feat: update zod to 3.25 and explicitly import zod/v3

core/cli/package.json

@@ -26,8 +26,7 @@
     "@types/pluralize": "^0.0.33",
     "globby": "^10.0.2",
     "type-fest": "^4.41.0",
-    "winston": "^3.17.0",
-    "zod": "^3.24.4"
+    "winston": "^3.17.0"
   },
   "dependencies": {
     "@dotcom-tool-kit/base": "^1.3.0",
@@ -47,7 +46,8 @@
     "pretty-format": "^29.7.0",
     "tslib": "^2.8.1",
     "yaml": "^2.8.0",
-    "zod-validation-error": "^3.4.1"
+    "zod": "^3.25.76",
+    "zod-validation-error": "^3.5.2"
   },
   "engines": {
     "node": "18.x || 20.x || 22.x"

core/cli/src/messages.ts

@@ -7,8 +7,8 @@ import type {
   OptionsForPlugin,
   OptionsForTask
 } from '@dotcom-tool-kit/plugin'
-import type { z } from 'zod'
-import { fromZodError } from 'zod-validation-error'
+import type { z } from 'zod/v3'
+import { fromZodError } from 'zod-validation-error/v3'
 import type { Conflict } from '@dotcom-tool-kit/conflict'
 import pluralize from 'pluralize'
 import { ToolKitError } from '@dotcom-tool-kit/error'

core/cli/src/plugin/entry-point.ts

@@ -4,7 +4,7 @@ import type { Base } from '@dotcom-tool-kit/base'
 import type { EntryPoint } from '@dotcom-tool-kit/plugin'
 import { Validated, invalid, valid } from '@dotcom-tool-kit/validated'
 import { __importDefault } from 'tslib'
-import type * as z from 'zod'
+import type * as z from 'zod/v3'
 import { indentReasons } from '../messages'
 import type { ReadonlyDeep } from 'type-fest'
 

core/cli/src/plugin/options.ts

@@ -9,7 +9,7 @@ import { type PluginOptions, PluginSchemas, legacyPluginOptions } from '@dotcom-
 import { invalid, reduceValidated, valid, Validated } from '@dotcom-tool-kit/validated'
 
 import type { Logger } from 'winston'
-import * as z from 'zod'
+import * as z from 'zod/v3'
 import { styles } from '@dotcom-tool-kit/logger'
 
 import { toolKitIfDefinedIdent, toolKitOptionIdent } from '../rc-file'

core/cli/src/plugin/reduce-installations.ts

@@ -1,6 +1,6 @@
 import { groupBy } from 'lodash'
 import type { Logger } from 'winston'
-import * as z from 'zod'
+import * as z from 'zod/v3'
 
 import type { HookClass, HookInstallation } from '@dotcom-tool-kit/base'
 import type { ValidConfig } from '@dotcom-tool-kit/config'

core/create/package.json

@@ -32,7 +32,7 @@
     "simple-git": "^3.27.0",
     "tslib": "^2.8.1",
     "yaml": "^2.8.0",
-    "zod": "^3.24.4"
+    "zod": "^3.25.76"
   },
   "repository": {
     "type": "git",

core/create/src/prompts/oidc.ts

@@ -13,7 +13,7 @@ import path from 'path'
 import prompt from 'prompts'
 import { simpleGit } from 'simple-git'
 import YAML from 'yaml'
-import { z } from 'zod'
+import { z } from 'zod/v3'
 
 // git mode indicating an object blob is a file
 const FILE_MODE = '100644' as const
@@ -254,7 +254,11 @@ export default async function oidcPrompt({ toolKitConfig }: OidcParams): Promise
         // store path using the same logic we used to use to infer the name
         // from Tool Kit vault plugin options. Pass in the options that were
         // selected during the options prompt.
-        const dopplerProjectName = new DopplerEnvVars(winstonLogger, 'prod', toolKitConfig.options.plugins['@dotcom-tool-kit/doppler']).options.project
+        const dopplerProjectName = new DopplerEnvVars(
+          winstonLogger,
+          'prod',
+          toolKitConfig.options.plugins['@dotcom-tool-kit/doppler']
+        ).options.project
         const ssmAction = 'ssm:GetParameter'
         const ssmResource = `arn:aws:ssm:eu-west-1:\${AWS::AccountId}:parameter/${dopplerProjectName}/*`
         winstonLogger.info(

core/create/src/prompts/options.ts

@@ -7,7 +7,7 @@ import YAML from 'yaml'
 import type Logger from 'komatsu'
 import partition from 'lodash/partition'
 import prompt from 'prompts'
-import { z } from 'zod'
+import { z } from 'zod/v3'
 import type { BizOpsSystem } from '../bizOps'
 
 interface OptionSettings {

docs/developing-tool-kit.md

@@ -148,7 +148,7 @@ This lets different plugins define the same abstractly labelled hooks with diffe
 Plugins can define options that a user can configure in their repo's `.toolkitrc.yml`. We use the [`zod` library](https://zod.dev) to specify the schema, which allows us to define what we expect the options to look like and use this specification to validate the options we receive as well as generate TypeScript types for them. Options are defined within plugins. For tasks and hooks you should export the `zod` schema in the same file as you export your `Task` or `Hook` class as a `schema` object. For plugin options you should define the `zod` schema in a separate file, export it as the default object, and add the path to your `.toolkitrc.yml` with the top-level `optionsSchema` option.
 
 ```typescript
-import { z } from 'zod'
+import { z } from 'zod/v3'
 
 const ESLintSchema = z.object({
   files: z.string().array().default(['**/*.js']),

docs/extending-tool-kit.md

@@ -178,7 +178,7 @@ options:
 Additionally, we can define an options schema to ensure that the options passed to task are as we expect them to be, with the correct names and correct types. We use [`zod`](https://zod.dev/) to define our schemas. For plugin options, you should export your schema as the default object in a separate file and specify its path as a top-level `optionsSchema` option in your `.toolkitrc.yml`. For tasks and hooks, you should export your schema as a `schema` object in the same file as you export your task/hook. We could define a `zod` schema for the Rollup task like so:
 
 ```js
-const z = require('zod')
+const z = require('zod/v3')
 
 const RollupSchema = z.object({ configPath: z.string() })
 module.exports.schema = RollupSchema

jest.config.base.js

@@ -15,7 +15,8 @@ module.exports.config = {
   snapshotSerializers: [
     '@relmify/jest-serializer-strip-ansi/always',
     path.resolve(__dirname, './jest/serializers/aggregate-error.js'),
-    path.resolve(__dirname, './jest/serializers/tool-kit-error.js')
+    path.resolve(__dirname, './jest/serializers/tool-kit-error.js'),
+    path.resolve(__dirname, './jest/serializers/zod-error.js')
   ],
   transform: {
     '^.+\\.tsx?$': ['ts-jest', tsJestConfig]

jest/serializers/zod-error.js

@@ -0,0 +1,9 @@
+module.exports = {
+  test(value) {
+    return value instanceof Error && value.name === 'ZodError'
+  },
+
+  serialize(val, config, indentation, depth, refs, printer) {
+    return `ZodError ${printer(val.issues, config, indentation, depth, refs)}`
+  }
+}

lib/base/package.json

@@ -21,9 +21,9 @@
     "@dotcom-tool-kit/plugin": "^1.1.0",
     "type-fest": "^4.41.0",
     "winston": "^3.17.0",
-    "zod": "^3.24.4"
+    "zod": "^3.25.76"
   },
   "peerDependencies": {
-    "zod": "^3.24.4"
+    "zod": "^3.25.76"
   }
 }

lib/base/src/hook.ts

@@ -1,7 +1,7 @@
 import type { Logger } from 'winston'
 import { Base } from './base'
 import { hookSymbol, typeSymbol } from './symbols'
-import type { z } from 'zod'
+import type { z } from 'zod/v3'
 import type { Plugin } from '@dotcom-tool-kit/plugin'
 import { Conflict, isConflict } from '@dotcom-tool-kit/conflict'
 import type { Default } from './type-utils'

lib/base/src/task.ts

@@ -1,4 +1,4 @@
-import type { z } from 'zod'
+import type { z } from 'zod/v3'
 import { Base } from './base'
 import { taskSymbol, typeSymbol } from './symbols'
 import type { Logger } from 'winston'

lib/doppler/package.json

@@ -10,7 +10,7 @@
     "@dotcom-tool-kit/error": "^4.1.1",
     "@dotcom-tool-kit/logger": "^4.2.2",
     "tslib": "^2.8.1",
-    "zod": "^3.24.4"
+    "zod": "^3.25.76"
   },
   "keywords": [],
   "author": "FT.com Platforms Team <platforms-team.customer-products@ft.com>",

lib/doppler/src/index.ts

@@ -1,7 +1,7 @@
 import { spawn } from 'node:child_process'
 
 import type { Logger } from 'winston'
-import type * as z from 'zod'
+import type * as z from 'zod/v3'
 
 import { ToolKitError } from '@dotcom-tool-kit/error'
 import { styles, waitOnExit } from '@dotcom-tool-kit/logger'

lib/doppler/src/schema.ts

@@ -1,4 +1,4 @@
-import * as z from 'zod'
+import * as z from 'zod/v3'
 
 // In theory, these fields should be required as Doppler won't work without them,
 // but not every app that pulls in the Doppler plugin actually needs to use

lib/plugin/src/root-schema.ts

@@ -1,4 +1,4 @@
-import * as z from 'zod'
+import * as z from 'zod/v3'
 
 export const RootSchema = z.object({
   allowNativeFetch: z.boolean().default(false)