chore: require zod4 or above #348

ymc9 · 2025-10-31T22:22:21Z

Summary by CodeRabbit

Breaking Changes
- Removed SWR plugin support
Chores
- Updated pnpm from 10.12.1 to 10.20.0
- Upgraded Zod from 3.25.0 to 4.1.0 (major version)
Bug Fixes
- Improved validation error handling for decimal values with enhanced issue mapping and error reporting

coderabbitai · 2025-10-31T22:22:31Z

Warning

Rate limit exceeded

@ymc9 has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 1 minutes and 13 seconds before requesting another review.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

📥 Commits

Reviewing files that changed from the base of the PR and between b69a71b and 84931a6.

📒 Files selected for processing (2)

packages/orm/src/client/crud/validator/utils.ts (3 hunks)
packages/orm/src/utils/zod-utils.ts (1 hunks)

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Walkthrough

This PR upgrades Zod from v3 to v4, updates validator type annotations from ZodSchema to ZodType, modifies error handling in decimal validation utilities, updates the package manager to [email protected], and reformats test schema files with double-quoted strings and consolidated imports.

Changes

Cohort / File(s)	Summary
Configuration & Package Updates `BREAKINGCHANGES.md`, `package.json`, `packages/orm/package.json`, `packages/server/package.json`, `packages/zod/package.json`, `pnpm-workspace.yaml`	Updated Zod from ~3.25.0 to ^4.1.0 across packages; updated pnpm from 10.12.1 to 10.20.0; narrowed workspace zod constraint to ^4.0.0 only; added SWR plugin removal to breaking changes
ORM Validator Type & Logic Updates `packages/orm/src/client/crud/validator/index.ts`	Changed all validator function return types and internal schemas from `ZodSchema` to `ZodType`; updated imports to remove `ZodSchema`; added explicit `any` typing to refine callback parameters
ORM Validator Error Handling `packages/orm/src/client/crud/validator/utils.ts`	Modified decimal validation error transformation to map `error.issues` into tailored Zod issues (too_small/too_big) with metadata; updated `applyValidation` refine options type inference and renamed error parameter from `message` to `error`
Test Utilities `packages/testtools/src/vitest-ext.ts`	Changed error message matching to be case-insensitive by converting both expected and actual messages to lowercase
Test Schema Files (basic, delegate, name-mapping, petstore, todo, typing) `tests/e2e/orm/schemas/\/input.ts`, `tests/e2e/orm/schemas/\/models.ts`, `tests/e2e/orm/schemas/\*/schema.ts`	Consolidated imports into single-line statements; reformatted type aliases and string literals from single quotes to double quotes; flattened multi-line payload type definitions to single-line declarations

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Zod v4 compatibility: Verify that the type change from ZodSchema to ZodType is compatible with Zod v4 API and doesn't break downstream validation behavior
Decimal validation error mapping: The custom error transformation logic in addDecimalValidation should be tested to ensure decimal constraints (gt, gte, lt, lte) produce correct error messages with proper metadata
Refine options type inference: Confirm that the inferred Parameters<typeof schema.refine>[1] type correctly captures refine callback options and that the message → error renaming aligns with Zod v4 API
Case-insensitive error matching: Ensure the lowercase comparison in expectErrorMessages doesn't mask legitimate test failures

Possibly related PRs

chore: update zod, add several helpers, CLI loads config from pkg.json #84: Related Zod v4 upgrade with validator import and type changes
feat: implement field validation #290: Related CRUD validator utilities modifications to addDecimalValidation and applyValidation error handling

Poem

🐰 From schema to schema, the quotes change their dress,
Double-quoted elegance, nothing less!
Zod hops from three to four with graceful stride,
Types refined, errors caught—our validators guide. ✨

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	You can run `@coderabbitai generate docstrings` to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The PR title "chore: require zod4 or above" accurately describes the primary objective of this changeset. The pull request demonstrates a comprehensive upgrade from Zod v3 to v4 across the codebase, with the most significant change being the update to pnpm-workspace.yaml that constrains zod to ^4.0.0 (removing support for ^3.25.0). Supporting changes include: bumping zod dependencies in multiple package.json files from ~3.25.0 to ^4.1.0, updating type annotations from ZodSchema to ZodType in validator code, modifying error handling patterns for zod4 compatibility, and reformatting code (quote styles) to comply with zod4 requirements. The title is concise, specific, and clearly communicates the breaking change in dependency constraints.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

claude · 2025-10-31T22:22:34Z

Claude finished @ymc9's task —— View job

PR Review: Zod 4 Migration

Reviewing this Zod 4 migration PR for code quality, bugs, performance, security, and test coverage.

Todo List

Analyze dependency updates and breaking changes
Review validator logic changes in ORM package
Check test schema updates for correctness
Evaluate performance and security implications
Provide comprehensive feedback and recommendations

Review Summary

This PR successfully migrates ZenStack to require Zod 4+, with mostly automated test file regeneration accounting for the large line count changes (1639 additions, 2675 deletions).

Critical Finding: Use of Deprecated `z.strictObject()`

⚠️ Major Issue: The codebase extensively uses z.strictObject() which is deprecated in Zod 4. Found 42 instances in packages/orm/src/client/crud/validator/index.ts.

Files needing updates:

packages/orm/src/client/crud/validator/index.ts (42 occurrences)

Example fix needed:

// Old (deprecated in Zod 4)
z.strictObject(fields)

// New (Zod 4 compatible)  
z.object(fields).strict()

Other Findings

✅ Good:

Breaking changes properly documented
All package.json files consistently updated to Zod ^4.1.0
Test schemas appropriately regenerated with cleaner type imports
No security concerns identified
Performance should be similar or improved with Zod 4

⚠️ Minor:

Large test file changes make it harder to review the actual logic changes
Consider running tests to verify validator behavior hasn't changed

Recommendations

Fix the strictObject deprecation - This should be addressed before merging as it may cause runtime warnings
Run comprehensive tests to ensure validator behavior is unchanged
Consider running linting to catch any other Zod 4 compatibility issues

The migration is well-structured but needs the deprecation fix to be complete.

Copilot

Pull Request Overview

This PR upgrades Zod from version 3.25.x to version 4.1.x and makes necessary code adjustments to accommodate breaking changes in Zod v4's API. The changes include:

Updating package dependencies to use Zod ^4.1.0
Modifying code to handle Zod v4 API changes (e.g., error?.issues instead of error?.errors, options.error instead of options.message)
Reformatting generated test schema files to use double quotes consistently
Updating error message comparison to be case-insensitive
Documenting the SWR plugin removal as a breaking change

Reviewed Changes

Copilot reviewed 27 out of 28 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pnpm-workspace.yaml	Updated Zod version constraint from `^3.25.0 \|\| ^4.0.0` to `^4.0.0`
packages/orm/src/client/crud/validator/utils.ts	Fixed Zod v4 API compatibility issues with error handling and validation
packages/orm/src/client/crud/validator/index.ts	Updated imports and type annotations for Zod v4 compatibility
packages/testtools/src/vitest-ext.ts	Made error message comparison case-insensitive
packages/*/package.json	Updated Zod dev dependencies to `^4.1.0`
tests/e2e/orm/schemas/*/schema.ts	Reformatted generated schema files with double quotes
BREAKINGCHANGES.md	Documented SWR plugin removal

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

packages/orm/src/client/crud/validator/utils.ts

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

packages/orm/src/client/crud/validator/index.ts (1)
1375-1375: Consider updating to ZodType for consistency.

Line 1375 still uses z.ZodSchema, while similar declarations elsewhere in the file (lines 833, 1110, 1132, 1141, 1260) have been updated to ZodType. For consistency with the Zod v4 migration, consider updating this as well.
-        let schema: z.ZodSchema = z.strictObject({
+        let schema: ZodType = z.strictObject({

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between f9cbedc and b69a71b.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (27)

BREAKINGCHANGES.md (1 hunks)
package.json (1 hunks)
packages/orm/package.json (1 hunks)
packages/orm/src/client/crud/validator/index.ts (8 hunks)
packages/orm/src/client/crud/validator/utils.ts (2 hunks)
packages/server/package.json (1 hunks)
packages/testtools/src/vitest-ext.ts (1 hunks)
packages/zod/package.json (1 hunks)
pnpm-workspace.yaml (1 hunks)
tests/e2e/orm/schemas/basic/input.ts (1 hunks)
tests/e2e/orm/schemas/basic/models.ts (1 hunks)
tests/e2e/orm/schemas/basic/schema.ts (1 hunks)
tests/e2e/orm/schemas/delegate/input.ts (1 hunks)
tests/e2e/orm/schemas/delegate/models.ts (1 hunks)
tests/e2e/orm/schemas/delegate/schema.ts (1 hunks)
tests/e2e/orm/schemas/name-mapping/input.ts (1 hunks)
tests/e2e/orm/schemas/name-mapping/models.ts (1 hunks)
tests/e2e/orm/schemas/name-mapping/schema.ts (1 hunks)
tests/e2e/orm/schemas/petstore/input.ts (1 hunks)
tests/e2e/orm/schemas/petstore/models.ts (1 hunks)
tests/e2e/orm/schemas/petstore/schema.ts (1 hunks)
tests/e2e/orm/schemas/todo/input.ts (1 hunks)
tests/e2e/orm/schemas/todo/models.ts (1 hunks)
tests/e2e/orm/schemas/todo/schema.ts (1 hunks)
tests/e2e/orm/schemas/typing/input.ts (1 hunks)
tests/e2e/orm/schemas/typing/models.ts (1 hunks)
tests/e2e/orm/schemas/typing/schema.ts (1 hunks)

🧰 Additional context used

📓 Path-based instructions (5)

{packages,samples,tests}/**