[maccman]

What

Updates two dependencies to their latest major versions:

Dependency	Before	After	Packages
zod	^3.23.0 / 3.23.0	^4.4.3 / 4.4.3	core, extension, desktop
vite	^7.0.4	^8.0.16	desktop
@vitejs/plugin-react	^4.6.0	^6.0.2	desktop
vitest	^3	^4	core, extension, desktop

Why

Requested dependency refresh to latest. zod and vite were the targets; the other two bumps are forced by vite 8 — vitest@3 caps at vite 7 and @vitejs/plugin-react@4 caps at vite 7. vitest is bumped in all three packages (not just desktop) so the lockfile doesn't carry a split major.

Code change

One file: the IPC call helper in packages/core/src/ipc/invoke.ts. zod 4 reworked ZodType's generics from <Output, Def, Input> to <Output, Input, Internals> and removed the exported ZodTypeDef, so ZodType<TOutput, ZodTypeDef, unknown> becomes ZodType<TOutput, unknown> — same output/input intent.

Reviewer notes

• Vite 8 ships Rolldown as its default bundler (replacing Rollup). The desktop build's pre-existing chunk-size warning now references build.rolldownOptions instead of Rollup options.
• A few zod APIs in the codebase are now deprecated-but-functional in v4: .passthrough() (3 sites) and z.string().uuid()/.url()/.datetime() (capture-envelope, page-text). They still work and all tests pass; migrating them to z.looseObject/z.uuid()/z.url() is optional follow-up, not done here to keep this change minimal.
• AI SDK v6 (ai@6) accepts zod 4 (^4.1.8); Node v24 satisfies vite 8's >=22.12.0 engine.

Verification

All green:

• pnpm typecheck — 4 packages
• pnpm test — 1741 tests (core 761, desktop 948, extension 28, db 4)
• pnpm lint — only pre-existing warnings, none in touched files
• desktop vite build — succeeds (vite 8 / Rolldown)
• extension wxt build — succeeds on Vite 8.0.16

🤖 Generated with Claude Code

---

Note

Medium Risk
Wide-reaching validation and desktop bundler changes (Zod 4 + Vite 8/Rolldown); capture z.guid() is a deliberate contract tweak that must stay in sync with the Rust host parity tests.

Overview
Major dependency refresh across the monorepo: Zod 3 → 4.4.3 (core, extension, desktop), Vite 7 → 8 and @vitejs/plugin-react 6 (desktop), and Vitest 3 → 4 (core, extension, desktop, db), with lockfile updates (Vite 8’s Rolldown-based bundler chain).

Zod 4 API migrations in shared validation code: IPC call now types schemas as ZodType<TOutput, unknown> (drops ZodTypeDef). Settings, frontmatter, and chat history use z.looseObject instead of .object().passthrough(). Capture and extension wire schemas move to z.guid(), z.url(), and z.iso.datetime() — notably z.guid() on capture id so drain validation matches the native host’s looser hex-UUID rules (not RFC z.uuid()). A parity fixture documents acceptance of non-RFC UUIDs.

Build/test tooling only: no product feature logic beyond validation shape compatibility.

^{Reviewed by Cursor Bugbot for commit 54bca82. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Chores
  • Updated dependencies across all packages: validation library upgraded to major version 4, testing framework to version 4, build tooling and plugins updated to latest versions for improved stability.
  • Refined internal type signatures for compatibility with upgraded dependencies.

[coderabbitai]

Walkthrough

Upgrades zod from v3 to v4 and vitest from v3 to v4 across packages/core, apps/extension, and apps/desktop. The desktop app also bumps vite to v8 and @vitejs/plugin-react to v6. The IPC call function in packages/core/src/ipc/invoke.ts is updated to use Zod v4's two-parameter ZodType<TOutput, unknown> generic instead of the three-parameter v3 form, removing the ZodTypeDef import.

Changes

Zod v4 and tooling upgrade

Layer / File(s)	Summary
Dependency version bumps across packages packages/core/package.json, apps/desktop/package.json, apps/extension/package.json	zod bumped to ^4.4.3 and vitest to ^4 in all three packages; desktop additionally bumps @vitejs/plugin-react to ^6.0.2 and vite to ^8.0.16.
Adapt IPC invoke.ts to Zod v4 generics packages/core/src/ipc/invoke.ts	Removes the ZodTypeDef import and changes the schema parameter of call<TOutput> from ZodType<TOutput, ZodTypeDef, unknown> to ZodType<TOutput, unknown> to match Zod v4's updated generic shape.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately captures the main changes: updating zod to v4 and vite to v8, which are the primary dependencies updated across the packages.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3da5fa3. Configure here.}