chore: upgrade to zod v4 - #4039
Open
carderne wants to merge 14 commits into
Open
Conversation
🦋 Changeset detectedLatest commit: 88ac588 The changes in this PR will be included in the next version bump. This PR includes changesets to release 27 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughPackage manifests and overrides update Zod versions, peer ranges, and dependency placement across the workspace. Core and webapp schemas switch to explicit string-keyed records and adjust a few field shapes. Webapp routes and components migrate to 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
@trigger.dev/build
trigger.dev
@trigger.dev/core
@trigger.dev/python
@trigger.dev/react-hooks
@trigger.dev/redis-worker
@trigger.dev/rsc
@trigger.dev/schema-to-json
@trigger.dev/sdk
commit: |
Contributor
|
Caution Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted. Error details |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
carderne
marked this pull request as ready for review
June 25, 2026 18:37
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
carderne
marked this pull request as draft
June 29, 2026 14:35
carderne
force-pushed
the
chore/zod-4
branch
3 times, most recently
from
July 3, 2026 15:00
c60f28b to
d42abf1
Compare
carderne
marked this pull request as ready for review
July 3, 2026 15:28
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
carderne
marked this pull request as draft
July 3, 2026 16:20
carderne
marked this pull request as ready for review
August 3, 2026 16:09
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Comment on lines
+667
to
+669
| "peerDependencies": { | ||
| "zod": "^3.25.0 || ^4.0.0" | ||
| } |
Contributor
There was a problem hiding this comment.
🔴 Installing the React hooks or build packages no longer pulls in a required validation library
The validation library is no longer installed automatically for anyone who installs the shared core library ("zod" moved to peerDependencies at packages/core/package.json:667-669), yet three published packages that load core's runtime code still declare no dependency on it, so installing them on their own leaves the library missing and they crash on import.
Impact: Users who add @trigger.dev/react-hooks, @trigger.dev/build, or @trigger.dev/rsc without also installing the SDK/CLI get a module-not-found failure at startup.
Why the peer-dependency move leaves sibling packages without zod
Before this PR, zod was a regular dependency of @trigger.dev/core, so any package depending on core got zod installed transitively. It is now devDependencies + peerDependencies only.
@trigger.dev/core still imports zod at runtime in its shipped entrypoints (e.g. packages/core/src/v3/apiClient/index.ts:1906 uses z.record(...)).
Published packages that depend on core but declare neither a zod dependency nor a zod peer:
packages/react-hooks/package.json— value importimport { ApiClient } from "@trigger.dev/core/v3"(packages/react-hooks/src/hooks/useApiClient.ts:4); this is the most likely standalone install (frontend apps that don't install the SDK).packages/build/package.json— value importimport { BuildManifest } from "@trigger.dev/core/v3"(packages/build/src/internal/additionalFiles.ts:1).packages/rsc/package.json.
@trigger.dev/sdk, trigger.dev (CLI) and @trigger.dev/redis-worker are fine — they declare zod as a peer or direct dependency.
Under pnpm (and any strict node_modules layout) the unmet peer is not hoisted, so require("zod") from inside core fails at import time.
Prompt for agents
Moving `zod` out of `@trigger.dev/core`'s `dependencies` into `peerDependencies` means packages that depend on core no longer get zod installed transitively. `@trigger.dev/react-hooks`, `@trigger.dev/build` and `@trigger.dev/rsc` are published packages that import core's runtime code (which imports zod) but declare no zod dependency or peer dependency of their own, so a standalone install of any of them will fail to resolve zod under strict node_modules layouts. Decide on a consistent policy: either add the same `"zod": "^3.25.0 || ^4.0.0"` peer dependency (plus a dev dependency pinned to 4.4.3) to those packages and include them in the changeset, or keep zod as a regular dependency of core.
Was this helpful? React with 👍 or 👎 to provide feedback.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Zod v4 compatibility
Upgrades the monorepo's internal zod version from 3.x to 4.4.3 and widens the peer
dependency on all published packages to
"^3.25.0 || ^4.0.0".For library consumers
No breaking change if you are on zod 3.25+. The peer dependency range is widened, not
narrowed — your existing zod 3.25+ install continues to satisfy it and the library code
is runtime-compatible with both versions. Zod 4.x is now also supported. Bumped as minor
across all affected packages.
Minimum zod 3 version is 3.25.0 (not 3.0.0).
API compatibility
Zod types appear in the public API of
@trigger.dev/coreand@trigger.dev/redis-worker(generic constraints like
T extends z.ZodTypeAny, exported schema values typed asz.ZodType<T>, andWorkerCatalog's schema field). These types exist in both zod 3 andzod 4, so TypeScript consumers on either version should resolve them without errors —
the shapes are structurally compatible across versions.
If you pass your own zod schemas into library APIs (e.g.
zodfetch,zodShapeStream,WorkerCatalog), schemas from zod 3.25+ and zod 4.x are both accepted.WorkerCatalogusesz.ZodFirstPartySchemaTypes, which is present in zod 4 via acompatibility alias but marked
@deprecated. This is intentional — the type is stillfully functional, and we've left it in place to avoid a breaking API change.
TODO list before merging