Update dependency zod to v4 [SECURITY] (#54072)

* Update dependency zod to v4 [SECURITY]
* Fix type errors from the zod 4 upgrade
  Zod 4's ZodSchema/ZodType infer `unknown` where Zod 3 inferred `any`, and
z.record() now requires a key schema.

---------

Co-authored-by: Renovate Bot <bot@renovateapp.com>
Co-authored-by: Xavier Lozano Carreras <xavier.lozano.carreras@automattic.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: 4 people

pnpm-lock.yaml

@@ -38,6 +38,8 @@ minimumReleaseAgeExclude:
   - '@wordpress/*'
   - 'gridicons'
   - 'wpcom-proxy-request'
+  # Renovate security update: zod@4.6.6
+  - zod@4.6.6
 
 trustPolicy: no-downgrade
 trustPolicyExclude:

pnpm-workspace.yaml

@@ -0,0 +1,4 @@
+Significance: patch
+Type: changed
+
+Update package dependencies.

projects/js-packages/boost-score-api/changelog/renovate-npm-zod-vulnerability

@@ -31,7 +31,7 @@
 	},
 	"dependencies": {
 		"@wordpress/i18n": "6.30.0",
-		"zod": "3.25.76"
+		"zod": "4.6.6"
 	},
 	"devDependencies": {
 		"@jest/globals": "30.5.2",

projects/js-packages/boost-score-api/package.json

@@ -0,0 +1,4 @@
+Significance: patch
+Type: changed
+
+Update package dependencies.

projects/js-packages/react-data-sync-client/changelog/renovate-npm-zod-vulnerability

@@ -36,13 +36,13 @@
 	},
 	"peerDependencies": {
 		"react": "^18.0.0 || ^19.0.0",
-		"zod": "^3.0.0"
+		"zod": "^4.6.6"
 	},
 	"devDependencies": {
 		"@typescript/native-preview": "7.0.0-dev.20260707.2",
 		"jest": "30.5.2",
 		"react": "19.3.0",
 		"react-dom": "^19.3.0",
-		"zod": "3.25.76"
+		"zod": "4.6.6"
 	}
 }

projects/js-packages/react-data-sync-client/package.json

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { DataSyncError } from './DataSyncError';
-import type { JSONSchema, ParsedValue } from './types';
+import type { AnySchema, JSONSchema, ParsedValue } from './types';
 
 export type RequestParams = string | JSONSchema;
 type RequestMethods = 'GET' | 'POST' | 'DELETE';
@@ -19,7 +19,7 @@ type GetRequestParams = Record< string, string | number | null | Array< string |
  *
  * Note: The keys are converted to be snake_case in Objects, but kebab-case in URLs.
  */
-export class DataSync< Schema extends z.ZodSchema, Value extends z.infer< Schema > > {
+export class DataSync< Schema extends AnySchema, Value extends z.infer< Schema > > {
 	/**
 	 * WordPress REST API Endpoint configuration.
 	 * @param wpDatasyncUrl - For example: http://localhost/wp-json/jetpack-favorites
@@ -133,7 +133,7 @@ export class DataSync< Schema extends z.ZodSchema, Value extends z.infer< Schema
 	 * @param valueSchema - The Zod schema to validate the value against.
 	 * @returns The parsed value.
 	 */
-	private getWindowValue< V extends z.ZodSchema >(
+	private getWindowValue< V extends AnySchema >(
 		valueName: string,
 		valueSchema: V
 	): ParsedValue< V > {
@@ -417,7 +417,7 @@ export class DataSync< Schema extends z.ZodSchema, Value extends z.infer< Schema
 	 * @param value - The value to send to the endpoint.
 	 * @returns A direct response from the endpoint.
 	 */
-	public ACTION = async < T extends RequestParams, R extends z.ZodSchema >(
+	public ACTION = async < T extends RequestParams, R extends AnySchema >(
 		name: string,
 		value: T,
 		schema: R

projects/js-packages/react-data-sync-client/src/DataSync.ts

@@ -12,6 +12,7 @@ import { createElement, useCallback, useEffect, useState } from 'react';
 import { z } from 'zod';
 import { DataSync } from './DataSync';
 import { DataSyncError } from './DataSyncError';
+import type { AnySchema } from './types';
 import type { ReactNode } from 'react';
 
 /**
@@ -38,14 +39,14 @@ export function DataSyncProvider( props: { children: ReactNode } ) {
  */
 type DataSyncMutation< Value > = Omit< UseMutationOptions< Value >, 'mutationKey' >;
 type DataSyncQuery< Value > = Omit< UseQueryOptions< Value >, 'queryKey' >;
-type DataSyncConfig< Schema extends z.ZodSchema, Value extends z.infer< Schema > > = {
+type DataSyncConfig< Schema extends AnySchema, Value extends z.infer< Schema > > = {
 	query?: DataSyncQuery< Value >;
 	mutation?: DataSyncMutation< Value >;
 };
 /**
  * This is what `useDataSync` returns
  */
-type DataSyncHook< Schema extends z.ZodSchema, Value extends z.infer< Schema > > = [
+type DataSyncHook< Schema extends AnySchema, Value extends z.infer< Schema > > = [
 	UseQueryResult< Value >,
 	UseMutationResult< Value, DataSyncError | Error, Value >,
 ];
@@ -77,7 +78,7 @@ function buildQueryKey( key: string, params: Record< string, string | number > )
  * @see https://tanstack.com/query/v5/docs/react/reference/useMutation
  */
 export function useDataSync<
-	Schema extends z.ZodSchema,
+	Schema extends AnySchema,
 	Value extends z.infer< Schema >,
 	Key extends string,
 >(
@@ -205,10 +206,10 @@ export function useDataSync<
  * Use React Query mutations to dispatch custom DataSync Actions.
  */
 export type DataSyncActionConfig<
-	ActionRequestSchema extends z.ZodSchema,
+	ActionRequestSchema extends AnySchema,
 	ActionRequestData extends z.infer< ActionRequestSchema >,
-	StateSchema extends z.ZodSchema,
-	ActionSchema extends z.ZodSchema,
+	StateSchema extends AnySchema,
+	ActionSchema extends AnySchema,
 	ActionResult extends z.infer< ActionSchema >,
 	CurrentState extends z.infer< StateSchema >,
 > = {
@@ -274,9 +275,9 @@ export type DataSyncActionConfig<
 	params?: Record< string, string | number >;
 };
 export function useDataSyncAction<
-	StateSchema extends z.ZodSchema,
-	ActionSchema extends z.ZodSchema,
-	ActionRequestSchema extends z.ZodSchema,
+	StateSchema extends AnySchema,
+	ActionSchema extends AnySchema,
+	ActionRequestSchema extends AnySchema,
 	ActionRequestData extends z.infer< ActionRequestSchema >,
 	ActionResult extends z.infer< ActionSchema >,
 	CurrentState extends z.infer< StateSchema >,
@@ -368,7 +369,7 @@ type SubsetMutation< T > = {
 };
 
 export function useDataSyncSubset<
-	Schema extends z.ZodSchema,
+	Schema extends AnySchema,
 	Value extends z.infer< Schema >,
 	K extends keyof Value,
 >( hook: DataSyncHook< Schema, Value >, key: K ): [ Value[ K ], SubsetMutation< Value[ K ] > ] {

projects/js-packages/react-data-sync-client/src/DataSyncHooks.ts

@@ -1,9 +1,13 @@
 import { z } from 'zod';
 
+// Zod 4's `ZodType` infers `unknown`; DataSync's generics rely on Zod 3's `any`.
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export type AnySchema = z.ZodType< any >;
+
 /**
  * A syncable value with a nonce that's parsed by Zod.
  */
-export type ParsedValue< T extends z.ZodSchema > = {
+export type ParsedValue< T extends AnySchema > = {
 	value: z.infer< T >;
 	nonce: string;
 };
@@ -28,6 +32,6 @@ type Literal = z.infer< typeof literalSchema >;
 type Json = Literal | { [ key: string ]: Json } | Json[];
 
 export const jsonSchema: z.ZodType< Json > = z.lazy( () =>
-	z.union( [ literalSchema, z.array( jsonSchema ), z.record( jsonSchema ) ] )
+	z.union( [ literalSchema, z.array( jsonSchema ), z.record( z.string(), jsonSchema ) ] )
 );
 export type JSONSchema = z.infer< typeof jsonSchema >;

projects/js-packages/react-data-sync-client/src/types.ts

@@ -31,7 +31,7 @@ const CriticalCssErrorType = z.union( [
 export const CriticalCssErrorDetailsSchema = z.object( {
 	url: z.coerce.string(),
 	message: z.coerce.string(),
-	meta: z.record( JSONSchema ).catch( {} ),
+	meta: z.record( z.string(), JSONSchema ).catch( {} ),
 	type: CriticalCssErrorType.catch( 'UnknownError' ),
 } );