Repository navigation
chore(deps): bump zod, @browserbasehq/stagehand, zod-to-json-schema and @cloudflare/vite-plugin in /packages/playwright-cloudflare/examples/stagehand - #251
dependabot[bot] wants to merge 1 commit into
Conversation
…nd @cloudflare/vite-plugin Bumps [zod](https://github.com/colinhacks/zod), [@browserbasehq/stagehand](https://github.com/browserbase/stagehand/tree/HEAD/packages/sdk-ts), [zod-to-json-schema](https://github.com/StefanTerdell/zod-to-json-schema) and [@cloudflare/vite-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vite-plugin-cloudflare). These dependencies needed to be updated together. Updates `zod` from 3.25.76 to 4.6.7 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v3.25.76...v4.6.7) Updates `@browserbasehq/stagehand` from 2.5.0 to 3.7.3 - [Release notes](https://github.com/browserbase/stagehand/releases) - [Changelog](https://github.com/browserbase/stagehand/blob/main/CHANGELOG.md) - [Commits](https://github.com/browserbase/stagehand/commits/@browserbasehq/stagehand@3.7.3/packages/sdk-ts) Updates `zod-to-json-schema` from 3.24.6 to 3.25.2 - [Release notes](https://github.com/StefanTerdell/zod-to-json-schema/releases) - [Changelog](https://github.com/StefanTerdell/zod-to-json-schema/blob/master/changelog.md) - [Commits](https://github.com/StefanTerdell/zod-to-json-schema/commits) Updates `@cloudflare/vite-plugin` from 1.13.4 to 1.66.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/@cloudflare/vite-plugin@1.66.0/packages/vite-plugin-cloudflare/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vite-plugin@1.66.0/packages/vite-plugin-cloudflare) --- updated-dependencies: - dependency-name: zod dependency-version: 4.6.7 dependency-type: direct:production - dependency-name: "@browserbasehq/stagehand" dependency-version: 3.7.3 dependency-type: direct:production - dependency-name: zod-to-json-schema dependency-version: 3.25.2 dependency-type: direct:production - dependency-name: "@cloudflare/vite-plugin" dependency-version: 1.66.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![clanky-the-clanker[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/5306670?s=60&v=4){kind=small}
There was a problem hiding this comment.
🛑 Significant concerns — The upgrade to Stagehand 3.7.3 breaks the example, which still calls the Stagehand 2 API (stagehand.page, page.act/extract) that its README says 3.x does not support. The move to zod 4 also likely gives wrong JSON schemas from zodToJsonSchema.
Findings: 1 blocking · 1 warning · 1 info (2 are inline comments on the diff)
The decision is advisory: this review is a comment and never approves, blocks or requests changes on the pull request.
🔧 Fix with your agent
Paste the following into your coding agent to investigate and fix these issues.
Fix the following code review issues found in pull request #251.
Before making changes, review each issue and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g., the fix would require disproportionate changes
for minimal ROI, or the finding is factually incorrect), explain why
- If you need to clarify something before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order
## BLOCKING (1)
### [Code Quality] Stagehand 2.5 → 3.7.3 is a breaking upgrade. The example still uses the v2 API (`stagehand.page`, `page.act`/`observe`/`extract`) and Playwright `Page`, and the README says 3.x is unsupported.
- **File:** packages/playwright-cloudflare/examples/stagehand/package.json:25
## WARNING (1)
### [Code Quality] With zod 4, `zodToJsonSchema(schema)` in `src/worker/workersAIClient.ts:38` likely produces an empty or wrong JSON schema for Workers AI structured output. Use `z.toJSONSchema` instead.
- **File:** packages/playwright-cloudflare/examples/stagehand/package.json:29
## INFO (1)
### [Documentation] `README.md:5-7` still says Stagehand 2.x, and that 3.x is unsupported, while `package.json` now declares 3.7.3.
📋 Code Quality: 🛑 1 blocking · 1 warning
Stagehand 2 → 3 and zod 3 → 4 are breaking upgrades, and the example code is not changed to match.
Recommendation: 🔴 Serious Concerns
- [BLOCKING] Stagehand 2.5 → 3.7.3 is a breaking upgrade. The example still uses the v2 API (
stagehand.page,page.act/observe/extract) and PlaywrightPage, and the README says 3.x is unsupported. (packages/playwright-cloudflare/examples/stagehand/package.json:25) - [WARNING] With zod 4,
zodToJsonSchema(schema)insrc/worker/workersAIClient.ts:38likely produces an empty or wrong JSON schema for Workers AI structured output. Usez.toJSONSchemainstead. (packages/playwright-cloudflare/examples/stagehand/package.json:29)
View full review
Stagehand 3.x is not supported by this example, and its code is not ported to it (package.json:25)
README.md:5-7says the example targets Stagehand 2.x, and that 3.x "is not currently supported as it no longer relies on Playwright".src/worker/index.ts:36-53still uses the v2 API:stagehand.page, thenpage.goto,page.observe,page.act,page.waitForSelectorandpage.extract.src/worker/screencast.tstakes a PlaywrightPageand callspage.context().newCDPSession(page).- Stagehand 3 drives the browser over CDP directly rather than through Playwright, so this code is unlikely to compile or run.
- The README's Deploy button points at this directory on
main, so the deployed template would break. - Fix: either port the example to the Stagehand 3 API and update the README, or close this pull request and ignore Stagehand's major updates in Dependabot.
- The README text that contradicts the new version is part of the same problem.
zod 4 schemas passed to zodToJsonSchema (package.json:29-30, src/worker/workersAIClient.ts:6,38)
WorkersAIClientbuildsresponse_format.json_schemawithzodToJsonSchema(schema).zod-to-json-schemaonly understands zod 3 schemas, including those imported fromzod/v3. Its own changelog points to zod 4's native JSON Schema support.- A zod 4 schema is likely to come out as an empty or unconstrained schema.
extractwould then send Workers AI no usable schema. - Fix: if zod 4 is kept, use
z.toJSONSchema(schema)instead.
📝 Documentation: 💬 1 info
The README's Stagehand version note contradicts the new dependency.
Recommendation: 📝 Minor Comments
- [INFO]
README.md:5-7still says Stagehand 2.x, and that 3.x is unsupported, whilepackage.jsonnow declares 3.7.3.
View full review
README.md:5-7 says the example uses Stagehand 2.x and that 3.x is unsupported. package.json:25 now declares ^3.7.3. The README has to change along with whichever way the Stagehand issue in the code quality section is resolved.
✅ All other checks passed
🔒 Security: ✅ LGTM
No security issues found in this dependency update.
📖 AGENTS.md: ✅ LGTM
No agent guidance files are affected by this change.
⚡ Performance: ✅ LGTM
No performance issues found.
Reviewed commit: 3bb34a25
| }, | ||
| "dependencies": { | ||
| "@browserbasehq/stagehand": "^2.5.0", | ||
| "@browserbasehq/stagehand": "^3.7.3", |
There was a problem hiding this comment.
🛑 BLOCKING · Code Quality
Stagehand 2.5 → 3.7.3 is a breaking upgrade. The example still uses the v2 API (stagehand.page, page.act/observe/extract) and Playwright Page, and the README says 3.x is unsupported.
This moves the example to Stagehand 3, but src/worker/index.ts:36-53 still uses the v2 API: stagehand.page, then page.observe, page.act and page.extract. src/worker/screencast.ts also depends on a Playwright Page. Stagehand 3 no longer drives Playwright, and README.md:7 says 3.x is unsupported for this reason. Either port the example to the v3 API and update the README, or keep Stagehand on 2.x and ignore its major updates in Dependabot.
| "react-dom": "^19.0.0", | ||
| "zod": "^3.25.76", | ||
| "zod-to-json-schema": "^3.24.6" | ||
| "zod": "^4.6.7", |
There was a problem hiding this comment.
With zod 4, zodToJsonSchema(schema) in src/worker/workersAIClient.ts:38 likely produces an empty or wrong JSON schema for Workers AI structured output. Use z.toJSONSchema instead.
zod-to-json-schema converts zod 3 schemas only. Once zod is 4.x, the schemas passed to zodToJsonSchema in src/worker/workersAIClient.ts:38 are likely to convert to an empty or unconstrained schema. extract would then send Workers AI no usable response_format. If zod 4 is kept, switch to zod's built-in z.toJSONSchema(schema).
|
npm i https://pkg.pr.new/cloudflare/browser-run/@cloudflare/playwright-mcp@3bb34a2515ed3c46d6b533e3c54b7be9d8df77c1Published by this workflow run. New pushes and reruns update this comment. |
|
npm i https://pkg.pr.new/cloudflare/browser-run/@cloudflare/playwright@3bb34a2515ed3c46d6b533e3c54b7be9d8df77c1Published by this workflow run. New pushes and reruns update this comment. |
Bumps zod, @browserbasehq/stagehand, zod-to-json-schema and @cloudflare/vite-plugin. These dependencies needed to be updated together.
Updates
zodfrom 3.25.76 to 4.6.7Release notes
Sourced from zod's releases.
... (truncated)
Commits
b500a2e4.6.79c21983ci: stage at verbose so a failed OIDC token exchange says why529f78d4.6.6a0ebf97fix(v4): check array, set and map size bounds before parsing elements (#6652)a2ba4a6fix(types): declare record output and input as members, not base type argumen...c42596brelease: hold the run on the release-approval environment until the staged ve...bacad51docs: square the Code for Japan logo to match the other bronze tiles8fb2fafdocs: crop the Code for Japan logo and list it first in bronzeb2ef983docs: add Code for Japan to bronze sponsors74304cerelease: stage npm versions instead of publishing them (#6622)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.
Updates
@browserbasehq/stagehandfrom 2.5.0 to 3.7.3Release notes
Sourced from @browserbasehq/stagehand's releases.
... (truncated)
Changelog
Sourced from @browserbasehq/stagehand's changelog.
... (truncated)
Commits
Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@browserbasehq/stagehandsince your current version.Updates
zod-to-json-schemafrom 3.24.6 to 3.25.2Changelog
Sourced from zod-to-json-schema's changelog.
... (truncated)
Commits
Updates
@cloudflare/vite-pluginfrom 1.13.4 to 1.66.0Release notes
Sourced from @cloudflare/vite-plugin's releases.
... (truncated)
Changelog
Sourced from @cloudflare/vite-plugin's changelog.
... (truncated)
Commits
ae80956[vite-plugin] Version v1 maintenance release (#16544)046db08[vite-plugin] Update v1 development registry and runtime (#16539)79678c4[vite-plugin] Update v1 to the October 23 runtime (#16444)d3b872f[vite-plugin] Route v1 DevTools WebSocket upgrades explicitly (#16540)436fa9a[vite-plugin] Preserve WebSockets owned by other v1 listeners (#16504)ca116f9[vite-plugin] Clear v1 Worker exports between dev servers (#16503)109844e[vite-plugin] Preserve repeated request cookies in v1 (#16501)4ce6176[vite-plugin] Preserve Worker response status text in v1 (#16493)1d5354b[vite-plugin] Resolve Durable Object runtime imports in v1 (#16479)49a4610[vite-plugin] Version v1 maintenance release (#16433)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@cloudflare/vite-pluginsince your current version.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.