Closes #21. Smaller migration than the issue anticipated because the codebase never used the APIs that changed incompatibly (`.merge()`, `.deepPartial()`, coerce, `.email()`/`.url()`, `.format()` on ZodError). - zod: 3.25.76 → 4.3.6 in @opencodehub/mcp + @opencodehub/sarif - sarif schemas: `z.record(z.string())` → `z.record(z.string(), z.string())` (Zod 4 drops the single-arg form and requires an explicit key schema) `.passthrough()` is deprecated in Zod 4 but still functional and the recommended smallest-diff path; all 11 SARIF call sites continue to work against the Zod 4 runtime. A separate cleanup PR can migrate them to `z.looseObject(...)` or `.loose()` if/when we want. Zod 3.25.76 remains in the dep tree transitively via @graphty/algorithms → pupt. Direct deps are exclusively on 4.3.6; no source-level mixing. Verified locally under @types/node@20.19.16 / Node 22: - pnpm -r build: clean - pnpm -r exec tsc --noEmit: clean - pnpm -r test: 952 pass / 0 fail - pnpm -F @opencodehub/sarif run validate-schema: 4 pass / 0 fail - biome ci, banned-strings, license-checker: green

Commits

Commits on Apr 23, 2026

feat: bump zod 3.25.76 → 4.3.6