chore(): upgrade zod to latest

[adrien2p]

RESOLVES FRMW-2996

What
zod v4 comes with performance improvements, types simplification and such which would be great to get in and benefit from

ref: https://zod.dev/v4
ref2: https://zod.dev/v4#benchmarks

---

Note

Upgrade Zod to v4 across repo

• Dependencies: bump zod to 4.2.0 and zod-validation-error to 5.0.0
• Schema migration: replace ZodEffects patterns with ZodPipe handling; use z.ZodType where appropriate; update z.record to include key type (e.g., z.record(z.string(), ...)); standardize metadata and similar fields to z.record(z.string(), z.unknown())
• Validation utilities: update validateAndTransformBody/validateAndTransformQuery and WithAdditionalData to accept ZodType; enforce strict parsing consistently
• New error formatting: add zod-helpers with robust Zod v4 error normalization; comprehensive tests added; update integration/unit tests to match new error messages
• Admin Dashboard: adjust form utilities/hooks and various schemas to Zod v4 API
• Minor refactors/formatting in tests and types to align with Zod v4 expectations

^{Written by Cursor Bugbot for commit e937e5d. This will update automatically on new commits. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: a5631a7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 77 packages

Name	Type
@medusajs/medusa	Patch
@medusajs/core-flows	Patch
@medusajs/framework	Patch
@medusajs/utils	Patch
@medusajs/workflows-sdk	Patch
@medusajs/admin-sdk	Patch
@medusajs/dashboard	Patch
@medusajs/test-utils	Patch
@medusajs/medusa-oas-cli	Patch
integration-tests-http	Patch
@medusajs/analytics	Patch
@medusajs/api-key	Patch
@medusajs/auth	Patch
@medusajs/cache-inmemory	Patch
@medusajs/cache-redis	Patch
@medusajs/caching	Patch
@medusajs/cart	Patch
@medusajs/currency	Patch
@medusajs/customer	Patch
@medusajs/event-bus-local	Patch
@medusajs/event-bus-redis	Patch
@medusajs/file	Patch
@medusajs/fulfillment	Patch
@medusajs/index	Patch
@medusajs/inventory	Patch
@medusajs/link-modules	Patch
@medusajs/locking	Patch
@medusajs/notification	Patch
@medusajs/order	Patch
@medusajs/payment	Patch
@medusajs/pricing	Patch
@medusajs/product	Patch
@medusajs/promotion	Patch
@medusajs/rbac	Patch
@medusajs/region	Patch
@medusajs/sales-channel	Patch
@medusajs/settings	Patch
@medusajs/stock-location	Patch
@medusajs/store	Patch
@medusajs/tax	Patch
@medusajs/translation	Patch
@medusajs/user	Patch
@medusajs/workflow-engine-inmemory	Patch
@medusajs/workflow-engine-redis	Patch
@medusajs/analytics-local	Patch
@medusajs/analytics-posthog	Patch
@medusajs/auth-emailpass	Patch
@medusajs/auth-github	Patch
@medusajs/auth-google	Patch
@medusajs/caching-redis	Patch
@medusajs/file-local	Patch
@medusajs/file-s3	Patch
@medusajs/fulfillment-manual	Patch
@medusajs/locking-postgres	Patch
@medusajs/locking-redis	Patch
@medusajs/notification-local	Patch
@medusajs/notification-sendgrid	Patch
@medusajs/payment-stripe	Patch
@medusajs/draft-order	Patch
@medusajs/modules-sdk	Patch
@medusajs/orchestration	Patch
@medusajs/cli	Patch
@medusajs/admin-bundler	Patch
@medusajs/oas-github-ci	Patch
@medusajs/js-sdk	Patch
@medusajs/types	Patch
@medusajs/http-types-generator	Patch
@medusajs/deps	Patch
@medusajs/telemetry	Patch
@medusajs/admin-shared	Patch
@medusajs/admin-vite-plugin	Patch
@medusajs/icons	Patch
@medusajs/toolbox	Patch
@medusajs/ui-preset	Patch
create-medusa-app	Patch
medusa-dev-cli	Patch
@medusajs/ui	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

9 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
api-reference	Ignored		Apr 10, 2026 0:29am
api-reference-v2	Ignored	Preview	Apr 10, 2026 0:29am
bloom-docs	Ignored	Preview	Apr 10, 2026 0:29am
cloud-docs	Ignored	Preview	Apr 10, 2026 0:29am
docs-ui	Ignored	Preview	Apr 10, 2026 0:29am
docs-v2	Ignored	Preview	Apr 10, 2026 0:29am
medusa-docs	Ignored	Preview	Apr 10, 2026 0:29am
resources-docs	Ignored	Preview	Apr 10, 2026 0:29am
user-guide	Ignored	Preview	Apr 10, 2026 0:29am

[adrien2p]

@shahednasser conflicts resolved 🎉

[github-actions]

This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[adrien2p]

Not stale

[github-actions]

This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[medusa-os-bot]

Thank you for your contribution! 🎉

After an initial review, this PR looks good to us. Here's a summary:

✅ Changeset included
✅ Tests included (new zod-helpers.spec.ts + updated integration tests)
✅ All z.record call sites updated across 37 files
✅ Follows Medusa's conventions

Notes:

• Error message format changes — the updated integration tests confirm Zod v4 produces different validation error messages (e.g. in promotions.spec.ts and cart.workflows.spec.ts). These are behavioral changes for consumers who may be catching and parsing specific error strings. Worth a brief mention in the release notes or changeset body.

• ZodEffects removal in admin dashboard — hooks.tsx and utils.ts both rely on instanceof ZodEffects checks and .innerType() calls that no longer work in Zod v4 (ZodEffects is gone). The PR modifies both files (+39/−20 and +16/−29 respectively), so presumably this is addressed — but the createExtendedSchema logic in hooks.tsx is particularly worth a careful second pass, since the .superRefine().and() chaining path has different semantics in Zod v4.

• Changeset bump type — all 76 packages are bumped as patch. Given that Zod v4 changes error message formats (a behavioral change) and replaces ZodEffects in public-facing type signatures (e.g. the modifyCallback return type in WithAdditionalData), confirm that patch is the right level for @medusajs/framework and @medusajs/medusa.

A team member will do a final review before this is merged.