, or on a downgrade, `fix` still refuses. - [#188](#188) [`69b1c88`](69b1c88) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `fix` makes the no-pack stop (no agent, or a major for a PR) before cloning or installing. When the check returns nothing to analyze for an outdated package, `fix` now says so instead of "has no upgrade", and an agent continues as a draft. Lockfile resolutions an agent-led install changed outside the upgrade are listed for review in the PR body and the terminal summary. Downgrades, key-like settings in `uptide.config.json`, credentials in `OPENAI_BASE_URL` and unsafe run reports throw `SafetyRefusal`, which no fallback continues past. - [#194](#194) [`7dd3259`](7dd3259) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Stop `fix` in preflight on npm when a package that moves, or a peer npm installs for it, rejects a package that stays installed: vitest 5 peers on vite, and vite 8 rejects the repository's esbuild 0.25. Before, npm refused the install after the clone. The row names the chain, and `--allow-peer` writes the override. - [`4c3dc23`](4c3dc23) Thanks [@lucasbraum](https://github.com/lucasbraum)! - `uptide pack test` now prints the precision of every rule with a rewrite, breaking or not, and warns when one is below 80%. It is a warning only: no pack's status and no rule's run mode changes. The compatibility matrix lists each rewrite's precision. - [#179](#179) [`9112f2b`](9112f2b) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Add `fix --update-pins` to explicitly approve updates to conflicting root Yarn resolutions and npm/pnpm overrides for the target and its companions. Preserve unrelated pins, update root declarations and pnpm catalogs together, report pin changes, and reject ambiguous selectors before installation. - [#192](#192) [`3f81193`](3f81193) Thanks [@lucasbraum](https://github.com/lucasbraum)! - The `@sentry/browser` 10 to 11 pack is verified again: 5 public upgrades, 22 real breaking sites, breaking precision 100% and recall 50%. `@sentry/react` stays a candidate: its ground truth grew to 14 public upgrades and 29 breaking sites, with 3 false positives among its breaking findings. - [#202](#202) [`51a6f70`](51a6f70) Thanks [@lucasbraum](https://github.com/lucasbraum)! - The Sentry packs now read JavaScript files that only require another Sentry package (`@sentry/core`, a sibling SDK of the same release), which the TypeScript compile scope skipped. `@sentry/browser` breaking recall on public ground truth goes from 50% to 82% with no false positives. - [#199](#199) [`08da2a7`](08da2a7) Thanks [@lucasbraum](https://github.com/lucasbraum)! - The Sentry 10 to 11 pack no longer reports `beforeSendTransaction` or `ignoreTransactions` in a `Sentry.init` that sets `traceLifecycle`: the option keeps transactions, so they still work. - [#189](#189) [`5d1d350`](5d1d350) Thanks [@lucasbraum](https://github.com/lucasbraum)! - Avoid shared registry-cache write races during parallel checks, publish complete package extractions atomically, and print package failure reasons on stderr when check exits 2. - [#195](#195) [`15b3b3e`](15b3b3e) Thanks [@lucasbraum](https://github.com/lucasbraum)! - The vitest pack now reads `vite.config.*` and `vitest.config.*` files and jest-dom setup files that never import `vitest` (a config that takes `defineConfig` from a shared file, a setup file that only does `import '@testing-library/jest-dom/vitest'`), so it reports their bare-directory coverage patterns and jest-dom registrations. Co-authored-by: uptide-release[bot] <338861287+uptide-release[bot]@users.noreply.github.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes UPT-68.
A file importing a schema from a local module could assign
await schema.safeParseAsync(...)to a variable, then readresult.error.errorswithoutcheckreporting it. The usage scan stopped tracing at the local variable and skipped common member names.Follow variable initializers back to the import, with cycle protection. The existing compiler resolver still proves the member belongs to the dependency, so unrelated
.errors, shadowed inputs, and untyped values are not guessed. Reported Zod sites use the existingerror-issuesrewrite. No ground truth or thresholds changed.Validation:
form.errorspreserved, andtsc --noEmitpasses after upgrade.pnpm lintandpnpm typecheckpass. Lint retains the existing Biome schema-version notice and warning inpacks/next/platform.test.ts.The issue's secondary
error-paramsconcern predates #156, which added public coverage and restored mechanical status. Current score comparison follows below.pnpm testpasses (full core and CLI suites).Zod pack scores
Both full runs used the same pinned ground truth and installed repositories: clean baseline
aee6b82in a separate worktree, then this change.pnpm -s uptide pack test zod --offline --jsonpasses on both; status remains verified, fixtures remain 8 cases / 20 sites passing, and breaking false positives remain 0.error-issuesTP / FP / FNerror-paramsTP / FP / FNgenericTP / FP / FNipTP / FP / FNrecord-keyTP / FP / FNstring-formatTP / FP / FNtypesTP / FP / FNThree existing misses are now found: AwesomeIntune
src/app/api/ideas/route.ts:201andsrc/app/api/submit-tool/route.ts:17, and vzdc-artcc/websitecomponents/SoloCertification/SoloForm.tsx:27.Tradeoff: PATH gains 46 unmatched findings, all unverified (44
types, 2generic), lowering overall precision. There are no new breaking false positives. The scorer counts these newly matched sites at their reported severity; this is why overall TP increases while breaking TP stays at 44.The
error-paramsrow is unchanged at 39 / 0 / 3, including 15 true positives in public repositories (24 in storefront). Its earlier zero-public-hit issue is already addressed.Both clean baseline and changed runs flag the committed verification record as stale: the committed breaking counts are 66 / 0 / 37, whereas this environment measures baseline 44 / 0 / 41.
verification.jsonis left unchanged rather than folding that pre-existing discrepancy into this scanner fix. Neither run overclaims the pack's verified status.Not run: the full Papermark checkout, other packs' public-repository scoring, or CI watching. The real-Zod repro covers the reported local-schema/async-result shape; general assignment-flow analysis and scoped-project importer selection are unchanged.