chore(deps): Upgrade Zod to @latest

[evadecker]

Changes

• A security vulnerability was reported in Zod <= 3.22.2 and a patch was published in Zod 3.22.3
• This upgrades Zod to 3.22.4 to resolve the dependency vulnerability
• Fixes astro@3.4.0 and @astrojs/sitemap@3.0.2 using vulnerable version of Zod #8938

Testing

• No tests added

Docs

/cc @withastro/maintainers-docs for feedback!

[changeset-bot]

🦋 Changeset detected

Latest commit: e668df3

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[natemoo-re]

Thank you for the contribution!

[natemoo-re]

Not sure what's going on with the CI failure, but it's definitely not your fault! We'll debug that.

[bluwy]

Zod is specifically pinned because of that types issue. I spent quite some time on it before and it seems there's no way to workaround it (tsc just bails). The only way if we really want it to work is to unwrap this as a standalone type i think:

astro/packages/astro/src/core/config/schema.ts

Line 282 in 0ab6bad

export type AstroConfigType = z.infer<typeof AstroConfigSchema>;

[evadecker]

@bluwy Thanks for that, I tried digging a little bit, too, but this level of TypeScript is a bit beyond me. Do you know why the pinned version of zod works but later releases don't?

[bumu]

@evadecker can you help to fix the conflicts?

[evadecker]

@evadecker can you help to fix the conflicts?

I reran pnpm i to get rid of the lockfile merge conflict, but we still have the issue that @bluwy mentioned.

[sarah11918]

Just updating the verb tense of the changeset for consistency! Also, when just using the name of the thing, Zod appears to be capitalized, so did that too.

Docs will be happy with these changes! 🙌

[evadecker]

@bluwy @natemoo-re

I was able to resolve the previous error—

Error: src/core/config/schema.ts(62,14): error TS2742: The inferred type of 'AstroConfigSchema' cannot be named without a reference to '.pnpm/mdast-util-to-hast@12.3.0/node_modules/mdast-util-to-hast'. This is likely not portable. A type annotation is necessary.
Error: src/core/config/schema.ts(312,17): error TS2742: The inferred type of 'createRelativeSchema' cannot be named without a reference to '.pnpm/mdast-util-to-hast@12.3.0/node_modules/mdast-util-to-hast'. This is likely not portable. A type annotation is necessary.

—without unwrapping AstroConfigType as a standalone type. 🎉

To do this required explicitly adding mdast-util-to-hast as a devDependency (pinned @12.3.0), and importing mdast-util-to-hast in the config file.

The extra import feels odd to me, but it's the solution suggested by the TypeScript team developer lead when TypeScript's declaration emitter fails to resolve a reference.

[natemoo-re]

@evadecker wow great job! I think that works. I'm curious if we'd need to add it as an actual dependency to ensure it's included in user's projects, though.

[evadecker]

Happy to make an edit if that's the case!

Not sure why macos-latest test failed: hopefully just a flaky test?

[ematipico]

@bluwy could you please take a look?

[bluwy]

One small request, but great work on fixing this! Looks like the move from shiki to shikiji allowed an easier fix here.

[natemoo-re]

Thanks so much for the PR @evadecker!