Maintenance: upgrade to Zod v4

[dreamorosi]

Summary

Zod has released a new major version and this project uses Zod v3 (the previous major version). There's a Dependabot PR open, however the CI is failing because the project uses v3 syntax.

We should update the dependency and the Zod schemas used in the project to use the newer version.

Why is this needed?

So that we can take advantage of Zod's v4 smaller bundle and better performance.

Solution

As part of this task we should:

• Check out chore(deps): bump zod from 3.25.76 to 4.0.14 #164 locally (remember to run npm ci after checking out)
• Update the Zod schemas in the project that are broken - see Zod v4 upgrade guide
• Iterate until all the test suites pass both locally and in the CI

Future readers

Please react with 👍 and your use case to help us understand customer demand.

[msumari]

After investigation and debugging it seems the issue is that MCP SDK v1.17.1 depends on Zod v3.25.76, but we're trying to use Zod v4.0.15. So the MCP SDK is trying to use Zod v3 APIs that don't exist in v4.

[msumari]

When npm list zod is runned

powertools-for-aws-mcp@0.8.8 /Users/msumari/Documents/Office/powertools-mcp
├─┬ @modelcontextprotocol/inspector@0.16.2
│ ├─┬ @modelcontextprotocol/inspector-client@0.16.2
│ │ └── zod@3.25.76
│ ├─┬ @modelcontextprotocol/inspector-server@0.16.2
│ │ └── zod@3.25.76
│ └── zod@3.25.76
├─┬ @modelcontextprotocol/sdk@1.17.1
│ ├─┬ zod-to-json-schema@3.24.6
│ │ └── zod@3.25.76 deduped
│ └── zod@3.25.76
└── zod@4.0.15

[msumari]

The latest mcp/sdk is version 1.17.2
When
npm view @modelcontextprotocol/sdk@1.17.2 dependencies
Is runned got

{
  ajv: '^6.12.6',
  'content-type': '^1.0.5',
  cors: '^2.8.5',
  'cross-spawn': '^7.0.5',
  eventsource: '^3.0.2',
  'eventsource-parser': '^3.0.0',
  express: '^5.0.1',
  'express-rate-limit': '^7.5.0',
  'pkce-challenge': '^5.0.0',
  'raw-body': '^3.0.0',
  zod: '^3.23.8',
  'zod-to-json-schema': '^3.24.1'
}

[msumari]

The latest mcp/sdk is version 1.17.2
When
npm view @modelcontextprotocol/sdk@1.17.2 dependencies
Is runned got

{
  ajv: '^6.12.6',
  'content-type': '^1.0.5',
  cors: '^2.8.5',
  'cross-spawn': '^7.0.5',
  eventsource: '^3.0.2',
  'eventsource-parser': '^3.0.0',
  express: '^5.0.1',
  'express-rate-limit': '^7.5.0',
  'pkce-challenge': '^5.0.0',
  'raw-body': '^3.0.0',
  zod: '^3.23.8',
  'zod-to-json-schema': '^3.24.1'
}

[msumari]

With this observation we have to wait for mcp sdk update and put issue on hold until we get more or new information.

[dreamorosi]

Ok - thanks for looking into it, modelcontextprotocol/typescript-sdk#555 confirms your findings.