fix(frontend): upgrade zod to 4.6.7, clearing the last npm audit finding (#132)

csv-table-hub-main/package.json

@@ -66,7 +66,7 @@
     "tw-animate-css": "^1.3.4",
     "vaul": "^1.1.2",
     "vite-tsconfig-paths": "^6.0.2",
-    "zod": "^3.24.2"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@eslint/js": "^9.32.0",

csv-table-hub-main/src/__tests__/table-rows-contract.test.ts

@@ -0,0 +1,27 @@
+// The table rows response is parsed with z.record, whose signature changed in zod 4 (#132).
+import { afterEach, expect, it, vi } from "vitest";
+import { previewCsvTable } from "@/lib/csv.functions";
+
+function mockFetchJson(payload: unknown) {
+  vi.stubGlobal(
+    "fetch",
+    vi
+      .fn()
+      .mockResolvedValue(
+        new Response(JSON.stringify(payload), { headers: { "content-type": "application/json" } }),
+      ),
+  );
+}
+
+afterEach(() => vi.unstubAllGlobals());
+
+it("accepts rows of string, number, boolean and null cells", async () => {
+  const rows = [{ name: "a", n: 1, ok: true, gone: null }];
+  mockFetchJson({ rows });
+  await expect(previewCsvTable("t")).resolves.toEqual({ rows });
+});
+
+it("rejects a row cell that is not a scalar", async () => {
+  mockFetchJson({ rows: [{ nested: { x: 1 } }] });
+  await expect(previewCsvTable("t")).rejects.toThrow(/Unexpected response shape/);
+});

csv-table-hub-main/src/lib/csv.functions.ts

@@ -98,7 +98,7 @@ const csvFileSummaryListSchema = z.array(csvFileSummarySchema);
 
 const previewRowValueSchema = z.union([z.string(), z.number(), z.boolean(), z.null()]);
 const previewRowsSchema = z.object({
-  rows: z.array(z.record(previewRowValueSchema)),
+  rows: z.array(z.record(z.string(), previewRowValueSchema)),
 });
 
 async function apiFetch<T>(path: string, schema: z.ZodType<T>, options?: RequestInit): Promise<T> {