fix(deps): upgrade zod to v4 and fix breaking changes (#3461)

* fix(deps): update dependency drizzle-zod to ^0.8.2

* chore: update zod to v4 import

* fix: path is no longer available in transform context

* fix: AnyZodObject does no longer exist

* fix: auth env.ts using wrong createEnv and remove unused file env-validation.ts

* fix: required_error no longer exists on z.string

* fix: zod error map is deprecated and replaced with config

* fix: default requires callback now

* fix: migrate zod resolver for mantine

* fix: remove unused form translation file

* fix: wrong enum type

* fix: record now requires two arguments

* fix: add-confirm-password-refinement type issues

* fix: add missing first record argument for entityStateSchema

* fix: migrate superrefine to check

* fix(deps): upgrade zod-form-data to v3

* fix: migrate superRefine to check for mediaUploadSchema

* fix: authProvidersSchema default is array

* fix: use stringbool instead of custom implementation

* fix: record requires first argument

* fix: migrate superRefine to check for certificate router

* fix: confirm pasword refinement is overwriting types

* fix: email optional not working

* fix: migrate intersection to object converter

* fix: safe parse return value rename

* fix: easier access for min and max number value

* fix: migrate superRefine to check for oldmarr import file

* fix: inference of enum shape for old-import board-size wrong

* fix: errors renamed to issues

* chore: address pull request feedback

* fix: zod form requires object

* fix: inference for use-zod-form not working

* fix: remove unnecessary convertion

* fix(deps): upgrade trpc-to-openapi to v3

* fix: build error

* fix: migrate missing zod imports to v4

* fix: migrate zod records to v4

* fix: missing core package dependency in api module

* fix: unable to convert custom zod schema to openapi schema

* fix(deps): upgrade zod to v4

* chore(renovate): enable zod dependency updates

* test: add simple unit test for convertIntersectionToZodObject

---------

Co-authored-by: homarr-renovate[bot] <158783068+homarr-renovate[bot]@users.noreply.github.com>

packages/api/src/env.ts

@@ -1,7 +1,6 @@
-import { createEnv } from "@t3-oss/env-nextjs";
-import { z } from "zod";
+import { z } from "zod/v4";
 
-import { shouldSkipEnvValidation } from "@homarr/common/env-validation";
+import { createEnv } from "@homarr/core/infrastructure/env";
 
 export const env = createEnv({
   server: {
@@ -10,6 +9,4 @@ export const env = createEnv({
   runtimeEnv: {
     KUBERNETES_SERVICE_ACCOUNT_NAME: process.env.KUBERNETES_SERVICE_ACCOUNT_NAME,
   },
-  skipValidation: shouldSkipEnvValidation(),
-  emptyStringAsUndefined: true,
 });

packages/api/src/middlewares/integration.ts

@@ -1,5 +1,5 @@
 import { TRPCError } from "@trpc/server";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import type { Session } from "@homarr/auth";
 import { hasQueryAccessToIntegrationsAsync } from "@homarr/auth/server";

packages/api/src/middlewares/item.ts

@@ -1,5 +1,5 @@
 import { TRPCError } from "@trpc/server";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { and, eq } from "@homarr/db";
 import { items } from "@homarr/db/schema";

packages/api/src/router/apiKeys.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { createSaltAsync, hashPasswordAsync } from "@homarr/auth";
 import { createId } from "@homarr/common";

packages/api/src/router/app.ts

@@ -1,5 +1,5 @@
 import { TRPCError } from "@trpc/server";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { createId } from "@homarr/common";
 import { asc, eq, inArray, like } from "@homarr/db";

packages/api/src/router/board.ts

@@ -1,6 +1,6 @@
 import { TRPCError } from "@trpc/server";
 import superjson from "superjson";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { constructBoardPermissions } from "@homarr/auth/shared";
 import { createId } from "@homarr/common";
@@ -1623,7 +1623,7 @@ const getFullBoardWithWhereAsync = async (db: Database, where: SQL<unknown>, use
 const forKind = <T extends WidgetKind>(kind: T) =>
   z.object({
     kind: z.literal(kind),
-    options: z.record(z.unknown()),
+    options: z.record(z.string(), z.unknown()),
   });
 
 const outputItemSchema = zodUnionFromArray(widgetKinds.map((kind) => forKind(kind))).and(sharedItemSchema);

packages/api/src/router/certificates/certificate-router.ts

@@ -1,13 +1,13 @@
 import { X509Certificate } from "node:crypto";
 import { TRPCError } from "@trpc/server";
-import { z } from "zod";
 import { zfd } from "zod-form-data";
+import { z } from "zod/v4";
 
 import { addCustomRootCertificateAsync, removeCustomRootCertificateAsync } from "@homarr/certificates/server";
 import { and, eq } from "@homarr/db";
 import { trustedCertificateHostnames } from "@homarr/db/schema";
 import { logger } from "@homarr/log";
-import { certificateValidFileNameSchema, superRefineCertificateFile } from "@homarr/validation/certificates";
+import { certificateValidFileNameSchema, checkCertificateFile } from "@homarr/validation/certificates";
 
 import { createTRPCRouter, permissionRequiredProcedure } from "../../trpc";
 
@@ -16,7 +16,7 @@ export const certificateRouter = createTRPCRouter({
     .requiresPermission("admin")
     .input(
       zfd.formData({
-        file: zfd.file().superRefine(superRefineCertificateFile),
+        file: zfd.file().check(checkCertificateFile),
       }),
     )
     .mutation(async ({ input }) => {

packages/api/src/router/docker/docker-router.ts

@@ -1,6 +1,6 @@
 import { TRPCError } from "@trpc/server";
 import { observable } from "@trpc/server/observable";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import type { Container, ContainerState, Docker, Port } from "@homarr/docker";
 import { DockerSingleton } from "@homarr/docker";

packages/api/src/router/group.ts

@@ -1,5 +1,5 @@
 import { TRPCError } from "@trpc/server";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { createId } from "@homarr/common";
 import type { Database } from "@homarr/db";

packages/api/src/router/import/import-router.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { analyseOldmarrImportForRouterAsync, analyseOldmarrImportInputSchema } from "@homarr/old-import/analyse";
 import {

packages/api/src/router/info.ts

@@ -1,4 +1,4 @@
-import z from "zod";
+import z from "zod/v4";
 
 import packageJson from "../../../../package.json";
 import { createTRPCRouter, protectedProcedure } from "../trpc";

packages/api/src/router/integration/integration-router.ts

@@ -1,5 +1,5 @@
 import { TRPCError } from "@trpc/server";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { createId, objectEntries } from "@homarr/common";
 import { decryptSecret, encryptSecret } from "@homarr/common/server";

packages/api/src/router/invite.ts

@@ -1,6 +1,6 @@
 import { randomBytes } from "crypto";
 import { TRPCError } from "@trpc/server";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { createId } from "@homarr/common";
 import { asc, eq } from "@homarr/db";

packages/api/src/router/location.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { fetchWithTimeout } from "@homarr/common";
 

packages/api/src/router/log.ts

@@ -1,5 +1,5 @@
 import { observable } from "@trpc/server/observable";
-import z from "zod";
+import z from "zod/v4";
 
 import { logger } from "@homarr/log";
 import { logLevels } from "@homarr/log/constants";

packages/api/src/router/medias/media-router.ts

@@ -1,5 +1,5 @@
 import { TRPCError } from "@trpc/server";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { createId } from "@homarr/common";
 import type { InferInsertModel } from "@homarr/db";

packages/api/src/router/onboard/onboard-router.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { onboarding } from "@homarr/db/schema";
 import { onboardingSteps } from "@homarr/definitions";

packages/api/src/router/search-engine/search-engine-router.ts

@@ -1,5 +1,5 @@
 import { TRPCError } from "@trpc/server";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { createId } from "@homarr/common";
 import { asc, eq, like } from "@homarr/db";

packages/api/src/router/section/section-router.ts

@@ -1,5 +1,5 @@
 import { TRPCError } from "@trpc/server";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { and, eq } from "@homarr/db";
 import { sectionCollapseStates, sections } from "@homarr/db/schema";

packages/api/src/router/serverSettings.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { getServerSettingByKeyAsync, getServerSettingsAsync, updateServerSettingByKeyAsync } from "@homarr/db/queries";
 import type { ServerSettings } from "@homarr/server-settings";

packages/api/src/router/user.ts

@@ -1,5 +1,5 @@
 import { TRPCError } from "@trpc/server";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { createSaltAsync, hashPasswordAsync } from "@homarr/auth";
 import { createId } from "@homarr/common";

packages/api/src/router/user/change-search-preferences.ts

@@ -1,5 +1,5 @@
 import { TRPCError } from "@trpc/server";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import type { Session } from "@homarr/auth";
 import type { Modify } from "@homarr/common/types";

packages/api/src/router/widgets/app.ts

@@ -1,5 +1,5 @@
 import { observable } from "@trpc/server/observable";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { sendPingRequestAsync } from "@homarr/ping";
 import { pingChannel, pingUrlChannel } from "@homarr/redis";

packages/api/src/router/widgets/calendar.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { getIntegrationKindsByCategory } from "@homarr/definitions";
 import { radarrReleaseTypes } from "@homarr/integrations/types";

packages/api/src/router/widgets/dns-hole.ts

@@ -1,5 +1,5 @@
 import { observable } from "@trpc/server/observable";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import type { Modify } from "@homarr/common/types";
 import type { Integration } from "@homarr/db/schema";

packages/api/src/router/widgets/downloads.ts

@@ -1,5 +1,5 @@
 import { observable } from "@trpc/server/observable";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import type { Modify } from "@homarr/common/types";
 import type { Integration } from "@homarr/db/schema";

packages/api/src/router/widgets/media-requests.ts

@@ -1,5 +1,5 @@
 import { observable } from "@trpc/server/observable";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { getIntegrationKindsByCategory } from "@homarr/definitions";
 import { createIntegrationAsync } from "@homarr/integrations";

packages/api/src/router/widgets/media-server.ts

@@ -1,5 +1,5 @@
 import { observable } from "@trpc/server/observable";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { getIntegrationKindsByCategory } from "@homarr/definitions";
 import type { StreamSession } from "@homarr/integrations";

packages/api/src/router/widgets/minecraft.ts

@@ -1,5 +1,5 @@
 import { observable } from "@trpc/server/observable";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import type { MinecraftServerStatus } from "@homarr/request-handler/minecraft-server-status";
 import { minecraftServerStatusRequestHandler } from "@homarr/request-handler/minecraft-server-status";

packages/api/src/router/widgets/notebook.ts

@@ -1,6 +1,6 @@
 import { TRPCError } from "@trpc/server";
 import SuperJSON from "superjson";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { eq } from "@homarr/db";
 import { boards, items } from "@homarr/db/schema";

packages/api/src/router/widgets/releases.ts

@@ -1,5 +1,5 @@
 import { escapeForRegEx } from "@tiptap/react";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { getIntegrationKindsByCategory } from "@homarr/definitions";
 import { releasesRequestHandler } from "@homarr/request-handler/releases";

packages/api/src/router/widgets/rssFeed.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { rssFeedsRequestHandler } from "@homarr/request-handler/rss-feeds";
 

packages/api/src/router/widgets/smart-home.ts

@@ -1,5 +1,5 @@
 import { observable } from "@trpc/server/observable";
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { getIntegrationKindsByCategory } from "@homarr/definitions";
 import { createIntegrationAsync } from "@homarr/integrations";

packages/api/src/router/widgets/stocks.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { fetchStockPriceHandler } from "@homarr/request-handler/stock-price";
 

packages/api/src/router/widgets/weather.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v4";
 
 import { fetchWithTimeout } from "@homarr/common";
 

packages/api/src/schema-merger.ts

@@ -1,21 +1,20 @@
-import { z } from "zod";
-import type { AnyZodObject, ZodIntersection, ZodObject } from "zod";
+import { z } from "zod/v4";
+import type { ZodIntersection, ZodObject } from "zod/v4";
 
-export function convertIntersectionToZodObject<TIntersection extends ZodIntersection<AnyZodObject, AnyZodObject>>(
+export function convertIntersectionToZodObject<TIntersection extends ZodIntersection<ZodObject, ZodObject>>(
   intersection: TIntersection,
 ) {
-  const { _def } = intersection;
+  const left = intersection.def.left;
+  const right = intersection.def.right;
 
   // Merge the shapes
-  // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
-  const mergedShape = { ..._def.left.shape, ..._def.right.shape };
+  const mergedShape = { ...left.def.shape, ...right.def.shape };
 
   // Return a new ZodObject
   return z.object(mergedShape) as unknown as TIntersection extends ZodIntersection<infer TLeft, infer TRight>
-    ? TLeft extends AnyZodObject
-      ? TRight extends AnyZodObject
-        ? // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          ZodObject<TLeft["shape"] & TRight["shape"], any, any, z.infer<TLeft> & z.infer<TRight>>
+    ? TLeft extends ZodObject
+      ? TRight extends ZodObject
+        ? ZodObject<TLeft["shape"] & TRight["shape"]>
         : never
       : never
     : never;

packages/api/src/test/schema-merger.spec.ts

@@ -0,0 +1,23 @@
+import { describe, expect, test } from "vitest";
+import z from "zod/v4";
+
+import { convertIntersectionToZodObject } from "../schema-merger";
+
+describe("convertIntersectionToZodObject should convert zod intersection to zod object", () => {
+  test("should merge two ZodObjects with different properties", () => {
+    const objectA = z.object({
+      id: z.string(),
+    });
+    const objectB = z.object({
+      name: z.string(),
+    });
+
+    const intersection = objectA.and(objectB);
+
+    const result = convertIntersectionToZodObject(intersection);
+
+    expect(result.def.type).toBe("object");
+    expect(result.shape).toHaveProperty("id");
+    expect(result.shape).toHaveProperty("name");
+  });
+});

packages/api/src/trpc.ts

@@ -9,7 +9,7 @@
 import { initTRPC, TRPCError } from "@trpc/server";
 import superjson from "superjson";
 import type { OpenApiMeta } from "trpc-to-openapi";
-import { ZodError } from "zod";
+import { ZodError } from "zod/v4";
 
 import type { Session } from "@homarr/auth";
 import { FlattenError } from "@homarr/common";