v27 is for Nikki Kuhnhausen (#3148)

<img width="1200" height="630" alt="image"
src="https://github.com/user-attachments/assets/5af2b247-bd39-4481-98a4-0ab6586afe49"
/>

Nikki Kuhnhausen was 17 years young transgender woman. She was murdered
by David Bogdanov in 2019. Her body was identified from decayed remains
on December 7th, in the Larch Mountain area near Vancouver, Washington.
Authorities were able to identify the body from personal effects;
subsequent examination showed she died from strangulation. Nikki had
previously been missing since June 5th when she left with David
Bogdanov, a 25-year-old male she met in Snapchat, who has since been
charged with second degree murder. Authorities believe that Bogdanov,
looking for a sexual encounter, became enraged upon learning of Nikki's
transgender origins.


https://katu.com/news/local/missing-vancouver-teen-nikki-kuhnhausen-found-dead-in-remote-clark-county-location-suspect-arrested

Transgender women suffer too frequently from transphobic violence and
cruelty, being the less protected social group. I'd like to raise an
awareness of this problem. Humans should be creators — not killers. But
most importantly, I want every transgender girl to have an opportunity
to create applications quickly and, in general, learn to write code
easily in order to receive job offers and leave dangerously transphobic
territories for more favorable and civilized ones, and live happily
there. Protect transgender women.

------------------

Version 27 makes `typescript` an optional peer dependency with explicit
injection of the manually imported module into the `Integration` class
constructor (`new Integration({ typescript, ... })`), or by calling the
new async `Integration.create()` factory method for automatic loading.
The Zod Plugin now leverages Zod 4.3's inheritable metadata feature,
removing the need for `pack()` and `unpack()` helpers while simplifying
brand handling by storing brands in standard metadata under `x-brand`
property.

- #3149 
- #3162 

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Async Integration.create() factory and optional TypeScript injection
for client generation
  * Zod metadata is inheritable (requires Zod ^4.3.4)

* **Breaking Changes**
* pack/unpack/setBrand removed; branding exposed as "x-brand" via
schema.meta()
* Integration constructor now accepts a typescript option and usage may
require async create()

* **Documentation**
  * Examples updated for TypeScript injection and async create() usage

* **Chores**
  * Version bumps to v27 beta and updated CI branch targets

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

Author: RobinTail

.github/workflows/codeql-analysis.yml

@@ -13,10 +13,10 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ master, v22, v23, v24, v25 ]
+    branches: [ master, v23, v24, v25, v26 ]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ master, v22, v23, v24, v25 ]
+    branches: [ master, v23, v24, v25, v26 ]
   schedule:
     - cron: '26 8 * * 1'
 

.github/workflows/node.js.yml

@@ -5,9 +5,9 @@ name: Node.js CI
 
 on:
   push:
-    branches: [ master, v22, v23, v24, v25 ]
+    branches: [ master, v23, v24, v25, v26 ]
   pull_request:
-    branches: [ master, v22, v23, v24, v25 ]
+    branches: [ master, v23, v24, v25, v26 ]
 
 jobs:
   build:

CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## Version 27
+
+### v27.0.0
+
+- Supported `zod` versions: `^4.3.4`;
+- The new version of Zod Plugin utilizes the inheritable metadata feature of Zod 4.3;
+- The `typescript` dependency is now optional and only required for making `Integration`:
+  - Either import and assign the `typescript` property to its constructor argument;
+  - Or use the new static async method `create()` to delegate the import;
+  - This change addresses the memory consumption issue fixed previously in v26.1.0, but with proper ESM handling.
+
+```diff
+  /** Option 1: import and assign */
+  import { Integration } from "express-zod-api";
++ import typescript from "typescript";
+
+  const client = new Integration({
+    routing,
+    config,
++   typescript,
+  });
+```
+
+```diff
+  /** Option 2: delegate asynchronously */
+  import { Integration } from "express-zod-api";
+
+- const client = new Integration({
++ const client = await Integration.create({
+    routing,
+    config,
+  });
+```
+
 ## Version 26
 
 ### v26.3.2

README.md

@@ -182,7 +182,7 @@ Install the framework, its peer dependencies and type assistance packages using
 
 ```shell
 # example for pnpm:
-pnpm add express-zod-api express zod typescript http-errors
+pnpm add express-zod-api express zod http-errors
 pnpm add -D @types/express @types/node @types/http-errors
 ```
 
@@ -1076,13 +1076,15 @@ adding the runtime helpers the framework relies on.
 
 ## Generating a Frontend Client
 
-You can generate a TypeScript file containing the IO types of your API and a client for it.
-Consider installing `prettier` and using the async `printFormatted()` method.
+You can generate a TypeScript file containing the IO types of your API and a client for it. Make sure you have
+`typescript` installed. Consider also installing `prettier` and using the async `printFormatted()` method.
 
 ```ts
+import typescript from "typescript";
 import { Integration } from "express-zod-api";
 
 const client = new Integration({
+  typescript, // or await Integration.create() to delegate importing
   routing,
   config,
   variant: "client", // <— optional, see also "types" for a DIY solution

SECURITY.md

@@ -4,11 +4,12 @@
 
 | Version | Code name     | Release |     Supported      |
 | ------: | :------------ | :------ | :----------------: |
+|  27.x.x | Nikki         | 02.2026 | :white_check_mark: |
 |  26.x.x | Lia           | 12.2025 | :white_check_mark: |
 |  25.x.x | Sara          | 08.2025 | :white_check_mark: |
 |  24.x.x | Ashley        | 06.2025 | :white_check_mark: |
 |  23.x.x | Sonia         | 04.2025 | :white_check_mark: |
-|  22.x.x | Tai           | 01.2025 | :white_check_mark: |
+|  22.x.x | Tai           | 01.2025 |        :x:         |
 |  21.x.x | Kesaria       | 11.2024 |        :x:         |
 |  20.x.x | Zoey          | 06.2024 |        :x:         |
 |  19.x.x | Dime          | 05.2024 |        :x:         |

compat-test/eslint.config.js

@@ -3,5 +3,5 @@ import migration from "@express-zod-api/migration";
 
 export default [
   { languageOptions: { parser }, plugins: { migration } },
-  { files: ["**/*.ts"], rules: { "migration/v26": "error" } },
+  { files: ["**/*.ts"], rules: { "migration/v27": "error" } },
 ];

compat-test/migration.spec.ts

@@ -4,6 +4,8 @@ import { describe, test, expect } from "vitest";
 describe("Migration", () => {
   test("should fix the import", async () => {
     const fixed = await readFile("./sample.ts", "utf-8");
-    expect(fixed).toBe(`const route = {\nget: someEndpoint,\n}\n`);
+    expect(fixed).toBe(
+      `import typescript from "typescript";\n\nnew Integration({ typescript, routing });\n`,
+    );
   });
 });

compat-test/package.json

@@ -3,7 +3,7 @@
   "type": "module",
   "private": true,
   "scripts": {
-    "pretest": "echo 'const route = new DependsOnMethod({ get: someEndpoint })' > sample.ts",
+    "pretest": "echo 'new Integration({ routing });' > sample.ts",
     "test": "eslint --fix && vitest --run",
     "posttest": "rm sample.ts"
   },

eslint.config.js

@@ -176,6 +176,10 @@ const tsFactoryConcerns = [
     selector: "Identifier[name='createUnionTypeNode']",
     message: "use makeUnion() helper",
   },
+  {
+    selector: "Identifier[name='createIdentifier']",
+    message: "use makeId() helper",
+  },
 ];
 
 export default tsPlugin.config(
@@ -238,11 +242,7 @@ export default tsPlugin.config(
     files: ["migration/index.ts"],
     rules: {
       "allowed/dependencies": ["error", { packageDir: migrationDir }],
-      "no-restricted-syntax": [
-        "warn",
-        ...importConcerns,
-        ...performanceConcerns,
-      ],
+      "no-restricted-syntax": ["warn", ...importConcerns],
     },
   },
   {

example/generate-client.ts

@@ -2,10 +2,12 @@ import { writeFile } from "node:fs/promises";
 import { Integration } from "express-zod-api";
 import { routing } from "./routing";
 import { config } from "./config";
+import typescript from "typescript";
 
 await writeFile(
   "example.client.ts",
   await new Integration({
+    typescript,
     routing,
     config,
     serverUrl: `http://localhost:${config.http!.listen}`,