chore(deps): Upgrade Zod to v4

packages/mcp-cloudflare/src/server/oauth/state.ts

@@ -6,7 +6,7 @@ import { z } from "zod";
 // Safe envelope: keep the full downstream AuthRequest (+permissions) under `req`
 // and include only iat/exp metadata at top-level to avoid collisions.
 export const OAuthStateSchema = z.object({
-  req: z.record(z.unknown()),
+  req: z.record(z.string(), z.unknown()),
   iat: z.number().int(),
   exp: z.number().int(),
 });

packages/mcp-cloudflare/src/server/routes/search.ts

@@ -85,7 +85,7 @@ export default new Hono<{ Bindings: Env }>().post("/", async (c) => {
       return c.json(
         {
           error: "Invalid request",
-          details: validationResult.error.errors,
+          details: validationResult.error.issues,
         },
         400,
       );

packages/mcp-cloudflare/vitest.config.ts

@@ -48,6 +48,6 @@ export default defineConfig({
   },
   // Force bundling to apply the ajv alias during module resolution
   ssr: {
-    noExternal: ["@modelcontextprotocol/sdk", "agents", "zod-to-json-schema"],
+    noExternal: ["@modelcontextprotocol/sdk", "agents"],
   },
 });

packages/mcp-core/package.json

@@ -158,8 +158,7 @@
     "@sentry/mcp-server-tsconfig": "workspace:*",
     "msw": "catalog:",
     "tiktoken": "^1.0.18",
-    "yaml": "^2.8.3",
-    "zod-to-json-schema": "catalog:"
+    "yaml": "^2.8.3"
   },
   "dependencies": {
     "@ai-sdk/anthropic": "catalog:",

packages/mcp-core/scripts/generate-definitions.ts

@@ -9,7 +9,6 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import YAML from "yaml";
 import { type ZodTypeAny, z } from "zod";
-import { zodToJsonSchema } from "zod-to-json-schema";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -33,7 +32,7 @@ function zodFieldMapToJsonSchema(
 ): unknown {
   if (!fieldMap || Object.keys(fieldMap).length === 0) return {};
   const obj = z.object(fieldMap);
-  return zodToJsonSchema(obj, { $refStrategy: "none" });
+  return z.toJSONSchema(obj, { io: "input", unrepresentable: "any" });
 }
 
 // Plugin variants whose agent frontmatter gets synced by this script.
@@ -161,7 +160,10 @@ function generateToolDefinitions({
       // Export full JSON Schema under inputSchema for external docs
       inputSchema: jsonSchema,
       outputSchema: t.outputSchema
-        ? zodToJsonSchema(t.outputSchema, { $refStrategy: "none" })
+        ? z.toJSONSchema(t.outputSchema, {
+            io: "input",
+            unrepresentable: "any",
+          })
         : undefined,
       // Preserve tool access requirements for UIs/docs
       requiredScopes: t.requiredScopes,

packages/mcp-core/scripts/measure-token-cost.ts

@@ -13,7 +13,6 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { type Tiktoken, encoding_for_model } from "tiktoken";
 import { type ZodTypeAny, z } from "zod";
-import { zodToJsonSchema } from "zod-to-json-schema";
 
 // Lazy imports to avoid type bleed
 const toolsModule = await import("../src/tools/index.ts");
@@ -80,9 +79,9 @@ function formatToolsForMCP(tools: Record<string, ToolDefinition>) {
         ? z.object(inputSchema)
         : z.object({});
     // Use the same options as the MCP SDK to match actual payload
-    const jsonSchema = zodToJsonSchema(zodObject, {
-      strictUnions: true,
-      pipeStrategy: "input",
+    const jsonSchema = z.toJSONSchema(zodObject, {
+      io: "input",
+      unrepresentable: "any",
     });
 
     return {

packages/mcp-core/src/api-client/client.ts

@@ -3277,7 +3277,7 @@ export class SentryApiService {
         eventType,
         eventId: bodyObj.id,
         validationError: parseResult.error.message,
-        validationIssues: parseResult.error.errors,
+        validationIssues: parseResult.error.issues,
       },
     });
 

packages/mcp-core/src/api-client/schema.ts

@@ -775,12 +775,14 @@ export const IssueSchema = z
     status: z.string(),
     substatus: z.string().nullable().optional(),
     culprit: z.string().nullable(),
-    type: z.union([
-      z.literal("error"),
-      z.literal("transaction"),
-      z.literal("generic"),
-      z.unknown(),
-    ]),
+    type: z
+      .union([
+        z.literal("error"),
+        z.literal("transaction"),
+        z.literal("generic"),
+        z.unknown(),
+      ])
+      .optional(),
     assignedTo: AssignedToSchema.optional(),
     issueType: z.string().optional(),
     issueCategory: z.string().optional(),
@@ -867,7 +869,7 @@ const StacktraceSchema = z
   .object({
     frames: z.array(FrameInterface),
     framesOmitted: z.array(z.unknown()).nullable().optional(),
-    registers: z.record(z.unknown()).nullable().optional(),
+    registers: z.record(z.string(), z.unknown()).nullable().optional(),
     hasSystemFrames: z.boolean().nullable().optional(),
   })
   .partial()
@@ -882,7 +884,7 @@ export const ThreadEntrySchema = z
     current: z.boolean().nullable(),
     crashed: z.boolean().nullable(),
     state: z.string().nullable(),
-    heldLocks: z.record(z.unknown()).nullable().optional(),
+    heldLocks: z.record(z.string(), z.unknown()).nullable().optional(),
     stacktrace: StacktraceSchema.nullable(),
     rawStacktrace: StacktraceSchema.nullable().optional(),
   })
@@ -901,7 +903,7 @@ export const BreadcrumbSchema = z
     category: z.string().nullable(),
     level: z.string().nullable(),
     message: z.string().nullable(),
-    data: z.record(z.unknown()).nullable(),
+    data: z.record(z.string(), z.unknown()).nullable(),
   })
   .partial();
 
@@ -981,13 +983,15 @@ const BaseEventSchema = z.object({
       z.string(),
       z
         .object({
-          type: z.union([
-            z.literal("default"),
-            z.literal("runtime"),
-            z.literal("os"),
-            z.literal("trace"),
-            z.unknown(),
-          ]),
+          type: z
+            .union([
+              z.literal("default"),
+              z.literal("runtime"),
+              z.literal("os"),
+              z.literal("trace"),
+              z.unknown(),
+            ])
+            .optional(),
         })
         .passthrough(),
     )
@@ -1721,7 +1725,7 @@ export const FlamegraphSchema = z.preprocess(
   z
     .object({
       activeProfileIndex: z.preprocess((value) => value ?? 0, z.number()),
-      metadata: z.record(z.unknown()).optional(),
+      metadata: z.record(z.string(), z.unknown()).optional(),
       platform: z.string(),
       profiles: z.preprocess(
         (value) => value ?? [],
@@ -1784,11 +1788,12 @@ export const ProfileFrameSchema = z
     raw_function: z.string().nullable().optional(),
     symbol: z.string().nullable().optional(),
     lang: z.string().nullable().optional(),
-    data: z.record(z.unknown()).optional(),
+    data: z.record(z.string(), z.unknown()).optional(),
   })
   .passthrough();
 
 const ProfileThreadMetadataSchema = z.record(
+  z.string(),
   z
     .object({
       // Matches Sentry's `Profiling.ContinuousProfile.thread_metadata` type,

packages/mcp-core/src/internal/agents/callEmbeddedAgent.ts

@@ -31,7 +31,7 @@ interface EmbeddedAgentResult<T> {
  */
 export async function callEmbeddedAgent<
   TOutput,
-  TSchema extends z.ZodType<TOutput, z.ZodTypeDef, unknown>,
+  TSchema extends z.ZodType<TOutput, unknown>,
 >({
   system,
   prompt,
@@ -246,7 +246,7 @@ function extractJsonCandidates(text: string): string[] {
  */
 function rescueFromText<TOutput>(
   text: string,
-  schema: z.ZodType<TOutput, z.ZodTypeDef, unknown>,
+  schema: z.ZodType<TOutput, unknown>,
 ): TOutput | null {
   for (const candidate of extractJsonCandidates(text)) {
     try {

packages/mcp-core/src/internal/formatting.ts

@@ -2462,7 +2462,7 @@ function stripReplayMetadata(event: Event): Event {
         )
       : {
           ...event.contexts,
-          replay: nextReplayContext,
+          replay: { ...nextReplayContext, type: replayContext.type },
         };
 
   return {