v7.0.0

7.0.0 (2026-05-26)

Features

• support zod 4 and zod-to-openapi v8 (#22) (77835fd)

BREAKING CHANGES

• peer dependency on zod is now ^4. Drop zod 3 support.

• Bump peer zod to ^4 and dep @asteasolutions/zod-to-openapi to ^8.5.0
• Replace z.SafeParseReturnType with z.ZodSafeParseResult (renamed in zod 4)
• Validated middleware now casts to z.output<T> so req.params/body/query
  infer correctly under zod 4's stricter input/output split
• Replace removed ZodEffects ref-resolution branch with getRefId() from
  zod-to-openapi v8 — pipes/transforms on registered schemas still resolve
  back to their $ref
• Update test assertions for zod 4's new "Invalid input: expected X, received Y"
  default error format
• Pin packageManager to yarn@1.22.22 to match the existing v1 lockfile

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

• fix: infer req body/query/params types correctly under zod 4

Three follow-up fixes after the initial zod 4 bump:

• Replace TBody extends ZodTypeAny (which collapses to unknown under
  zod 4's stricter variance) with bare TBody/TQuery/etc. generics and a
  conditional InferOutput<T> helper that reads T["_zod"]["output"]. This
  restores proper inference for req.body, req.query, and req.params
  inside openAPIRoute(...) handlers.
• InferOutput<T> falls back to any when no schema is declared, matching
  the previous behavior so routes without explicit schemas don't suddenly
  break.
• Re-export extendZodWithOpenApi and ZodOpenAPIMetadata from the
  package root so the .openapi() augmentation is more discoverable for
  consumers; under module: "nodenext" callers may still need to import
  @asteasolutions/zod-to-openapi themselves to fully activate it.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com