You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
chore(deps): update @deepnote packages to their zod 4 releases - #610
Updates every @deepnote/* dependency to the releases that migrate to the zod 4 API (upstream deepnote/deepnote#597). It also replaces the federated BigQuery path's hand-copied @deepnote/blocks helpers with the upstream function, which fixes generated code for queries with a carriage return.
Package
Before
After
@deepnote/blocks
4.8.1
5.0.0
@deepnote/convert
4.0.3
5.0.0
@deepnote/database-integrations
1.7.1
2.0.0
@deepnote/runtime-core
0.7.0
0.8.0
@deepnote/cloud
0.2.1
0.3.0
@deepnote/cloud-sync
0.1.0
0.2.0
@deepnote/cli (exact pin)
0.8.0
0.11.0
@deepnote/sql-language-server
3.0.1
3.0.1 (already latest)
Changes
chore(deps) commit
package.json, package-lock.json: the bumps above. All packages now declare zod ^4.6.7, so the lockfile resolves a single zod 4.6.7 (the root ^4.6.6 range already allowed it). It also resolves one copy of each @deepnote/* package, including under @deepnote/cli, local-runner and reactivity, which used to nest their own older copies. Every nested zod 3.25.76 copy is gone.
.nsprc, osv-scanner.toml: removed the GHSA-mrhx-c7xc-m3w5 (zod) exception, because nothing in the tree matches it any more.
Root yaml override raised from 2.8.3 to 2.9.1. The @deepnote packages declare yaml ^2.9.0, and the old pin held them below that floor (already true for blocks 4.8.1). Every other consumer accepts 2.9.1, and postcss-load-config keeps its own nested 1.10.3 override. The only lockfile change is yaml 2.8.3 → 2.9.1.
specs/INTEGRATIONS_CREDENTIALS.md: dropped the stale "(v1.1.0)" label from the database-integrations heading.
fix(integrations) commit
federatedAuthSqlBlockCodeGenerator.node.ts now returns createPythonCodeForSqlBlockWithConnectionJson(sqlBlock, { connectionJson }) from @deepnote/blocks (exported since 4.8.1). Before, it assembled the code from vendoredBlocksHelpers.ts, whose escapePythonString escaped only \, ' and LF. A query containing a carriage return (CRLF line endings) therefore produced SyntaxError: unterminated string literal in the kernel. Upstream also escapes CR, NUL, tabs, other control characters and U+2028/2029.
Deleted vendoredBlocksHelpers.ts, its 15 unit tests (the behavior is now upstream's and tested there), and the ts-dedent direct dependency that only that file imported. ts-dedent stays in the tree through @deepnote/blocks and mermaid.
Added a regression test for the CRLF query. It fails against the vendored code and passes now.
Fixed the parsePythonSingleQuoted test-helper docstring, which claimed to be the inverse of escapePythonString.
Behavior changes
Error wording from zod 4..deepnote parse errors and integrations-YAML diagnostics (Problems panel, logs) use zod 4's messages. For example, "Required" is now "Invalid input: expected string, received undefined", and the issue code invalid_union_discriminator is now invalid_union. No extension code or test matches on these.
Parsing is unchanged. All 46 .deepnote and integrations YAML files in this repo and in the deepnote/deepnote examples re-save byte-identically. That holds for blocks 4.8.1 vs 5.0.0, and for yaml 2.8.3 vs 2.9.1 under blocks 5.0.0. Input-block metadata defaults, empty image content and minute-precision timestamps parse as before. parseIntegrations reports the same integrations and issue paths for invalid YAML (wrong types, unknown type, missing fields); only the message text differs.
Federated BigQuery SQL code is byte-identical to before for queries without control characters. Queries with CR/NUL/tab/U+2028 are now escaped. An invalid deepnote_return_variable_type in cell metadata now fails the cell with upstream's InvalidValueError (via handleFederatedGenerateError) instead of being pasted into the Python unescaped. This matches the non-federated createPythonCode path.
Large invalid files. Removing the zod exception clears the scanner, but zod 4 still builds one issue per invalid element. A .deepnote file with ~150k invalid blocks now throws RangeError: Maximum call stack size exceeded instead of SchemaValidationError. The extension catches it either way.
Bundled CLI 0.11.0: install-skills is unchanged upstream, and it accepts all four agent names the extension passes (cursor, windsurf, antigravity, github copilot). Upstream's other changes in this range: escaping Python line separators in generated code, cloud-sync messages without CLI flag hints, keeping the live copy of files over 100 MiB on publish, and schedule --remove.
Verification
npm run typecheck, lint (0 errors, the same 27 pre-existing warnings), format and spell-check pass.
Unit tests: 2946 passing, 0 failing, 239 pending. That is 2960 after the bump alone, minus the 15 deleted vendored-helper tests, plus 1 new test.
npm run esbuild-all succeeds. The desktop and web bundle metafiles contain one zod (4.x, no v3 files) and no nested @deepnote copies.
The packages bundled the same way as the desktop build (cjs, node18) load and parse under Node 20.18.0, the oldest supported VS Code's extension host. dist/deepnoteCli.cjs runs install-skills for all four agents under Node 20.18.0 and 22.21.1.
npx better-npm-audit audit and audit --production pass. npm audit goes from 27 (12 high) to 17 (2 high); the 10 removed entries are the zod advisory through @deepnote/*.
npm install leaves the lockfile unchanged (CI's drift check). The lockfile is 1,407,784 bytes, under qlty's 2,098,000-byte limit.
Python 3 confirms the old CRLF output fails to compile and the new output compiles.
CI on this PR: every check passes, including all five E2E groups (agent, execution, files, interpreter, workspace), the audits, Qlty and the lockfile drift check. The one exception is codecov/project. Project coverage drops from 38.37% to 38.34% because deleting vendoredBlocksHelpers.ts removes 22 lines, 21 of them covered. codecov/patch reports 100% of the diff covered.
Not verified
E2E suites were not run locally (CI ran them).
The federated BigQuery path against a live kernel and real Google OAuth.
Cursor, Windsurf and Antigravity (only plain-Node runs of the bundled CLI).
Move every @deepnote/* dependency to its latest release: blocks 5.0.0,
convert 5.0.0, database-integrations 2.0.0, runtime-core 0.8.0, cloud
0.3.0, cloud-sync 0.2.0 and cli 0.11.0. sql-language-server 3.0.1 is
already the latest.
These releases import the zod 4 API and declare zod ^4.6.7, so the
lockfile resolves a single zod 4.6.7 and one copy of each @deepnote
package, including under @deepnote/cli, local-runner and reactivity. All
nested zod 3.25.76 copies are gone, so the GHSA-mrhx-c7xc-m3w5 exception
in .nsprc and osv-scanner.toml no longer matches anything and is removed.
Raise the root yaml override from 2.8.3 to 2.9.1: the @deepnote packages
declare yaml ^2.9.0, and the old pin held them below that floor. Drop the
stale version label from the database-integrations heading in
specs/INTEGRATIONS_CREDENTIALS.md.
…e/blocks
The federated BigQuery path built its Python from hand-copied
@deepnote/blocks helpers. Their escapePythonString only escaped
backslash, single quote and LF, so a query containing a carriage return
(CRLF line endings) produced an unterminated string literal and the cell
failed with a SyntaxError. Upstream has escaped CR and NUL since 4.8.1,
and 5.0.0 also escapes tabs, other control characters and U+2028/2029.
Call createPythonCodeForSqlBlockWithConnectionJson, which @deepnote/blocks
has exported since 4.8.1 and which produces the same code otherwise
(byte-identical for queries without control characters). This also
validates deepnote_return_variable_type against its allowlist instead of
interpolating it into the generated Python, matching the non-federated
createPythonCode path. Delete vendoredBlocksHelpers.ts with its tests and
the ts-dedent dependency that only it used.
✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38%. Comparing base (9215efd) to head (1c91172).
✅ All tests successful. No failed tests found.
No actionable comments were generated in the recent review.
Walkthrough
The PR updates Deepnote dependency versions and changes federated SQL code generation to use @deepnote/blocks. It removes the vendored helper module and its tests, adds a test for CRLF query escaping, and removes two accepted-risk records for GHSA-mrhx-c7xc-m3w5.
No actionable merge-blocking issue was established.
Pre-merge checks: 6
Check name
Status
Explanation
Description Check
Check skipped - CodeRabbit’s high-level summary is enabled.
Title check
The title names the main change: updating @deepnote packages to their zod 4 releases. The PR objectives confirm this is the core change, with the dependency bumps (@deepnote/blocks 5.0.0, convert 5.0.…
Docstring Coverage
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Updates Docs
The diff updates dependencies and fixes federated SQL generation; it does not implement a new feature. Linked repositories were unavailable. Please check the documentation in deepnote/deepnote and t…
Full details: Title check
Explanation
The title names the main change: updating @deepnote packages to their zod 4 releases. The PR objectives confirm this is the core change, with the dependency bumps (@deepnote/blocks 5.0.0, convert 5.0.0, database-integrations 2.0.0, and others) and the zod 4 migration. The federated SQL code-generation change and removal of vendored helpers are secondary and not named in the title, which is acceptable for a title. The title uses the conventional commit prefix and is concise and specific.
Full details: Docstring Coverage
Explanation
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 3 files. (2 skipped: 2 unsupported.)
Full details: Updates Docs
Explanation
The diff updates dependencies and fixes federated SQL generation; it does not implement a new feature. Linked repositories were unavailable. Please check the documentation in deepnote/deepnote and the roadmap in deepnote/deepnote-internal.
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Warning
Some tools did not complete. Review the errors below.
LanguageTool
LanguageTool checks were skipped: reviews.tools.languagetool.enabled_only requires at least one selection in enabled_rules or enabled_categories. Select rules/categories, set enabled_only to false to use the default rules, or set enabled to false to disable LanguageTool.
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Essentials
Run ID: 1089414e-e900-4fe6-9c43-e1ac1a67c88b
Commits
Reviewing files that changed from the base of the PR and between 9215efd and 1c91172.
Files ignored due to path filters: 1
package-lock.json is excluded by !**/package-lock.json
Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Summary
Updates every
@deepnote/*dependency to the releases that migrate to the zod 4 API (upstream deepnote/deepnote#597). It also replaces the federated BigQuery path's hand-copied@deepnote/blockshelpers with the upstream function, which fixes generated code for queries with a carriage return.@deepnote/blocks@deepnote/convert@deepnote/database-integrations@deepnote/runtime-core@deepnote/cloud@deepnote/cloud-sync@deepnote/cli(exact pin)@deepnote/sql-language-serverChanges
chore(deps)commitpackage.json,package-lock.json: the bumps above. All packages now declarezod ^4.6.7, so the lockfile resolves a singlezod4.6.7 (the root^4.6.6range already allowed it). It also resolves one copy of each@deepnote/*package, including under@deepnote/cli,local-runnerandreactivity, which used to nest their own older copies. Every nestedzod3.25.76 copy is gone..nsprc,osv-scanner.toml: removed the GHSA-mrhx-c7xc-m3w5 (zod) exception, because nothing in the tree matches it any more.yamloverride raised from2.8.3to2.9.1. The@deepnotepackages declareyaml ^2.9.0, and the old pin held them below that floor (already true for blocks 4.8.1). Every other consumer accepts 2.9.1, andpostcss-load-configkeeps its own nested 1.10.3 override. The only lockfile change isyaml2.8.3 → 2.9.1.specs/INTEGRATIONS_CREDENTIALS.md: dropped the stale "(v1.1.0)" label from the database-integrations heading.fix(integrations)commitfederatedAuthSqlBlockCodeGenerator.node.tsnow returnscreatePythonCodeForSqlBlockWithConnectionJson(sqlBlock, { connectionJson })from@deepnote/blocks(exported since 4.8.1). Before, it assembled the code fromvendoredBlocksHelpers.ts, whoseescapePythonStringescaped only\,'and LF. A query containing a carriage return (CRLF line endings) therefore producedSyntaxError: unterminated string literalin the kernel. Upstream also escapes CR, NUL, tabs, other control characters and U+2028/2029.vendoredBlocksHelpers.ts, its 15 unit tests (the behavior is now upstream's and tested there), and thets-dedentdirect dependency that only that file imported.ts-dedentstays in the tree through@deepnote/blocksand mermaid.parsePythonSingleQuotedtest-helper docstring, which claimed to be the inverse ofescapePythonString.Behavior changes
.deepnoteparse errors and integrations-YAML diagnostics (Problems panel, logs) use zod 4's messages. For example, "Required" is now "Invalid input: expected string, received undefined", and the issue codeinvalid_union_discriminatoris nowinvalid_union. No extension code or test matches on these..deepnoteand integrations YAML files in this repo and in the deepnote/deepnote examples re-save byte-identically. That holds for blocks 4.8.1 vs 5.0.0, and for yaml 2.8.3 vs 2.9.1 under blocks 5.0.0. Input-block metadata defaults, empty image content and minute-precision timestamps parse as before.parseIntegrationsreports the same integrations and issue paths for invalid YAML (wrong types, unknown type, missing fields); only the message text differs.deepnote_return_variable_typein cell metadata now fails the cell with upstream'sInvalidValueError(viahandleFederatedGenerateError) instead of being pasted into the Python unescaped. This matches the non-federatedcreatePythonCodepath..deepnotefile with ~150k invalid blocks now throwsRangeError: Maximum call stack size exceededinstead ofSchemaValidationError. The extension catches it either way.install-skillsis unchanged upstream, and it accepts all four agent names the extension passes (cursor,windsurf,antigravity,github copilot). Upstream's other changes in this range: escaping Python line separators in generated code, cloud-sync messages without CLI flag hints, keeping the live copy of files over 100 MiB on publish, andschedule --remove.Verification
npm run typecheck,lint(0 errors, the same 27 pre-existing warnings),formatandspell-checkpass.npm run esbuild-allsucceeds. The desktop and web bundle metafiles contain onezod(4.x, nov3files) and no nested@deepnotecopies.dist/deepnoteCli.cjsrunsinstall-skillsfor all four agents under Node 20.18.0 and 22.21.1.npx better-npm-audit auditandaudit --productionpass.npm auditgoes from 27 (12 high) to 17 (2 high); the 10 removed entries are the zod advisory through@deepnote/*.npm installleaves the lockfile unchanged (CI's drift check). The lockfile is 1,407,784 bytes, under qlty's 2,098,000-byte limit.codecov/project. Project coverage drops from 38.37% to 38.34% because deletingvendoredBlocksHelpers.tsremoves 22 lines, 21 of them covered.codecov/patchreports 100% of the diff covered.Not verified
@deepnote/cloud-sync. They will need a rebase onto 0.2.0 and the zod 4 schemas.Summary by CodeRabbit