chore: clear the audit, build auth against zod 4, lazy-load the AWS SDK - #44
Merged
Conversation
pnpm audit went from 95 findings to 0. Nearly all of it came from stale transitive resolutions, so the fix is upgrading the direct dependencies rather than pinning transitives: - stack: @aws-sdk/client-* 3.1127, js-yaml 4.3.2, ts-jest 29.4.12, jest 30 - auth: @typescript-eslint 8, prisma 7.10, tsup 8.5.1, vite 7.3.6, drizzle-orm 0.45.2, react-router-dom 7.18.3, @vitejs/plugin-react 5.2 - root: @changesets/cli 3 Overrides drop from 9 to 3. minimatch, hono, @hono/node-server, diff, lodash, flatted, rollup and ajv all reach a patched version on their own now. deepmerge-ts, esbuild and mysql2 stay because prisma and tsup pin them to an exact version no range can reach. The zod override was hiding a real bug. validators.ts, types/hooks.ts and procedures/passkey.ts imported AnyZodObject, which zod 3 exported and zod 4 removed, while peerDependencies has always declared ">=4.3.6 <5". The override forced zod 3 into the workspace, so the build passed and the emitted .d.ts carried zod 3 shapes (z.ZodObject<..., "strip", z.ZodTypeAny, ...>) that break every consumer on zod 4. src/types/zod.ts now defines the zod 4 equivalent, and auth builds against zod 4.5.4. Unused dependencies: libsodium-wrappers and ts-node (stack), better-sqlite3 with its adapter and types (auth, also drops a native build step), and the duplicate @trpc/server devDependency that shadowed the real one and caused a peer warning. Dead code, roughly 3000 lines. Eight .test.js files that jest never ran (testMatch is *.test.ts) and that fail outright when forced, plus the fixtures and mock only they used. Thirteen source files unreachable from bin/stack, src/index.ts or any live test: four orphan barrels, seven modules reachable only through those barrels, and two with no references at all. template-generator.ts goes too; the live .env.example generation lives in factiii/scanfix/env-files.ts and port-convention.ts, and the scanfix tests already cover the PORT slot behaviour its two tests duplicated. src/scripts/index.ts stays. mac/staging.ts generates remote code that deep-requires @factiii/stack/dist/scripts/index.js. Also runs prettier over auth/src. That check had been failing before any of this, against its own pinned prettier. Build, both test suites, both typechecks, auth lint and format, prisma generate and prisma validate all pass.
aws-helpers.ts imported all nine @aws-sdk/client-* packages at module
scope. Every AWS scanfix file imports that helper, and factiii/index.ts
imports those scanfix files to build its fixes array, so requiring any
CLI command pulled the whole SDK in. Measured, that was 112 ms of a
118 ms module load — including on --help, ops, db and backup, which
never touch AWS.
The SDK types are now `import type`, which TypeScript erases, and nine
*Sdk() accessors require the real packages on first use and cache them.
Call sites construct commands through the accessor: `new
(ec2Sdk().CreateVpcCommand)({...})`. The aws-helpers re-export block for
SDK command classes is gone, since re-exporting them forced the eager
load it existed to hide.
Results: `node bin/stack --help` 140 ms -> 50 ms, module load 126 ms ->
43 ms, AWS SDK modules resolved at startup 24 -> 0. All nine packages
still load on demand, verified by constructing one command from each.
Typecheck clean, stack 151 tests and auth 186 tests pass.
Covers a25c537, which dropped the zod override that was forcing zod 3 into the auth build. Patch, not minor: peerDependencies has always declared ">=4.3.6 <5", so a consumer on the declared zod 4 sees a fix rather than a break. Verified in all three consumers before release. link3d and factiii pass unchanged. Chop-Shop needed a zod 4 migration of its own, since it ran zod 3.24.1 with a zodv4 alias only for the auth schema extensions — that combination already fails on the published 0.20.1, so this release does not regress it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Three pieces, all verified against the three consumer apps before release.
pnpm audit95 findings → 0, overrides 9 → 3Nearly all of it was stale transitive resolution, so the fix was bumping direct dependencies rather than pinning transitives.
minimatch,hono,@hono/node-server,diff,lodash,flatted,rollupandajvall reach a patched version on their own now.The three that stay cannot be removed by any version bump:
deepmerge-ts >=8.0.2@prisma/config@7.10.0pins it at exactly7.1.5mysql2 >=3.24.3prisma@7.10.0pins it at exactly3.15.3esbuild >=0.28.1tsup@8.5.1caps at^0.27.0; the advisory is patched only in0.28.1prisma@8drops both of its pins, so two of the three die when it leaves release candidate. tsup's own Renovate PR to bump esbuild (egoist/tsup#1401) is titled "abandoned" and still unmerged, and tsup has not released since November 2025.auth now builds against zod 4
peerDependencieshas always declaredzod >=4.3.6 <5, but azod: 3.25.76override forced zod 3 into the build. The package compiled green while emitting zod 3 shapes into the published.d.ts, which do not typecheck for a consumer on zod 4. The override is gone andsrc/types/zod.tssupplies theAnyZodObjectequivalent zod 4 removed.AWS SDK loads only when an AWS code path runs
aws-helpers.tsimported all nine@aws-sdk/client-*packages at module scope, and every AWS scanfix file imports that helper, so any CLI command pulled the whole SDK in. Types are nowimport typeand nine*Sdk()accessors require the real packages on first use.node bin/stack --helpdrops from 140 ms to 50 ms; AWS SDK modules resolved at startup drop from 24 to 0.Also removes roughly 3000 lines of dead code: eight
.test.jsfiles jest never ran, and thirteen source files unreachable from any entry point.Verification
pnpm audit0createAuthRoutermounts, protected page rendersZero 5xx, zero TypeErrors and zero zod errors across all three app servers during browser QA.
Chop-Shop needed a zod 4 migration of its own — it ran zod 3.24.1 with a
zodv4alias only for the auth schema extensions, which already fails on the published 0.20.1. That is fixed in its own repo; this release does not regress it.🤖 Generated with Claude Code
https://claude.ai/code/session_01W7W5Fzy93cBfRcRe2BqnrV