feat(deps): upgrade zod from v3 to v4 (#3153)

- Replace z.record(z.unknown()) with z.record(z.string(), z.unknown()) (breaking change v4)
- Replace z.ZodIssueCode.custom string enum with plain 'custom' string literal
- Replace invalid_type_error param with error param in z.string()
- Remove .strip() (now default behavior in v4)
- Add input field to ctx.addIssue() calls per v4 API

Closes #3149

Author: PierreBrisorgueil

lib/helpers/zod.js

@@ -3,16 +3,15 @@
  */
 import zxcvbn from 'zxcvbn';
 import config from '../../config/index.js';
-import { z } from 'zod';
 
 /**
  * @desc Zod superRefine for zxcvbn password strength
  */
 const passwordRefinement = (val, ctx) => {
   if (config.zxcvbn.forbiddenPasswords.includes(val)) {
-    ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'password is too common' });
+    ctx.addIssue({ code: 'custom', message: 'password is too common', input: val });
   } else if (zxcvbn(val).score < config.zxcvbn.minimumScore) {
-    ctx.addIssue({ code: z.ZodIssueCode.custom, message: `password must have a strength of at least ${config.zxcvbn.minimumScore}` });
+    ctx.addIssue({ code: 'custom', message: `password must have a strength of at least ${config.zxcvbn.minimumScore}`, input: val });
   }
 };
 

modules/tasks/models/tasks.schema.js

@@ -7,10 +7,10 @@ import { z } from 'zod';
  *  Data Schema
  */
 const Task = z.object({
-  title: z.string({ invalid_type_error: 'title must be a string' }).trim().min(1),
+  title: z.string({ error: 'title must be a string' }).trim().min(1),
   description: z.string().default(''),
   user: z.string().trim().default(''),
-}).strip();
+});
 
 const TaskUpdate = Task.partial();
 

modules/users/models/user.schema.js

@@ -21,7 +21,7 @@ const User = z.object({
   roles: z.array(z.enum(config.whitelists.users.roles)).min(1).default(['user']),
   /* Provider */
   provider: z.string().optional(),
-  providerData: z.record(z.unknown()).optional(),
+  providerData: z.record(z.string(), z.unknown()).optional(),
   /* Password */
   password: z.string()
     .max(config.zxcvbn.maxSize)
@@ -30,16 +30,16 @@ const User = z.object({
       if (val === '') return; // allow empty (OAuth users / no password set)
       zodHelpers.passwordRefinement(val, ctx);
       if (val.length < config.zxcvbn.minSize) {
-        ctx.addIssue({ code: z.ZodIssueCode.custom, message: `Password length must be at least ${config.zxcvbn.minSize} characters long` });
+        ctx.addIssue({ code: 'custom', message: `Password length must be at least ${config.zxcvbn.minSize} characters long`, input: val });
       }
     }),
   resetPasswordToken: z.string().nullable().optional(),
   resetPasswordExpires: z.coerce.date().nullable().optional(),
   // startup requirement
   terms: z.coerce.date().nullable().optional(),
   // others
-  complementary: z.record(z.unknown()).nullable().optional(),
-}).strip();
+  complementary: z.record(z.string(), z.unknown()).nullable().optional(),
+});
 
 const UserUpdate = User.partial();
 

package-lock.json

@@ -89,7 +89,7 @@
     "swagger-ui-express": "^5.0.1",
     "ts-jest": "^29.4.6",
     "winston": "^3.19.0",
-    "zod": "^3.25.76",
+    "zod": "^4.3.6",
     "zxcvbn": "^4.4.2"
   },
   "devDependencies": {