chore(deps): update dependency zod to v4.3.2 (#3156)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [zod](https://zod.dev)
([source](https://redirect.github.com/colinhacks/zod)) | [`4.2.1` →
`4.3.2`](https://renovatebot.com/diffs/npm/zod/4.2.1/4.3.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/zod/4.3.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/zod/4.2.1/4.3.2?slim=true)
|

---

### Release Notes

<details>
<summary>colinhacks/zod (zod)</summary>

###
[`v4.3.2`](https://redirect.github.com/colinhacks/zod/compare/v4.3.1...0f41e5a12a43e6913c9dcb501b2b5136ea86500d)

[Compare
Source](https://redirect.github.com/colinhacks/zod/compare/v4.3.1...v4.3.2)

###
[`v4.3.1`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.3.1)

[Compare
Source](https://redirect.github.com/colinhacks/zod/compare/v4.3.0...v4.3.1)

#### Commits:

-
[`0fe8840`](https://redirect.github.com/colinhacks/zod/commit/0fe88407a4149c907929b757dc6618d8afe998fc)
allow non-overwriting extends with refinements. 4.3.1

###
[`v4.3.0`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.3.0)

[Compare
Source](https://redirect.github.com/colinhacks/zod/compare/v4.2.1...v4.3.0)

This is Zod's biggest release since 4.0. It addresses several of Zod's
longest-standing feature requests.

#### `z.fromJSONSchema()`

Convert JSON Schema to Zod
([#&#8203;5534](https://redirect.github.com/colinhacks/zod/pull/5534),
[#&#8203;5586](https://redirect.github.com/colinhacks/zod/pull/5586))

You can now convert JSON Schema definitions directly into Zod schemas.
This function supports JSON Schema `"draft-2020-12"`, `"draft-7"`,
`"draft-4"`, and OpenAPI 3.0.

```typescript
import * as z from "zod";

const schema = z.fromJSONSchema({
  type: "object",
  properties: {
    name: { type: "string", minLength: 1 },
    age: { type: "integer", minimum: 0 },
  },
  required: ["name"],
});

schema.parse({ name: "Alice", age: 30 }); // ✅
```

The API should be considered experimental. There are no guarantees of
1:1 "round-trip soundness": `MySchema` > `z.toJSONSchema()` >
`z.fromJSONSchema()`. There are several features of Zod that don't exist
in JSON Schema and vice versa, which makes this virtually impossible.

Features supported:

- All primitive types (`string`, `number`, `integer`, `boolean`, `null`,
`object`, `array`)
- String formats (`email`, `uri`, `uuid`, `date-time`, `date`, `time`,
`ipv4`, `ipv6`, and more)
- Composition (`anyOf`, `oneOf`, `allOf`)
- Object constraints (`additionalProperties`, `patternProperties`,
`propertyNames`)
- Array constraints (`prefixItems`, `items`, `minItems`, `maxItems`)
- `$ref` for local references and circular schemas
- Custom metadata is preserved

#### `z.xor()` — exclusive union
([#&#8203;5534](https://redirect.github.com/colinhacks/zod/pull/5534))

A new exclusive union type that requires **exactly one** option to
match. Unlike `z.union()` which passes if *any* option matches,
`z.xor()` fails if zero or more than one option matches.

```typescript
const schema = z.xor([z.string(), z.number()]);

schema.parse("hello"); // ✅
schema.parse(42);      // ✅
schema.parse(true);    // ❌ zero matches
```

When converted to JSON Schema, `z.xor()` produces `oneOf` instead of
`anyOf`.

#### `z.looseRecord()` — partial record validation
([#&#8203;5534](https://redirect.github.com/colinhacks/zod/pull/5534))

A new record variant that only validates keys matching the key schema,
passing through non-matching keys unchanged. This is used to represent
`patternProperties` in JSON Schema.

```typescript
const schema = z.looseRecord(z.string().regex(/^S_/), z.string());

schema.parse({ S_name: "John", other: 123 });
// ✅ { S_name: "John", other: 123 }
// only S_name is validated, "other" passes through
```

#### `.exactOptional()` — strict optional properties
([#&#8203;5589](https://redirect.github.com/colinhacks/zod/pull/5589))

A new wrapper that makes a property *key-optional* (can be omitted) but
does **not** accept `undefined` as an explicit value.

```typescript
const schema = z.object({
  a: z.string().optional(),      // accepts `undefined`
  b: z.string().exactOptional(), // does not accept `undefined`
});

schema.parse({});                  // ✅
schema.parse({ a: undefined });    // ✅
schema.parse({ b: undefined });    // ❌
```

This makes it possible to accurately represent the full spectrum of
optionality expressible using
[`exactOptionalPropertyTypes`](https://www.typescriptlang.org/tsconfig/exactOptionalPropertyTypes.html).

#### `.apply()`

A utility method for applying arbitrary transformations to a schema,
enabling cleaner schema composition.
([#&#8203;5463](https://redirect.github.com/colinhacks/zod/pull/5463))

```typescript
const setCommonChecks = <T extends z.ZodNumber>(schema: T) => {
  return schema.min(0).max(100);
};

const schema = z.number().apply(setCommonChecks).nullable();
```

#### `.brand()` cardinality

The `.brand()` method now accepts a second argument to control whether
the brand applies to input, output, or both. Closes
[#&#8203;4764](https://redirect.github.com/colinhacks/zod/issues/4764),
[#&#8203;4836](https://redirect.github.com/colinhacks/zod/issues/4836).

```typescript
// output only (default)
z.string().brand<"UserId">();           // output is branded (default)
z.string().brand<"UserId", "out">();    // output is branded
z.string().brand<"UserId", "in">();     // input is branded
z.string().brand<"UserId", "inout">();  // both are branded
```

#### Type predicates on `.refine()`
([#&#8203;5575](https://redirect.github.com/colinhacks/zod/pull/5575))

The `.refine()` method now supports type predicates to narrow the output
type:

```typescript
const schema = z.string().refine((s): s is "a" => s === "a");

type Input = z.input<typeof schema>;   // string
type Output = z.output<typeof schema>; // "a"
```

#### `ZodMap` methods: `min`, `max`, `nonempty`, `size`
([#&#8203;5316](https://redirect.github.com/colinhacks/zod/pull/5316))

`ZodMap` now has parity with `ZodSet` and `ZodArray`:

```typescript
const schema = z.map(z.string(), z.number())
  .min(1)
  .max(10)
  .nonempty();

schema.size; // access the size constraint
```

#### `.with()` alias for `.check()`
([359c0db](https://redirect.github.com/colinhacks/zod/commit/359c0db6))

A new `.with()` method has been added as a more readable alias for
`.check()`. Over time, more APIs have been added that don't qualify as
"checks". The new method provides a readable alternative that doesn't
muddy semantics.

```typescript
z.string().with(
  z.minLength(5),
  z.toLowerCase()
);

// equivalent to:
z.string().check(
  z.minLength(5),
  z.trim(),
  z.toLowerCase()
);
```

##### `z.slugify()` transform

Transform strings into URL-friendly slugs. Works great with `.with()`:

```typescript
// Zod
z.string().slugify().parse("Hello World");           // "hello-world"

// Zod Mini
// using .with() for explicit check composition
z.string().with(z.slugify()).parse("Hello World");   // "hello-world"
```

#### `z.meta()` and `z.describe()` in Zod Mini
([947b4eb](https://redirect.github.com/colinhacks/zod/commit/947b4eb2))

Zod Mini now exports `z.meta()` and `z.describe()` as top-level
functions for adding metadata to schemas:

```typescript
import * as z from "zod/mini";

// add description
const schema = z.string().with(
  z.describe("A user's name"),
);

// add arbitrary metadata
const schema2 = z.number().with(
  z.meta({ deprecated: true })
);
```

#### New locales

- Armenian (`am`)
([#&#8203;5531](https://redirect.github.com/colinhacks/zod/pull/5531))
- Uzbek (`uz`)
([#&#8203;5519](https://redirect.github.com/colinhacks/zod/pull/5519))

```ts
import * as z from "zod";
import { uz } from "zod/locales";

z.config(uz());
```

<br/><br/>

***

<br/><br/>

#### Bug fixes

All of these changes fix soundness issues in Zod. As with any bug fix
there's some chance of breakage if you were intentionally or
unintentionally relying on this unsound behavior.

##### ⚠️ `.pick()` and `.omit()` disallowed on object schemas containing
refinements
([#&#8203;5317](https://redirect.github.com/colinhacks/zod/pull/5317))

Using `.pick()` or `.omit()` on object schemas with refinements now
throws an error. Previously, this would silently drop the refinements,
leading to unexpected behavior.

```typescript
const schema = z.object({
  password: z.string(),
  confirmPassword: z.string(),
}).refine(data => data.password === data.confirmPassword);

schema.pick({ password: true });
// 4.2: refinement silently dropped ⚠️
// 4.3: throws error ❌
```

**Migration**: The easiest way to migrate is to create a new schema
using the `shape` of the old one.

```ts
const newSchema = z.object(schema.shape).pick({ ... })
```

##### ⚠️ `.extend()` disallowed on refined schemas
([#&#8203;5317](https://redirect.github.com/colinhacks/zod/pull/5317))

Similarly, `.extend()` now throws on schemas with refinements. Use
`.safeExtend()` if you need to extend refined schemas.

```typescript
const schema = z.object({ a: z.string() }).refine(/* ... */);

// 4.2: refinement silently dropped ⚠️
// 4.3: throws error ✅
schema.extend({ b: z.number() });
// error: object schemas containing refinements cannot be extended. use `.safeExtend()` instead.
```

##### ⚠️ Stricter object masking methods
([#&#8203;5581](https://redirect.github.com/colinhacks/zod/pull/5581))

Object masking methods (`.pick()`, `.omit()`) now validate that the keys
provided actually exist in the schema:

```typescript
const schema = z.object({ a: z.string() });

// 4.3: throws error for unrecognized keys
schema.pick({ nonexistent: true });
// error: unrecognized key: "nonexistent"
```

#### Additional changes

- Fixed JSON Schema generation for `z.iso.time` with minute precision
([#&#8203;5557](https://redirect.github.com/colinhacks/zod/pull/5557))
- Fixed error details for tuples with extraneous elements
([#&#8203;5555](https://redirect.github.com/colinhacks/zod/pull/5555))
- Fixed `includes` method params typing to accept `string |
$ZodCheckIncludesParams`
([#&#8203;5556](https://redirect.github.com/colinhacks/zod/pull/5556))
- Fixed numeric formats error messages to be inclusive
([#&#8203;5485](https://redirect.github.com/colinhacks/zod/pull/5485))
- Fixed `implementAsync` inferred type to always be a promise
([#&#8203;5476](https://redirect.github.com/colinhacks/zod/pull/5476))
- Tightened E.164 regex to require a non-zero leading digit and 7–15
digits total
([#&#8203;5524](https://redirect.github.com/colinhacks/zod/pull/5524))
- Fixed Dutch (nl) error strings
([#&#8203;5529](https://redirect.github.com/colinhacks/zod/pull/5529))
- Convert `Date` instances to numbers in `minimum`/`maximum` checks
([#&#8203;5351](https://redirect.github.com/colinhacks/zod/pull/5351))
- Improved numeric keys handling in `z.record()`
([#&#8203;5585](https://redirect.github.com/colinhacks/zod/pull/5585))
- Lazy initialization of `~standard` schema property
([#&#8203;5363](https://redirect.github.com/colinhacks/zod/pull/5363))
- Functions marked as `@__NO_SIDE_EFFECTS__` for better tree-shaking
([#&#8203;5475](https://redirect.github.com/colinhacks/zod/pull/5475))
- Improved metadata tracking across child-parent relationships
([#&#8203;5578](https://redirect.github.com/colinhacks/zod/pull/5578))
- Improved locale translation approach
([#&#8203;5584](https://redirect.github.com/colinhacks/zod/pull/5584))
- Dropped id uniqueness enforcement at registry level
([#&#8203;5574](https://redirect.github.com/colinhacks/zod/pull/5574))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/RobinTail/express-zod-api).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi42Ni4xNCIsInVwZGF0ZWRJblZlciI6IjQyLjY2LjE0IiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbXX0=-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Robin Tail <[email protected]>

Author: renovate[bot]

example/example.documentation.yaml

@@ -132,10 +132,10 @@ paths:
           required: true
           description: PATCH /v1/user/:id Parameter
           schema:
-            examples:
-              - "1234567890"
             type: string
             minLength: 1
+            examples:
+              - "1234567890"
           examples:
             example1:
               value: "1234567890"
@@ -144,9 +144,9 @@ paths:
           required: true
           description: PATCH /v1/user/:id Parameter
           schema:
+            type: string
             examples:
               - "12"
-            type: string
           examples:
             example1:
               value: "12"
@@ -158,15 +158,15 @@ paths:
               type: object
               properties:
                 key:
+                  type: string
+                  minLength: 1
                   examples:
                     - 1234-5678-90
+                name:
                   type: string
                   minLength: 1
-                name:
                   examples:
                     - John Doe
-                  type: string
-                  minLength: 1
                 birthday:
                   description: the day of birth
                   type: string
@@ -205,9 +205,9 @@ paths:
                     type: object
                     properties:
                       name:
+                        type: string
                         examples:
                           - John Doe
-                        type: string
                       createdAt:
                         description: account creation date
                         type: string
@@ -275,11 +275,11 @@ paths:
               type: object
               properties:
                 name:
+                  type: string
+                  pattern: ^\w+ \w+$
                   description: first name and last name
                   examples:
                     - John Doe
-                  type: string
-                  pattern: ^\w+ \w+$
               required:
                 - name
             examples:
@@ -868,7 +868,6 @@ paths:
 components:
   schemas:
     Feature:
-      id: Feature
       type: object
       properties:
         title:
@@ -880,6 +879,7 @@ components:
       required:
         - title
       additionalProperties: false
+      id: Feature
   responses: {}
   parameters: {}
   examples: {}

express-zod-api/tests/__snapshots__/documentation.spec.ts.snap

@@ -2091,6 +2091,9 @@ paths:
                             - option2
                         additionalProperties:
                           type: boolean
+                        required:
+                          - option1
+                          - option2
                     required:
                       - simple
                       - stringy
@@ -3594,8 +3597,8 @@ paths:
           required: true
           description: GET /v1/getSomething Parameter
           schema:
-            deprecated: true
             type: string
+            deprecated: true
       responses:
         "200":
           description: GET /v1/getSomething Positive response
@@ -3653,8 +3656,8 @@ paths:
           required: true
           description: HEAD /v1/getSomething Parameter
           schema:
-            deprecated: true
             type: string
+            deprecated: true
       responses:
         "200":
           description: HEAD /v1/getSomething Positive response
@@ -3713,11 +3716,6 @@ paths:
                     type: string
                     const: success
                   data:
-                    examples:
-                      - a: first
-                        b: prefix_first
-                      - a: second
-                        b: prefix_second
                     type: object
                     properties:
                       a:
@@ -3728,6 +3726,11 @@ paths:
                       - a
                       - b
                     additionalProperties: false
+                    examples:
+                      - a: first
+                        b: prefix_first
+                      - a: second
+                        b: prefix_second
                 required:
                   - status
                   - data
@@ -3933,15 +3936,15 @@ paths:
                     type: string
                     const: success
                   data:
-                    examples:
-                      - num: 123
                     type: object
                     properties:
                       num:
                         type: number
                     required:
                       - num
                     additionalProperties: false
+                    examples:
+                      - num: 123
                 required:
                   - status
                   - data
@@ -4013,13 +4016,13 @@ paths:
               type: object
               properties:
                 key:
+                  type: string
                   examples:
                     - 1234-56789-01
-                  type: string
                 str:
+                  type: string
                   examples:
                     - test
-                  type: string
               required:
                 - key
                 - str
@@ -4044,9 +4047,9 @@ paths:
                     type: object
                     properties:
                       num:
+                        type: number
                         examples:
                           - 123
-                        type: number
                     required:
                       - num
                     additionalProperties: false
@@ -4137,15 +4140,15 @@ paths:
                     type: string
                     const: success
                   data:
-                    examples:
-                      - numericStr: "123"
                     type: object
                     properties:
                       numericStr:
                         type: string
                     required:
                       - numericStr
                     additionalProperties: false
+                    examples:
+                      - numericStr: "123"
                 required:
                   - status
                   - data
@@ -4254,15 +4257,15 @@ paths:
                     type: string
                     const: success
                   data:
-                    examples:
-                      - numericStr: "123"
                     type: object
                     properties:
                       numericStr:
                         type: string
                     required:
                       - numericStr
                     additionalProperties: false
+                    examples:
+                      - numericStr: "123"
                 required:
                   - status
                   - data
@@ -4332,9 +4335,9 @@ paths:
           required: true
           description: GET /v1/getSomething Parameter
           schema:
+            type: string
             examples:
               - "123"
-            type: string
           examples:
             example1:
               value: "123"
@@ -4407,9 +4410,9 @@ paths:
           required: true
           description: HEAD /v1/getSomething Parameter
           schema:
+            type: string
             examples:
               - "123"
-            type: string
           examples:
             example1:
               value: "123"
@@ -4451,9 +4454,9 @@ paths:
               type: object
               properties:
                 strNum:
+                  type: string
                   examples:
                     - "123"
-                  type: string
               required:
                 - strNum
             examples:
@@ -4553,8 +4556,8 @@ paths:
           required: true
           description: here is the test
           schema:
-            description: here is the test
             type: string
+            description: here is the test
       responses:
         "200":
           description: GET /v1/getSomething Positive response
@@ -4570,10 +4573,10 @@ paths:
                     type: object
                     properties:
                       result:
-                        description: some positive integer
                         type: integer
                         exclusiveMinimum: 0
                         maximum: 9007199254740991
+                        description: some positive integer
                     required:
                       - result
                     additionalProperties: false
@@ -4617,8 +4620,8 @@ paths:
           required: true
           description: here is the test
           schema:
-            description: here is the test
             type: string
+            description: here is the test
       responses:
         "200":
           description: HEAD /v1/getSomething Positive response
@@ -5029,12 +5032,12 @@ paths:
 components:
   schemas:
     NameParam:
-      id: NameParam
       anyOf:
         - type: string
           const: John
         - type: string
           const: Jane
+      id: NameParam
   responses: {}
   parameters: {}
   examples: {}

express-zod-api/tests/__snapshots__/env.spec.ts.snap

@@ -61,6 +61,10 @@ exports[`Environment checks > Zod checks/refinements > Snapshot control 'ZodNumb
     "type": "number",
   },
   "deferred": [],
+  "parent": {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "type": "number",
+  },
   "parse": [Function],
   "pattern": /\\^-\\?\\\\d\\+\\$/,
   "processJSONSchema": [Function],
@@ -171,6 +175,12 @@ exports[`Environment checks > Zod checks/refinements > Snapshot control 'ZodNumb
   "onattach": [
     [Function],
   ],
+  "parent": {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "maximum": 9007199254740991,
+    "minimum": -9007199254740991,
+    "type": "integer",
+  },
   "parse": [Function],
   "pattern": /\\^-\\?\\\\d\\+\\$/,
   "processJSONSchema": [Function],
@@ -209,6 +219,10 @@ exports[`Environment checks > Zod checks/refinements > Snapshot control 'ZodStri
     "type": "string",
   },
   "deferred": [],
+  "parent": {
+    "$schema": "https://json-schema.org/draft/2020-12/schema",
+    "type": "string",
+  },
   "parse": [Function],
   "pattern": /\\^\\(\\?!\\\\\\.\\)\\(\\?!\\.\\*\\\\\\.\\\\\\.\\)\\(\\[A-Za-z0-9_'\\+\\\\-\\\\\\.\\]\\*\\)\\[A-Za-z0-9_\\+-\\]@\\(\\[A-Za-z0-9\\]\\[A-Za-z0-9\\\\-\\]\\*\\\\\\.\\)\\+\\[A-Za-z\\]\\{2,\\}\\$/,
   "processJSONSchema": [Function],

express-zod-api/tests/__snapshots__/json-schema-helpers.spec.ts.snap

@@ -1,6 +1,46 @@
 // Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
-exports[`JSON Schema helpers > flattenIO() > should handle records 1`] = `
+exports[`JSON Schema helpers > flattenIO() > should handle records > in intersection 1`] = `
+{
+  "examples": [
+    {
+      "four": 456,
+      "one": "test",
+      "three": 123,
+      "two": "jest",
+    },
+    {
+      "four": 456,
+      "one": "some",
+      "three": 123,
+      "two": "another",
+    },
+  ],
+  "properties": {
+    "four": {
+      "type": "number",
+    },
+    "one": {
+      "type": "string",
+    },
+    "three": {
+      "type": "number",
+    },
+    "two": {
+      "type": "string",
+    },
+  },
+  "required": [
+    "one",
+    "two",
+    "three",
+    "four",
+  ],
+  "type": "object",
+}
+`;
+
+exports[`JSON Schema helpers > flattenIO() > should handle records > in union 1`] = `
 {
   "examples": [
     {