deps: Upgrade to Zod 4 (#1461)

Co-authored-by: Charles Vien <charles.v@posthog.com>

Author: ryans-posthog

.github/workflows/code-release.yml

@@ -220,4 +220,6 @@ jobs:
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           APP_VERSION: ${{ steps.version.outputs.version }}
-        run: gh release edit "v$APP_VERSION" --repo PostHog/code --draft=false --generate-notes
+        run: |
+          gh api repos/PostHog/code/releases/generate-notes -f tag_name="v$APP_VERSION" --jq '.body' > /tmp/release-notes.md
+          gh release edit "v$APP_VERSION" --repo PostHog/code --draft=false --notes-file /tmp/release-notes.md

apps/code/src/main/services/agent/schemas.ts

@@ -63,50 +63,42 @@ export const modelOptionSchema = z.object({
 
 export type ModelOption = z.infer<typeof modelOptionSchema>;
 
-const sessionConfigSelectOptionSchema = z
-  .object({
-    value: z.string(),
-    name: z.string(),
-    description: z.string().nullish(),
-    _meta: z.record(z.string(), z.unknown()).nullish(),
-  })
-  .passthrough();
-
-const sessionConfigSelectGroupSchema = z
-  .object({
-    group: z.string(),
-    name: z.string(),
-    options: z.array(sessionConfigSelectOptionSchema),
-    _meta: z.record(z.string(), z.unknown()).nullish(),
-  })
-  .passthrough();
-
-const sessionConfigSelectSchema = z
-  .object({
-    id: z.string(),
-    name: z.string(),
-    type: z.literal("select"),
-    currentValue: z.string(),
-    options: z
-      .array(sessionConfigSelectOptionSchema)
-      .or(z.array(sessionConfigSelectGroupSchema)),
-    category: z.string().nullish(),
-    description: z.string().nullish(),
-    _meta: z.record(z.string(), z.unknown()).nullish(),
-  })
-  .passthrough();
-
-const sessionConfigBooleanSchema = z
-  .object({
-    id: z.string(),
-    name: z.string(),
-    type: z.literal("boolean"),
-    currentValue: z.boolean(),
-    category: z.string().nullish(),
-    description: z.string().nullish(),
-    _meta: z.record(z.string(), z.unknown()).nullish(),
-  })
-  .passthrough();
+const sessionConfigSelectOptionSchema = z.looseObject({
+  value: z.string(),
+  name: z.string(),
+  description: z.string().nullish(),
+  _meta: z.record(z.string(), z.unknown()).nullish(),
+});
+
+const sessionConfigSelectGroupSchema = z.looseObject({
+  group: z.string(),
+  name: z.string(),
+  options: z.array(sessionConfigSelectOptionSchema),
+  _meta: z.record(z.string(), z.unknown()).nullish(),
+});
+
+const sessionConfigSelectSchema = z.looseObject({
+  id: z.string(),
+  name: z.string(),
+  type: z.literal("select"),
+  currentValue: z.string(),
+  options: z
+    .array(sessionConfigSelectOptionSchema)
+    .or(z.array(sessionConfigSelectGroupSchema)),
+  category: z.string().nullish(),
+  description: z.string().nullish(),
+  _meta: z.record(z.string(), z.unknown()).nullish(),
+});
+
+const sessionConfigBooleanSchema = z.looseObject({
+  id: z.string(),
+  name: z.string(),
+  type: z.literal("boolean"),
+  currentValue: z.boolean(),
+  category: z.string().nullish(),
+  description: z.string().nullish(),
+  _meta: z.record(z.string(), z.unknown()).nullish(),
+});
 
 export const sessionConfigOptionSchema = z.union([
   sessionConfigSelectSchema,
@@ -124,13 +116,11 @@ export const sessionResponseSchema = z.object({
 export type SessionResponse = z.infer<typeof sessionResponseSchema>;
 
 // Prompt input/output
-export const contentBlockSchema = z
-  .object({
-    type: z.string(),
-    text: z.string().optional(),
-    _meta: z.record(z.string(), z.unknown()).nullish(),
-  })
-  .passthrough();
+export const contentBlockSchema = z.looseObject({
+  type: z.string(),
+  text: z.string().optional(),
+  _meta: z.record(z.string(), z.unknown()).nullish(),
+});
 
 export const promptInput = z.object({
   sessionId: z.string(),

apps/code/src/main/services/oauth/schemas.ts

@@ -66,6 +66,6 @@ export const cancelFlowOutput = z.object({
 export type CancelFlowOutput = z.infer<typeof cancelFlowOutput>;
 
 export const openExternalUrlInput = z.object({
-  url: z.string().url(),
+  url: z.url(),
 });
 export type OpenExternalUrlInput = z.infer<typeof openExternalUrlInput>;

packages/agent/package.json

@@ -112,7 +112,7 @@
     "tar": "^7.5.0",
     "uuid": "13.0.0",
     "yoga-wasm-web": "^0.3.3",
-    "zod": "^3.24.1"
+    "zod": "^4.2.0"
   },
   "files": [
     "dist/**/*",

packages/agent/src/server/bin.ts

@@ -7,25 +7,21 @@ import { claudeCodeConfigSchema, mcpServersSchema } from "./schemas";
 const envSchema = z.object({
   JWT_PUBLIC_KEY: z
     .string({
-      required_error:
-        "JWT_PUBLIC_KEY is required for authenticating client connections",
+      error: "JWT_PUBLIC_KEY is required for authenticating client connections",
     })
     .min(1, "JWT_PUBLIC_KEY cannot be empty"),
-  POSTHOG_API_URL: z
-    .string({
-      required_error:
-        "POSTHOG_API_URL is required for LLM gateway communication",
-    })
-    .url("POSTHOG_API_URL must be a valid URL"),
+  POSTHOG_API_URL: z.url({
+    error: "POSTHOG_API_URL is required for LLM gateway communication",
+  }),
   POSTHOG_PERSONAL_API_KEY: z
     .string({
-      required_error:
+      error:
         "POSTHOG_PERSONAL_API_KEY is required for authenticating with PostHog services",
     })
     .min(1, "POSTHOG_PERSONAL_API_KEY cannot be empty"),
   POSTHOG_PROJECT_ID: z
     .string({
-      required_error:
+      error:
         "POSTHOG_PROJECT_ID is required for routing requests to the correct project",
     })
     .regex(/^\d+$/, "POSTHOG_PROJECT_ID must be a numeric string")
@@ -34,7 +30,7 @@ const envSchema = z.object({
 
 const program = new Command();
 
-function parseJsonOption<S extends z.ZodTypeAny>(
+function parseJsonOption<S extends z.ZodType>(
   raw: string | undefined,
   schema: S,
   flag: string,

packages/agent/src/server/schemas.ts

@@ -8,7 +8,7 @@ const httpHeaderSchema = z.object({
 const remoteMcpServerSchema = z.object({
   type: z.enum(["http", "sse"]),
   name: z.string().min(1, "MCP server name is required"),
-  url: z.string().url("MCP server url must be a valid URL"),
+  url: z.url({ error: "MCP server url must be a valid URL" }),
   headers: z.array(httpHeaderSchema).default([]),
 });
 
@@ -35,7 +35,7 @@ export const claudeCodeConfigSchema = z.object({
 export const jsonRpcRequestSchema = z.object({
   jsonrpc: z.literal("2.0"),
   method: z.string(),
-  params: z.record(z.unknown()).optional(),
+  params: z.record(z.string(), z.unknown()).optional(),
   id: z.union([z.string(), z.number()]).optional(),
 });
 

packages/electron-trpc/package.json

@@ -38,7 +38,7 @@
     "typescript": "^5.8.3",
     "vite": "^6.0.7",
     "vitest": "^2.1.8",
-    "zod": "^3.24.1"
+    "zod": "^4.2.0"
   },
   "peerDependencies": {
     "@trpc/client": ">=11.0.0",