[Snyk] Upgrade zod from 3.25.56 to 4.3.6 - #9
Open
pinkycollie wants to merge 1 commit into
Open
Conversation
Snyk has created this PR to upgrade zod from 3.25.56 to 4.3.6. See this package in npm: zod See this project in Snyk: https://app.snyk.io/org/pinkycollie/project/19394bc5-5ee2-4bfe-8a0b-7dfa3f7b57e0?utm_source=github&utm_medium=referral&page=upgrade-pr
Owner
Author
|
The upgrade from zod v3 to v4 is a major version jump with significant breaking changes that require code modifications. While offering major performance improvements, several core APIs have been refactored. Key Breaking Changes:
Recommendation: Developers must review their schema definitions and update them to conform to the new v4 APIs, especially for error handling and object creation. A community-maintained codemod, Source: Zod v4 Migration Guide
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade zod from 3.25.56 to 4.3.6.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 327 versions ahead of your current version.
The recommended version was released 23 days ago.
Breaking Change Risk
Release notes
Package name: zod
Commits:
Commits:
Commits:
Commits:
Commits:
Commits:
This is Zod's biggest release since 4.0. It addresses several of Zod's longest-standing feature requests.
z.fromJSONSchema()Convert JSON Schema to Zod (#5534, #5586)
You can now convert JSON Schema definitions directly into Zod schemas. This function supports JSON Schema
"draft-2020-12","draft-7","draft-4", and OpenAPI 3.0.const schema = z.fromJSONSchema({
type: "object",
properties: {
name: { type: "string", minLength: 1 },
age: { type: "integer", minimum: 0 },
},
required: ["name"],
});
schema.parse({ name: "Alice", age: 30 }); // ✅
The API should be considered experimental. There are no guarantees of 1:1 "round-trip soundness":
MySchema>z.toJSONSchema()>z.fromJSONSchema(). There are several features of Zod that don't exist in JSON Schema and vice versa, which makes this virtually impossible.Features supported:
string,number,integer,boolean,null,object,array)email,uri,uuid,date-time,date,time,ipv4,ipv6, and more)anyOf,oneOf,allOf)additionalProperties,patternProperties,propertyNames)prefixItems,items,minItems,maxItems)$reffor local references and circular schemasz.xor()— exclusive union (#5534)A new exclusive union type that requires exactly one option to match. Unlike
z.union()which passes if any option matches,z.xor()fails if zero or more than one option matches.schema.parse("hello"); // ✅
schema.parse(42); // ✅
schema.parse(true); // ❌ zero matches
When converted to JSON Schema,
z.xor()producesoneOfinstead ofanyOf.z.looseRecord()— partial record validation (#5534)A new record variant that only validates keys matching the key schema, passing through non-matching keys unchanged. This is used to represent
patternPropertiesin JSON Schema.schema.parse({ S_name: "John", other: 123 });
// ✅ { S_name: "John", other: 123 }
// only S_name is validated, "other" passes through
.exactOptional()— strict optional properties (#5589)A new wrapper that makes a property key-optional (can be omitted) but does not accept
undefinedas an explicit value.a: z.string().optional(), // accepts
undefinedb: z.string().exactOptional(), // does not accept
undefined});
schema.parse({}); // ✅
schema.parse({ a: undefined }); // ✅
schema.parse({ b: undefined }); // ❌
This makes it possible to accurately represent the full spectrum of optionality expressible using
exactOptionalPropertyTypes..apply()A utility method for applying arbitrary transformations to a schema, enabling cleaner schema composition. (#5463)
return schema.min(0).max(100);
};
const schema = z.number().apply(setCommonChecks).nullable();
.brand()cardinalityThe
.brand()method now accepts a second argument to control whether the brand applies to input, output, or both. Closes #4764, #4836.Type predicates on
.refine()(#5575)The
.refine()method now supports type predicates to narrow the output type:type Input = z.input<typeof schema>; // string
type Output = z.output<typeof schema>; // "a"
ZodMapmethods:min,max,nonempty,size(#5316)ZodMapnow has parity withZodSetandZodArray:.min(1)
.max(10)
.nonempty();
schema.size; // access the size constraint
.with()alias for.check()(359c0db)A new
.with()method has been added as a more readable alias for.check(). Over time, more APIs have been added that don't qualify as "checks". The new method provides a readable alternative that doesn't muddy semantics.z.minLength(5),
z.toLowerCase()
);
// equivalent to:
z.string().check(
z.minLength(5),
z.trim(),
z.toLowerCase()
);
z.slugify()transformTransform strings into URL-friendly slugs. Works great with
.with():z.string().slugify().parse("Hello World"); // "hello-world"
// Zod Mini
// using .with() for explicit check composition
z.string().with(z.slugify()).parse("Hello World"); // "hello-world"
z.meta()andz.describe()in Zod Mini (947b4eb)Zod Mini now exports
z.meta()andz.describe()as top-level functions for adding metadata to schemas:// add description
const schema = z.string().with(
z.describe("A user's name"),
);
// add arbitrary metadata
const schema2 = z.number().with(
z.meta({ deprecated: true })
);
More ergonomic intersections #5587
When intersecting schemas that include
z.strictObject(), Zod 4 now only rejects keys that are unrecognized by both sides of the intersection. Previously, any unrecognized key from either side would cause an error.This means keys that are recognized by at least one side of the intersection will now pass validation:
const B = z.object({ b: z.string() });
const C = z.intersection(A, B);
// Keys recognized by either side now work
C.parse({ a: "foo", b: "bar" }); // ✅ { a: "foo", b: "bar" }
// Extra keys are stripped (follows strip behavior from B)
C.parse({ a: "foo", b: "bar", c: "extra" }); // ✅ { a: "foo", b: "bar" }
When both sides are strict, only keys unrecognized by both sides will error:
const B = z.strictObject({ b: z.string() });
const C = z.intersection(A, B);
// Keys recognized by either side work
C.parse({ a: "foo", b: "bar" }); // ✅
// Keys unrecognized by BOTH sides error
C.parse({ a: "foo", b: "bar", c: "extra" });
// ❌ ZodError: Unrecognized key: "c"
New locales
am) (#5531)uz) (#5519)import { uz } from "zod/locales";
z.config(uz());
Bug fixes
All of these changes fix soundness issues in Zod. As with any bug fix there's some chance of breakage if you were intentionally or unintentionally relying on this unsound behavior.
.pick()and.omit()disallowed on object schemas containing refinements (#5317)Using
.pick()or.omit()on object schemas with refinements now throws an error. Previously, this would silently drop the refinements, leading to unexpected behavior.password: z.string(),
confirmPassword: z.string(),
}).refine(data => data.password === data.confirmPassword);
schema.pick({ password: true });⚠️
// 4.2: refinement silently dropped
// 4.3: throws error ❌
Migration: The easiest way to migrate is to create a new schema using the
shapeof the old one..extend()disallowed on object schemas with refinements (#5317)Similarly,
.extend()will throws on schemas with refinements if you are overwriting existing properties.a: z.string()
}).refine(/* ... */);
schema.extend({ a: z.number() }); // 4.3: throws error ❌
Instead you can use
.safeExtend(), which statically ensures that you aren't changing the type signature of any pre-existing properties.a: z.string(),
}).refine(/* ... */);
schema.safeExtend({
a: z.string().min(5).max(10)
}); // ✅ allows overwrite, preserves refinement
Object masking methods (
.pick(),.omit()) now validate that the keys provided actually exist in the schema:// 4.3: throws error for unrecognized keys
schema.pick({ nonexistent: true });
// error: unrecognized key: "nonexistent"
Additional changes
z.iso.timewith minute precision (#5557)includesmethod params typing to acceptstring | $ZodCheckIncludesParams(#5556)implementAsyncinferred type to always be a promise (#5476)Dateinstances to numbers inminimum/maximumchecks (#5351)z.record()(#5585)~standardschema property (#5363)@ __NO_SIDE_EFFECTS__for better tree-shaking (#5475)Commits:
Features
Implement Standard JSON Schema
standard-schema/standard-schema#134
Implement
z.fromJSONSchema()type: "object",
...