fix(deps): update dependency zod to v4.3.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
zod (source)	4.1.5 → 4.3.3

---

Release Notes

colinhacks/zod (zod)

v4.3.3

Compare Source

v4.3.2

Compare Source

v4.3.1

Compare Source

Commits:

• 0fe8840 allow non-overwriting extends with refinements. 4.3.1

v4.3.0

Compare Source

This is Zod's biggest release since 4.0. It addresses several of Zod's longest-standing feature requests.

z.fromJSONSchema()

Convert JSON Schema to Zod (#​5534, #​5586)

You can now convert JSON Schema definitions directly into Zod schemas. This function supports JSON Schema "draft-2020-12", "draft-7", "draft-4", and OpenAPI 3.0.

import * as z from "zod";

const schema = z.fromJSONSchema({
  type: "object",
  properties: {
    name: { type: "string", minLength: 1 },
    age: { type: "integer", minimum: 0 },
  },
  required: ["name"],
});

schema.parse({ name: "Alice", age: 30 }); // ✅

The API should be considered experimental. There are no guarantees of 1:1 "round-trip soundness": MySchema > z.toJSONSchema() > z.fromJSONSchema(). There are several features of Zod that don't exist in JSON Schema and vice versa, which makes this virtually impossible.

Features supported:

• All primitive types (string, number, integer, boolean, null, object, array)
• String formats (email, uri, uuid, date-time, date, time, ipv4, ipv6, and more)
• Composition (anyOf, oneOf, allOf)
• Object constraints (additionalProperties, patternProperties, propertyNames)
• Array constraints (prefixItems, items, minItems, maxItems)
• $ref for local references and circular schemas
• Custom metadata is preserved

z.xor() — exclusive union (#​5534)

A new exclusive union type that requires exactly one option to match. Unlike z.union() which passes if any option matches, z.xor() fails if zero or more than one option matches.

const schema = z.xor([z.string(), z.number()]);

schema.parse("hello"); // ✅
schema.parse(42);      // ✅
schema.parse(true);    // ❌ zero matches

When converted to JSON Schema, z.xor() produces oneOf instead of anyOf.

z.looseRecord() — partial record validation (#​5534)

A new record variant that only validates keys matching the key schema, passing through non-matching keys unchanged. This is used to represent patternProperties in JSON Schema.

const schema = z.looseRecord(z.string().regex(/^S_/), z.string());

schema.parse({ S_name: "John", other: 123 });
// ✅ { S_name: "John", other: 123 }
// only S_name is validated, "other" passes through

.exactOptional() — strict optional properties (#​5589)

A new wrapper that makes a property key-optional (can be omitted) but does not accept undefined as an explicit value.

const schema = z.object({
  a: z.string().optional(),      // accepts `undefined`
  b: z.string().exactOptional(), // does not accept `undefined`
});

schema.parse({});                  // ✅
schema.parse({ a: undefined });    // ✅
schema.parse({ b: undefined });    // ❌

This makes it possible to accurately represent the full spectrum of optionality expressible using exactOptionalPropertyTypes.

.apply()

A utility method for applying arbitrary transformations to a schema, enabling cleaner schema composition. (#​5463)

const setCommonChecks = <T extends z.ZodNumber>(schema: T) => {
  return schema.min(0).max(100);
};

const schema = z.number().apply(setCommonChecks).nullable();

.brand() cardinality

The .brand() method now accepts a second argument to control whether the brand applies to input, output, or both. Closes #​4764, #​4836.

// output only (default)
z.string().brand<"UserId">();           // output is branded (default)
z.string().brand<"UserId", "out">();    // output is branded
z.string().brand<"UserId", "in">();     // input is branded
z.string().brand<"UserId", "inout">();  // both are branded

Type predicates on .refine() (#​5575)

The .refine() method now supports type predicates to narrow the output type:

const schema = z.string().refine((s): s is "a" => s === "a");

type Input = z.input<typeof schema>;   // string
type Output = z.output<typeof schema>; // "a"

ZodMap methods: min, max, nonempty, size (#​5316)

ZodMap now has parity with ZodSet and ZodArray:

const schema = z.map(z.string(), z.number())
  .min(1)
  .max(10)
  .nonempty();

schema.size; // access the size constraint

.with() alias for .check() (359c0db)

A new .with() method has been added as a more readable alias for .check(). Over time, more APIs have been added that don't qualify as "checks". The new method provides a readable alternative that doesn't muddy semantics.

z.string().with(
  z.minLength(5),
  z.toLowerCase()
);

// equivalent to:
z.string().check(
  z.minLength(5),
  z.trim(),
  z.toLowerCase()
);

z.slugify() transform

Transform strings into URL-friendly slugs. Works great with .with():

// Zod
z.string().slugify().parse("Hello World");           // "hello-world"

// Zod Mini
// using .with() for explicit check composition
z.string().with(z.slugify()).parse("Hello World");   // "hello-world"

z.meta() and z.describe() in Zod Mini (947b4eb)

Zod Mini now exports z.meta() and z.describe() as top-level functions for adding metadata to schemas:

import * as z from "zod/mini";

// add description
const schema = z.string().with(
  z.describe("A user's name"),
);

// add arbitrary metadata
const schema2 = z.number().with(
  z.meta({ deprecated: true })
);

New locales

• Armenian (am) (#​5531)
• Uzbek (uz) (#​5519)

import * as z from "zod";
import { uz } from "zod/locales";

z.config(uz());

---

Bug fixes

All of these changes fix soundness issues in Zod. As with any bug fix there's some chance of breakage if you were intentionally or unintentionally relying on this unsound behavior.

⚠️ .pick() and .omit() disallowed on object schemas containing refinements (#​5317)

Using .pick() or .omit() on object schemas with refinements now throws an error. Previously, this would silently drop the refinements, leading to unexpected behavior.

const schema = z.object({
  password: z.string(),
  confirmPassword: z.string(),
}).refine(data => data.password === data.confirmPassword);

schema.pick({ password: true });
// 4.2: refinement silently dropped ⚠️
// 4.3: throws error ❌

Migration: The easiest way to migrate is to create a new schema using the shape of the old one.

const newSchema = z.object(schema.shape).pick({ ... })

⚠️ .extend() disallowed on refined schemas (#​5317)

Similarly, .extend() now throws on schemas with refinements. Use .safeExtend() if you need to extend refined schemas.

const schema = z.object({ a: z.string() }).refine(/* ... */);

// 4.2: refinement silently dropped ⚠️
// 4.3: throws error ✅
schema.extend({ b: z.number() });
// error: object schemas containing refinements cannot be extended. use `.safeExtend()` instead.

⚠️ Stricter object masking methods (#​5581)

Object masking methods (.pick(), .omit()) now validate that the keys provided actually exist in the schema:

const schema = z.object({ a: z.string() });

// 4.3: throws error for unrecognized keys
schema.pick({ nonexistent: true });
// error: unrecognized key: "nonexistent"

Additional changes

• Fixed JSON Schema generation for z.iso.time with minute precision (#​5557)
• Fixed error details for tuples with extraneous elements (#​5555)
• Fixed includes method params typing to accept string | $ZodCheckIncludesParams (#​5556)
• Fixed numeric formats error messages to be inclusive (#​5485)
• Fixed implementAsync inferred type to always be a promise (#​5476)
• Tightened E.164 regex to require a non-zero leading digit and 7–15 digits total (#​5524)
• Fixed Dutch (nl) error strings (#​5529)
• Convert Date instances to numbers in minimum/maximum checks (#​5351)
• Improved numeric keys handling in z.record() (#​5585)
• Lazy initialization of ~standard schema property (#​5363)
• Functions marked as @__NO_SIDE_EFFECTS__ for better tree-shaking (#​5475)
• Improved metadata tracking across child-parent relationships (#​5578)
• Improved locale translation approach (#​5584)
• Dropped id uniqueness enforcement at registry level (#​5574)

v4.2.1

Compare Source

v4.2.0

Compare Source

Features

Implement Standard JSON Schema

standard-schema/standard-schema#134

Implement z.fromJSONSchema()

const jsonSchema = {
  type: "object",
  properties: {
    name: { type: "string" },
    age: { type: "number" }
  },
  required: ["name"]
};

const schema = z.fromJSONSchema(jsonSchema);

Implement z.xor()

const schema = z.xor(
  z.object({ type: "user", name: z.string() }),
  z.object({ type: "admin", role: z.string() })
);
// Exactly one of the schemas must match

Implement z.looseRecord()

const schema = z.looseRecord(z.string(), z.number());
// Allows additional properties beyond those defined

Commits:

• af49c08 Update docs for JSON Schema conversion of z.undefined() (#​5504)
• 767f320 Add .toJSONSchema() method (#​5477)
• e17dcb6 Add z.fromJSONSchema(), z.looseRecord(), z.xor() (#​5534)

v4.1.13

Compare Source

v4.1.12

Compare Source

Commits:

• 0b109c3 docs(ecosystem): add bupkis to the ecosystem section (#​5237)
• d22ec0d docs(ecosystem): add upfetch (#​5238)
• c56a4f6 docs(ecosystem): add eslint-plugin-zod-x (#​5261)
• a0abcc0 docs(metadata.mdx): fix a mistake in an example output (#​5248)
• 62bf4e4 fix(ZodError): prevent flatten() from crashing on 'toString' key (#​5266)
• 02a5840 refac(errors): Unify code structure and improve types (#​5278)
• 4b1922a docs(content/v4/index): fix zod version (#​5289)
• 3fcb20f Add frrm to ecosystem (#​5292)
• fda4c7c Make docs work without token
• af44738 Fix lint
• 77c3c9f Export bg.ts
• 3b94610 v4.1.12

v4.1.11

Compare Source

Commits:

• 2bed4b3 4.1.11

v4.1.10

Compare Source

Commits:

• 7ffedd0 Fix shape caching (#​5263)
• 82cd717 v4.1.10

v4.1.9

Compare Source

Commits:

• a78716d Update zshy (#​5249)
• 923af80 Publish zod@​4.1.9

v4.1.8

Compare Source

Commits:

• 36c4ee3 Switch back to weakmap
• a1726d5 4.1.8

v4.1.7

Compare Source

Commits:

• 0cca351 Fix variable name inconsistency in coercion documentation (#​5188)
• aa78c27 Add copy/edit buttons
• 76452d4 Update button txt
• 937f73c Fix tsconfig issue in bench
• 976b436 v4.1.6 (#​5222)
• 4309c61 Fix cidrv6 validation - cidrv6 should reject invalid strings with multiple slashes (#​5196)
• ef95a73 feat(locales): Add Lithuanian (lt) locale (#​5210)
• 3803f3f docs: update wrong contents in codeblocks in api.mdx (#​5209)
• 8a47d5c docs: update coerce example in api.mdx (#​5207)
• e87db13 feat(locales): Add Georgian (ka) locale (#​5203)
• c54b123 docs: adds @traversable/zod and @traversable/zod-test to v4 ecosystem (#​5194)
• c27a294 Fix two tiny grammatical errors in the docs. (#​5193)
• 23a2d66 docs: fix broken links in async refinements and transforms references (#​5190)
• 845a230 fix(locales): Add type name translations to Spanish locale (#​5187)
• 27f13d6 Improve regex precision and eliminate duplicates in regexes.ts (#​5181)
• a8a52b3 fix(v4): fix Khmer and Ukrainian locales (#​5177)
• 887e37c Update slugs
• e1f1948 fix(v4): ensure array defaults are shallow-cloned (#​5173)
• 9f65038 docs(ecosystem): add DRZL; fix Prisma Zod Generator placement (#​5215)
• aa6f0f0 More fixes (#​5223)
• aab3356 4.1.7

v4.1.6

Compare Source

---

• If you want to rebase/retry this PR, check this box