Skip to content

chore(deps): bump zod to 4.1 #925

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 24, 2025
+121 −110
Merged

chore(deps): bump zod to 4.1 #925

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apps/content/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,6 @@
"vitepress-plugin-mermaid": "^2.0.17",
"vitepress-plugin-shiki-twoslash": "^0.0.6",
"vue": "^3.5.18",
"zod": "^4.0.17"
"zod": "^4.1.1"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

I noticed that the zod dependency version is explicitly defined and updated in multiple package.json files across this monorepo. To improve maintainability and ensure all packages use a consistent version, you could define the zod version in the root package.json and reference it using the workspace:* protocol in the individual package manifests.

This approach centralizes version management, which simplifies future updates as you would only need to change the version number in one place.

For example:

Root package.json:

{
  "devDependencies": {
    "zod": "^4.1.1"
  }
}

This package's package.json:

{
  "devDependencies": {
    "zod": "workspace:*"
  }
}

}
}
2 changes: 1 addition & 1 deletion packages/client/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,6 @@
"@orpc/standard-server-peer": "workspace:*"
},
"devDependencies": {
"zod": "^4.0.17"
"zod": "^4.1.1"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

I see that the zod dependency version is explicitly managed in many package.json files. For better maintainability in a monorepo, consider defining the version in the root package.json and using workspace:* in the individual packages. This ensures version consistency and simplifies future updates.

Example:

Root package.json:

{
  "devDependencies": {
    "zod": "^4.1.1"
  }
}

This package's package.json:

{
  "devDependencies": {
    "zod": "workspace:*"
  }
}

}
}
2 changes: 1 addition & 1 deletion packages/contract/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,6 @@
"devDependencies": {
"arktype": "2.1.20",
"valibot": "^1.1.0",
"zod": "^4.0.17"
"zod": "^4.1.1"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

I've noticed that the zod dependency is versioned individually in multiple packages. To improve maintainability and ensure consistency across the monorepo, you could define the version in the root package.json and reference it with workspace:* in the packages. This will make future updates easier to manage.

Example:

Root package.json:

{
  "devDependencies": {
    "zod": "^4.1.1"
  }
}

This package's package.json:

{
  "devDependencies": {
    "zod": "workspace:*"
  }
}

}
}
2 changes: 1 addition & 1 deletion packages/json-schema/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,6 @@
"@orpc/shared": "workspace:*"
},
"devDependencies": {
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion packages/nest/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,6 @@
"fastify": "^5.5.0",
"rxjs": "^7.8.1",
"supertest": "^7.1.4",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion packages/openapi/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,6 @@
"rou3": "^0.7.3"
},
"devDependencies": {
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion packages/react-query/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,6 @@
"devDependencies": {
"@tanstack/react-query": "^5.85.5",
"react": "^19.1.1",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion packages/react/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,6 @@
},
"devDependencies": {
"react": "^19.1.1",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion packages/shared/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,6 @@
"@opentelemetry/api": "^1.9.0",
"arktype": "2.1.20",
"valibot": "^1.1.0",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion packages/solid-query/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,6 @@
},
"devDependencies": {
"@tanstack/solid-query": "^5.85.5",
"zod": "^4.0.17"
"zod": "^4.1.1"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Zod bump to ^4.1.1 looks good; run a quick workspace-wide sanity check.

Change is scoped to devDependencies, which is low risk. To avoid drift and catch any packages that still import zod at runtime without declaring it as a dep/peer, run the script below.

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "1) Report any non-^4.1.1 zod versions across the repo"
fd -a -t f package.json | while read -r pkg; do
  dev=$(jq -r '(.devDependencies.zod // empty)' "$pkg")
  dep=$(jq -r '(.dependencies.zod // empty)' "$pkg")
  peer=$(jq -r '(.peerDependencies.zod // empty)' "$pkg")
  [[ -n "$dev" && "$dev" != "^4.1.1" ]] && echo "dev zod mismatch: $pkg -> $dev"
  [[ -n "$dep" ]]  && echo "has runtime dependency on zod: $pkg -> $dep"
  [[ -n "$peer" ]] && echo "has peer dependency on zod: $pkg -> $peer"
done

echo
echo "2) Flag packages that import zod at runtime but only list it as a devDependency"
fd -t f package.json | while read -r pkg; do
  dir=$(dirname "$pkg")
  # true if zod is declared as dep or peer
  if jq -e '(.dependencies.zod // empty) or (.peerDependencies.zod // empty)' "$pkg" >/dev/null; then
    continue
  fi
  # find non-type-only imports from 'zod' outside tests
  if rg -nP --glob '!**/test/**' --glob '!**/*.test.*' --glob '!**/__tests__/**' '^\s*import\s+(?!type\b).*from\s*[\'"]zod[\'"]' "$dir" >/dev/null 2>&1; then
    echo "Potential runtime import without dep/peer: $pkg"
    rg -nP --glob '!**/test/**' --glob '!**/*.test.*' --glob '!**/__tests__/**' '^\s*import\s+(?!type\b).*from\s*[\'"]zod[\'"]' "$dir" -n
  fi
done

echo
echo "3) Spot old zod entries in pnpm-lock (if present)"
[[ -f pnpm-lock.yaml ]] && rg -n '^  zod@' pnpm-lock.yaml | sed -n '1,30p' || true

Length of output: 17105

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== 1) packages/zod/package.json peerDependency on zod =="
jq '.peerDependencies.zod // "none"' packages/zod/package.json || true

echo
echo "== 2) Runtime imports of zod (excluding tests) =="
rg -nP --glob '!**/test/**' --glob '!**/*.test.*' --glob '!**/__tests__/**' \
  '^\s*import\s+(?!type\b).*from\s*[\'"]zod[\'"]' \
  --type-add 'ts:*.ts' --type-add 'tsx:*.tsx' \
  --type-add 'js:*.js' --type-add 'jsx:*.jsx' || echo "No runtime imports found"

echo
echo "== 3) Old zod entries in pnpm-lock.yaml =="
if [[ -f pnpm-lock.yaml ]]; then
  rg -n '^  zod@' pnpm-lock.yaml | head -n 20 || echo "No old zod entries"
else
  echo "pnpm-lock.yaml not present"
fi

Length of output: 453

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== 1) packages/zod/package.json peerDependency on zod =="
jq '.peerDependencies.zod // "none"' packages/zod/package.json || true

echo
echo "== 2) Runtime imports of zod (excluding tests) =="
rg -nP --glob '!**/test/**' --glob '!**/*.test.*' --glob '!**/__tests__/**' \
  -e "^\s*import\s+(?!type\\b).*from\s*['\"]zod['\"]" -n . || echo "No runtime imports found"

echo
echo "== 3) Old zod entries in pnpm-lock.yaml =="
if [[ -f pnpm-lock.yaml ]]; then
  rg -n '^  zod@' pnpm-lock.yaml | head -n 20 || echo "No old zod entries"
else
  echo "pnpm-lock.yaml not present"
fi

Length of output: 7976

Update packages/zod peerDependency and refresh lockfile

  • packages/zod/package.json still declares 
    "peerDependencies": {
  "zod": ">=3.25.0"
}
    Please bump this to "^4.1.1" to match the rest of the workspace.
  • All other packages’ devDependencies.zod entries are correctly ^4.1.1, and no published package (outside of playgrounds/docs) imports Zod at runtime without declaring it.
  • Your pnpm-lock.yaml still contains legacy Zod versions (3.22.3, 3.24.1, 3.25.76); run a lockfile update (e.g. pnpm install) to consolidate to 4.1.1.
🤖 Prompt for AI Agents 
In packages/solid-query/package.json around line 50, the workspace uses Zod v4
but packages/zod/package.json still lists a peerDependency of "zod": ">=3.25.0";
update that peerDependency to "zod": "^4.1.1" to match the workspace, then run
pnpm install (or pnpm update --recursive) to refresh pnpm-lock.yaml so legacy
3.x Zod versions are removed and the lockfile consolidates to 4.1.1.

}
}
2 changes: 1 addition & 1 deletion packages/svelte-query/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,6 @@
},
"devDependencies": {
"@tanstack/svelte-query": "^5.85.5",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion packages/tanstack-query/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,6 @@
"@tanstack/vue-query": "^5.85.5",
"svelte": "^5.38.2",
"vue": "^3.5.18",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion packages/trpc/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,6 @@
},
"devDependencies": {
"@trpc/server": "^11.4.3",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion packages/zod/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,6 @@
"wildcard-match": "^5.1.3"
},
"devDependencies": {
"zod": "^4.0.17"
"zod": "^4.1.1"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Confirm peer range still supports intended majors (v3 vs v4).

You bumped devDependency to ^4.1.1, while peerDependencies still allow "zod": ">=3.25.0". If @orpc/zod now targets v4 only (especially with zod4-specific code/tests), consider tightening to ">=4 <5" to prevent consumers from accidentally installing zod v3 at runtime. If v3 is still intentionally supported via a separate path, keeping the wide peer range is fine—please confirm.

If v3 is no longer supported, apply:

   "peerDependencies": {
     "@orpc/contract": "workspace:*",
     "@orpc/server": "workspace:*",
-    "zod": ">=3.25.0"
+    "zod": ">=4 <5"
   },

Repo-wide quick check to ensure consistency of zod versions across package.json files:

🏁 Script executed:

#!/bin/bash
# Lists all package.json entries that reference zod and their declared ranges
fd -t f package.json | while read -r f; do
  jq -r --arg f "$f" '
    [
      $f,
      (.dependencies.zod // empty),
      (.devDependencies.zod // empty),
      (.peerDependencies.zod // empty)
    ] | @tsv
  ' "$f"
done | awk -F'\t' '$2$3$4!="" { printf "%-60s  dep:%-12s devDep:%-12s peer:%-12s\n", $1, $2, $3, $4 }' | sort

Length of output: 13692

🏁 Script executed:

#!/bin/bash
# Display the first 200 lines of the zod package manifest for inspection
sed -n '1,200p' packages/zod/package.json

Length of output: 1286

🏁 Script executed:

#!/bin/bash
# List all source files in the zod package to inspect structure
find packages/zod/src -type f

Length of output: 1510

🏁 Script executed:

#!/bin/bash
# Show the contents of the main entry point to verify v3 support
sed -n '1,200p' packages/zod/src/index.ts

Length of output: 584

Confirm Zod v3 support or tighten peer range to v4-only

Our tests and dev setup are using Zod 4 exclusively (devDependency is "zod": "^4.1.1", and there are no root‐level tests against v3), yet the peerDependency still allows "zod": ">=3.25.0". If you no longer intend to maintain full v3 compatibility, you should narrow the peer range to v4 so downstream consumers won’t accidentally install Zod 3 at runtime.

• In packages/zod/package.json, update the peerDependency for Zod to only v4:

  "peerDependencies": {
    "@orpc/contract": "workspace:*",
    "@orpc/server": "workspace:*",
-   "zod": ">=3.25.0"
+   "zod": ">=4 <5"
  },

• Run a repo-wide check to ensure no other package.json still expects Zod 3.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"zod": "^4.1.1"
"peerDependencies": {
"@orpc/contract": "workspace:*",
"@orpc/server": "workspace:*",
"zod": ">=4 <5"
},
🤖 Prompt for AI Agents 
In packages/zod/package.json around line 55 the peerDependency for zod is too
permissive (">=3.25.0") while the code and devDependencies use Zod v4; update
the peerDependency to a v4-only range (for example ">=4.0.0 <5") to prevent
consumers from installing Zod 3, then run a repo-wide search (all package.json
files) to ensure no other packages declare or require Zod 3 and update them or
add compatibility notes as needed; after changing the peer range, run tests and
CI to verify nothing breaks.

}
}
1 change: 1 addition & 0 deletions packages/zod/src/zod4/coercer.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -354,6 +354,7 @@ export class experimental_ZodSmartCoercionPlugin<TContext extends Context> imple
| 'int'
| 'symbol'
| 'promise'
| 'function'
| 'custom'
= schema._zod.def.type

Expand Down
10 changes: 10 additions & 0 deletions packages/zod/src/zod4/converter.string.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,4 +148,14 @@ testSchemaConverter([
schema: z.templateLiteral([z.number(), z.enum(['px', 'em', 'rem', '%'])]) as any,
input: [true, { type: 'string', pattern: '^-?\\d+(?:\\.\\d+)?(px|em|rem|%)$' }],
},
{
name: 'z.hash("md5")',
schema: z.hash('md5'),
input: [true, { type: 'string', pattern: '^[0-9a-fA-F]{32}$' }],
},
{
name: 'z.hash("sha256", { enc: "base64" })',
schema: z.hash('sha256', { enc: 'base64' }),
input: [true, { type: 'string', pattern: '^[A-Za-z0-9+/]{43}=$' }],
},
])
2 changes: 1 addition & 1 deletion packages/zod/src/zod4/converter.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -556,7 +556,7 @@ export class ZodToJsonSchemaConverter implements ConditionalSchemaConverter {
}

default: {
const _unsupported: 'int' | 'symbol' | 'promise' | 'custom' = schema._zod.def.type
const _unsupported: 'function' | 'int' | 'symbol' | 'promise' | 'custom' = schema._zod.def.type
return [true, this.unsupportedJsonSchema]
}
}
Expand Down
2 changes: 1 addition & 1 deletion playgrounds/astro/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,6 @@
"react": "^19.1.1",
"react-dom": "^19.1.1",
"typescript": "^5.9.2",
"zod": "^4.0.17"
"zod": "^4.1.1"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Zod bump to ^4.1.1 looks good; verify it’s not used at runtime in this package.

Since zod is listed under devDependencies, ensure no code that ships (or example build output) imports zod at runtime. If any runtime import exists, promote it to dependencies or peerDependencies accordingly.

Run this repo-wide check from the root to confirm no runtime/source imports in the touched workspaces:

🏁 Script executed:

#!/bin/bash
# Find zod imports across updated packages' source trees
rg -nP -C2 --type=ts --type=tsx --type=js --type=jsx \
  "(from\\s+['\"]zod['\"]|require\\(['\"]zod['\"]\\))" \
  playgrounds/astro packages/nest playgrounds/electron apps/content packages/svelte-query

# If any matches appear under published package src (e.g., packages/*/src),
# zod should be a dependency or peerDependency rather than only a devDependency.

Length of output: 228

🏁 Script executed:

#!/bin/bash
# Search for any runtime imports of zod without relying on rg --type flags
rg -n -C2 "import\s+.*from\s+['\"]zod['\"]|require\(['\"]zod['\"]\)" \
  -g '*.js' -g '*.jsx' -g '*.ts' -g '*.tsx' \
  playgrounds/astro packages/nest playgrounds/electron apps/content packages/svelte-query

Length of output: 3505

Move Zod into runtime dependencies
The AST search shows that this package ships code importing Zod at runtime (e.g. in playgrounds/astro/src/router/sse.ts, router/planet.ts, and all schemas under playgrounds/astro/src/schemas/*.ts). Because Zod is only in devDependencies, consumers won’t get it when installing the package.

• Affected files:

  • playgrounds/astro/src/router/sse.ts
  • playgrounds/astro/src/router/planet.ts
  • playgrounds/astro/src/schemas/user.ts
  • playgrounds/astro/src/schemas/planet.ts
  • playgrounds/astro/src/schemas/auth.ts

• Required change: in playgrounds/astro/package.json, remove the Zod entry from devDependencies and add it under dependencies. For example:

--- package.json
@@
-  "devDependencies": {
-    "zod": "^4.1.1"
-    /* …other devDeps… */
-  },
+  "dependencies": {
+    "zod": "^4.1.1"
+    /* …other runtime deps… */
+  },
+  "devDependencies": {
+    /* …other devDeps (without zod)… */
+  },

Please update the package.json accordingly to ensure Zod is installed at runtime.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"zod": "^4.1.1"
@@ playgrounds/astro/package.json
- "devDependencies": {
- "zod": "^4.1.1"
- /* …other devDeps… */
"dependencies": {
"zod": "^4.1.1"
/* …other runtime deps… */
},
"devDependencies": {
/* …other devDeps (without zod)… */
},
🤖 Prompt for AI Agents 
In playgrounds/astro/package.json around line 29 the "zod" package is currently
listed only in devDependencies but is imported at runtime by files under
playgrounds/astro/src (router/sse.ts, router/planet.ts, and schemas/*), so move
"zod" from devDependencies into dependencies: remove the "zod" entry under
devDependencies and add the same version string under the top-level
"dependencies" object (preserve the version specifier "^4.1.1"), then run a
quick install to verify the package is resolved for consumers.

}
}
2 changes: 1 addition & 1 deletion playgrounds/browser-extension/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,6 @@
"react-dom": "^19.1.1",
"typescript": "^5.9.2",
"wxt": "^0.20.8",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion playgrounds/bun-websocket-otel/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,6 @@
"@types/react-dom": "^19.1.7",
"react": "^19.1.1",
"react-dom": "^19.1.1",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion playgrounds/cloudflare-worker/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,6 @@
"typescript": "^5.9.2",
"vite": "^6.3.5",
"wrangler": "^4.31.0",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion playgrounds/contract-first/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,6 @@
"@types/node": "^22.15.30",
"tsx": "^4.20.4",
"typescript": "^5.9.2",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion playgrounds/electron/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,6 @@
"react-dom": "^19.1.1",
"typescript": "^5.9.2",
"vite": "^6.3.5",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion playgrounds/nest/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,6 @@
"tsconfig-paths": "^4.2.0",
"typescript": "^5.9.2",
"unbuild": "^3.6.1",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion playgrounds/next/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,6 @@
"react-dom": "^19.1.1",
"server-only": "^0.0.1",
"typescript": "^5.9.2",
"zod": "^4.0.17"
"zod": "^4.1.1"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

LGTM on the zod bump; verify workspace-wide consistency and lockfile.

The upgrade to ^4.1.1 looks good for this playground. To avoid drift across the monorepo, please confirm all packages pin zod consistently and that the lockfile resolves to a single 4.1.x.

Run the script to audit all package.json files and the lockfile:

Optionally enforce a single version via a root override (pnpm):

 {
   "name": "orpc-monorepo",
   // ...
+  "pnpm": {
+    "overrides": {
+      "zod": "^4.1.1"
+    }
+  }
 }

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "==> Enumerating zod versions across the repo"
fd -a package.json | while read -r f; do
  for scope in dependencies devDependencies peerDependencies; do
    v=$(jq -r --arg s "$scope" '.[$s].zod // empty' "$f")
    if [ -n "$v" ]; then
      printf "%s\t%s\t%s\n" "$f" "$scope" "$v"
    fi
  done
done | sort | tee /tmp/zod-versions.txt

echo
echo "==> Any non-^4.1.x constraints?"
rg -nP -v '^\S+\t\S+\t\^4\.1\.' /tmp/zod-versions.txt || echo "All zod entries are ^4.1.x"

echo
if [ -f pnpm-lock.yaml ]; then
  echo "==> Lockfile zod entries (first 10 matches)"
  rg -n '(^\s*name:\s*zod$|zod@)' -n pnpm-lock.yaml -C2 | head -n 100 || true
else
  echo "No pnpm-lock.yaml found."
fi

echo
echo "==> Where is zod imported?"
rg -nP --glob '!**/dist/**' --glob '!**/.*/**' --type ts --type tsx --type js --type jsx '\bfrom\s+[\"\']zod[\"\']|\brequire\([\"\']zod[\"\']\)' -C2 || echo "No zod imports found."

Length of output: 28168

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "==> Enumerating zod version constraints across the repo"
fd -a package.json | while IFS= read -r f; do
  for scope in dependencies devDependencies peerDependencies; do
    v=$(jq -r --arg s "$scope" '.[$s].zod // empty' "$f")
    if [[ -n "$v" ]]; then
      printf "%s\t%s\t%s\n" "$f" "$scope" "$v"
    fi
  done
done | sort > /tmp/zod_versions.txt

echo
echo "==> All zod version constraints:"
cat /tmp/zod_versions.txt

echo
echo "==> Non-^4.1.x constraints:"
grep -nP -v '^\S+\t\S+\t\^4\.1\.' /tmp/zod_versions.txt || echo "None"

echo
if [[ -f pnpm-lock.yaml ]]; then
  echo "==> Zod entries in pnpm-lock.yaml (first 20 matches):"
  grep -n 'zod@' pnpm-lock.yaml | head -n20 || true
else
  echo "No pnpm-lock.yaml found."
fi

echo
echo "==> Zod import occurrences in code:"
rg -nP --glob '!**/dist/**' --glob '!**/.*/**' --type ts --type tsx --type js --type jsx '\bfrom\s+[\"\']zod[\"\']|\brequire\([\"\']zod[\"\']\)' -C2 || echo "No zod imports found."

Length of output: 31663

Action Required: Align zod peerDependency & prune lockfile entries

The audit shows that all consumer packages pin zod at ^4.1.1 in their dependencies, except the monorepo’s own packages/zod/package.json still allows any v3.x via its peerDependency, and the lockfile retains legacy v3 entries.

• In packages/zod/package.json, update the peerDependency constraint:

 "peerDependencies": {
-  "zod": ">=3.25.0"
+  "zod": "^4.1.1"
 }

• Regenerate/clean the lockfile so only zod@4.1.x remains (e.g. delete pnpm-lock.yaml and run pnpm install, or pnpm install --lockfile-only).
• (Optional) Enforce workspace-wide consistency via a root override in package.json:

 {
   "name": "orpc-monorepo",
   // …
+  "pnpm": {
+    "overrides": {
+      "zod": "^4.1.1"
+    }
+  }
 }

These changes will ensure a single zod version across the monorepo and remove outdated v3.x entries.

Committable suggestion skipped: line range outside the PR's diff.

🤖 Prompt for AI Agents 
In playgrounds/next/package.json (line 29) and the monorepo, update
packages/zod/package.json peerDependency to pin Zod v4 (e.g. "^4.1.1" or a caret
range that matches consumer deps) so it no longer allows v3.x; then remove the
stale lockfile (pnpm-lock.yaml) and regenerate it with pnpm install or pnpm
install --lockfile-only to prune v3 entries and ensure only zod@4.1.x remains;
optionally add a root-level package.json override/peerDependencyResolution to
enforce workspace-wide zod@4 consistency.

}
}
2 changes: 1 addition & 1 deletion playgrounds/nuxt/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,6 @@
"nuxt": "^3.17.7",
"vue": "latest",
"vue-router": "latest",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion playgrounds/solid-start/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,6 @@
"solid-js": "^1.9.9",
"vinxi": "^0.5.8",
"vite-plugin-top-level-await": "^1.6.0",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion playgrounds/svelte-kit/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,6 @@
"svelte-check": "^4.3.0",
"typescript": "^5.9.2",
"vite": "^6.3.5",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
2 changes: 1 addition & 1 deletion playgrounds/tanstack-start/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,6 @@
"react-dom": "^19.1.1",
"vite": "^6.3.5",
"vite-tsconfig-paths": "^5.1.4",
"zod": "^4.0.17"
"zod": "^4.1.1"
}
}
Loading