chore(deps): update execa 10, esbuild 0.28, vitest 5 and TypeScript 7

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to junto are documented in this file. The project follows Semantic Versioning.
 
+## [Unreleased]
+
+### Changed
+
+- Update `execa` to 10 and the build/test toolchain to esbuild 0.28, Vitest 5 and TypeScript 7. `zod` stays on 3.x: zod 4 made each bundled hook about 5x larger and added 10-20 ms to every hook start.
+
 ## [0.6.0] - 2026-09-24
 
 ### Changed

package.json

@@ -16,8 +16,8 @@
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.30.1",
     "@types/node": "^22.0.0",
-    "esbuild": "^0.24.0",
-    "typescript": "^5.9.2",
-    "vitest": "^3.1.1"
+    "esbuild": "^0.28.2",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.1"
   }
 }

packages/core/package.json

@@ -7,7 +7,7 @@
     ".": "./src/index.ts"
   },
   "dependencies": {
-    "execa": "^9.6.1",
-    "zod": "^3.23.8"
+    "execa": "^10.0.1",
+    "zod": "^3.25.76"
   }
 }

packages/mcp/package.json

@@ -6,7 +6,7 @@
   "dependencies": {
     "@junto/core": "workspace:*",
     "@modelcontextprotocol/sdk": "^1.30.1",
-    "execa": "^9.6.1",
-    "zod": "^3.23.8"
+    "execa": "^10.0.1",
+    "zod": "^3.25.76"
   }
 }

packages/mcp/test/verify-review-ocr.test.ts

@@ -23,17 +23,19 @@ const savedBin = process.env.OPEN_CODE_REVIEW_BIN
 function installFakeOcr(output: unknown, exitCode = 0): void {
   writeFileSync(join(bin, "out.json"), typeof output === "string" ? output : JSON.stringify(output))
   if (process.platform === "win32") {
-    const script = [
-      "@echo off",
-      "if \"%~1\"==\"--version\" goto version",
-      "echo %*>> \"%~dp0args.txt\"",
-      "type \"%~dp0out.json\"",
-      `exit /b ${exitCode}`,
-      ":version",
-      "echo ocr 9.9.9",
-      "exit /b 0",
-    ].join("\r\n")
-    writeFileSync(join(bin, "ocr.cmd"), script)
+    // Like the shims npm installs for `ocr`: the .cmd only forwards %* to a Node script, so the
+    // fake does not depend on how the spawner quotes arguments for cmd.exe.
+    const fake = [
+      "const { appendFileSync, readFileSync } = require('node:fs')",
+      "const { join } = require('node:path')",
+      "const args = process.argv.slice(2)",
+      "if (args[0] === '--version') { console.log('ocr 9.9.9'); process.exit(0) }",
+      "appendFileSync(join(__dirname, 'args.txt'), args.join(' ') + '\\n')",
+      "process.stdout.write(readFileSync(join(__dirname, 'out.json')))",
+      `process.exitCode = ${exitCode}`,
+    ].join("\n")
+    writeFileSync(join(bin, "fake-ocr.cjs"), fake)
+    writeFileSync(join(bin, "ocr.cmd"), `@"${process.execPath}" "%~dp0fake-ocr.cjs" %*\r\n`)
     process.env.OPEN_CODE_REVIEW_BIN = join(bin, "ocr.cmd")
   } else {
     const script = [

plugin/hooks/guard.js

@@ -3837,7 +3837,7 @@ ZodNaN.create = (params) => {
     ...processCreateParams(params)
   });
 };
-var BRAND = Symbol("zod_brand");
+var BRAND = /* @__PURE__ */ Symbol("zod_brand");
 var ZodBranded = class extends ZodType {
   _parse(input) {
     const { ctx } = this._processInputParams(input);
@@ -4039,14 +4039,14 @@ var ostring = () => stringType().optional();
 var onumber = () => numberType().optional();
 var oboolean = () => booleanType().optional();
 var coerce = {
-  string: (arg) => ZodString.create({ ...arg, coerce: true }),
-  number: (arg) => ZodNumber.create({ ...arg, coerce: true }),
-  boolean: (arg) => ZodBoolean.create({
+  string: ((arg) => ZodString.create({ ...arg, coerce: true })),
+  number: ((arg) => ZodNumber.create({ ...arg, coerce: true })),
+  boolean: ((arg) => ZodBoolean.create({
     ...arg,
     coerce: true
-  }),
-  bigint: (arg) => ZodBigInt.create({ ...arg, coerce: true }),
-  date: (arg) => ZodDate.create({ ...arg, coerce: true })
+  })),
+  bigint: ((arg) => ZodBigInt.create({ ...arg, coerce: true })),
+  date: ((arg) => ZodDate.create({ ...arg, coerce: true }))
 };
 var NEVER = INVALID;
 
@@ -4062,6 +4062,8 @@ var SchemaVersionError = class extends Error {
     this.supported = supported;
     this.name = "SchemaVersionError";
   }
+  found;
+  supported;
 };
 function assertVersion(raw) {
   const v = raw?.schemaVersion;

plugin/hooks/handoff.js

@@ -3837,7 +3837,7 @@ ZodNaN.create = (params) => {
     ...processCreateParams(params)
   });
 };
-var BRAND = Symbol("zod_brand");
+var BRAND = /* @__PURE__ */ Symbol("zod_brand");
 var ZodBranded = class extends ZodType {
   _parse(input) {
     const { ctx } = this._processInputParams(input);
@@ -4039,14 +4039,14 @@ var ostring = () => stringType().optional();
 var onumber = () => numberType().optional();
 var oboolean = () => booleanType().optional();
 var coerce = {
-  string: (arg) => ZodString.create({ ...arg, coerce: true }),
-  number: (arg) => ZodNumber.create({ ...arg, coerce: true }),
-  boolean: (arg) => ZodBoolean.create({
+  string: ((arg) => ZodString.create({ ...arg, coerce: true })),
+  number: ((arg) => ZodNumber.create({ ...arg, coerce: true })),
+  boolean: ((arg) => ZodBoolean.create({
     ...arg,
     coerce: true
-  }),
-  bigint: (arg) => ZodBigInt.create({ ...arg, coerce: true }),
-  date: (arg) => ZodDate.create({ ...arg, coerce: true })
+  })),
+  bigint: ((arg) => ZodBigInt.create({ ...arg, coerce: true })),
+  date: ((arg) => ZodDate.create({ ...arg, coerce: true }))
 };
 var NEVER = INVALID;
 

plugin/hooks/session.js

@@ -3837,7 +3837,7 @@ ZodNaN.create = (params) => {
     ...processCreateParams(params)
   });
 };
-var BRAND = Symbol("zod_brand");
+var BRAND = /* @__PURE__ */ Symbol("zod_brand");
 var ZodBranded = class extends ZodType {
   _parse(input) {
     const { ctx } = this._processInputParams(input);
@@ -4039,14 +4039,14 @@ var ostring = () => stringType().optional();
 var onumber = () => numberType().optional();
 var oboolean = () => booleanType().optional();
 var coerce = {
-  string: (arg) => ZodString.create({ ...arg, coerce: true }),
-  number: (arg) => ZodNumber.create({ ...arg, coerce: true }),
-  boolean: (arg) => ZodBoolean.create({
+  string: ((arg) => ZodString.create({ ...arg, coerce: true })),
+  number: ((arg) => ZodNumber.create({ ...arg, coerce: true })),
+  boolean: ((arg) => ZodBoolean.create({
     ...arg,
     coerce: true
-  }),
-  bigint: (arg) => ZodBigInt.create({ ...arg, coerce: true }),
-  date: (arg) => ZodDate.create({ ...arg, coerce: true })
+  })),
+  bigint: ((arg) => ZodBigInt.create({ ...arg, coerce: true })),
+  date: ((arg) => ZodDate.create({ ...arg, coerce: true }))
 };
 var NEVER = INVALID;
 
@@ -4062,6 +4062,8 @@ var SchemaVersionError = class extends Error {
     this.supported = supported;
     this.name = "SchemaVersionError";
   }
+  found;
+  supported;
 };
 function assertVersion(raw) {
   const v = raw?.schemaVersion;

plugin/hooks/state.js

@@ -3837,7 +3837,7 @@ ZodNaN.create = (params) => {
     ...processCreateParams(params)
   });
 };
-var BRAND = Symbol("zod_brand");
+var BRAND = /* @__PURE__ */ Symbol("zod_brand");
 var ZodBranded = class extends ZodType {
   _parse(input) {
     const { ctx } = this._processInputParams(input);
@@ -4039,14 +4039,14 @@ var ostring = () => stringType().optional();
 var onumber = () => numberType().optional();
 var oboolean = () => booleanType().optional();
 var coerce = {
-  string: (arg) => ZodString.create({ ...arg, coerce: true }),
-  number: (arg) => ZodNumber.create({ ...arg, coerce: true }),
-  boolean: (arg) => ZodBoolean.create({
+  string: ((arg) => ZodString.create({ ...arg, coerce: true })),
+  number: ((arg) => ZodNumber.create({ ...arg, coerce: true })),
+  boolean: ((arg) => ZodBoolean.create({
     ...arg,
     coerce: true
-  }),
-  bigint: (arg) => ZodBigInt.create({ ...arg, coerce: true }),
-  date: (arg) => ZodDate.create({ ...arg, coerce: true })
+  })),
+  bigint: ((arg) => ZodBigInt.create({ ...arg, coerce: true })),
+  date: ((arg) => ZodDate.create({ ...arg, coerce: true }))
 };
 var NEVER = INVALID;
 
@@ -4062,6 +4062,8 @@ var SchemaVersionError = class extends Error {
     this.supported = supported;
     this.name = "SchemaVersionError";
   }
+  found;
+  supported;
 };
 function assertVersion(raw) {
   const v = raw?.schemaVersion;