chore: upgrade Zod 4, Vitest 4, and TypeScript 7

Bump major tooling stacks and adapt Zod error APIs (issues/flattenError) plus tsconfig paths for TS 7 baseUrl removal.

Co-authored-by: Cursor <[email protected]>

package.json

@@ -65,7 +65,7 @@
 		"sonner": "^2.0.7",
 		"tailwind-merge": "^3.6.0",
 		"tailwindcss-animate": "^1.0.7",
-		"zod": "^3.24.0"
+		"zod": "^4.4.3"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "2.5.4",
@@ -73,7 +73,7 @@
 		"@tailwindcss/forms": "^0.5.11",
 		"@tailwindcss/postcss": "^4.3.3",
 		"@tailwindcss/typography": "^0.5.20",
-		"@types/node": "^22.10.0",
+		"@types/node": "^26.1.1",
 		"@types/nodemailer": "^7.0.12",
 		"@types/react": "^19.2.17",
 		"@types/react-dom": "^19.2.3",
@@ -86,7 +86,8 @@
 		"prisma": "^7.9.0",
 		"tailwindcss": "^4.3.3",
 		"tsx": "^4.23.1",
-		"typescript": "^5.7.0",
-		"vitest": "^2.1.0"
+		"typescript": "^7.0.2",
+		"vite": "^8.1.5",
+		"vitest": "^4.1.10"
 	}
 }

src/actions/register.ts

@@ -54,7 +54,7 @@ export async function register(
 
 	const parsed = registerSchema.safeParse(raw);
 	if (!parsed.success) {
-		return parsed.error.errors[0]?.message ?? "Invalid input";
+		return parsed.error.issues[0]?.message ?? "Invalid input";
 	}
 
 	const { username, mail, password, look } = parsed.data;

src/env.ts

@@ -86,7 +86,7 @@ const schema = z.object({
 	if (data.NODE_ENV !== "production") return;
 	if (!data.AUTH_SECRET || data.AUTH_SECRET.length < 32) {
 		ctx.addIssue({
-			code: z.ZodIssueCode.custom,
+			code: "custom",
 			message:
 				"AUTH_SECRET (>=32 characters) is required when NODE_ENV=production",
 			path: ["AUTH_SECRET"],

src/lib/foundation/action.ts

@@ -1,4 +1,4 @@
-import type { z } from "zod";
+import { z } from "zod";
 import { logAuthorizationEvent } from "@/lib/admin/authorization-events";
 import { auth } from "@/lib/auth";
 import { canAccess, getApiAdminContext } from "@/lib/permissions";
@@ -112,7 +112,10 @@ export function adminAction<TSchema extends z.ZodType | undefined = undefined>(
 					if (!parsed.success) {
 						return fail(
 							"Validation failed",
-							parsed.error.flatten().fieldErrors as Record<string, string[]>,
+							z.flattenError(parsed.error).fieldErrors as Record<
+								string,
+								string[]
+							>,
 						);
 					}
 					data = parsed.data;
@@ -188,7 +191,10 @@ export function authAction<TSchema extends z.ZodType | undefined = undefined>(
 					if (!parsed.success) {
 						return fail(
 							"Validation failed",
-							parsed.error.flatten().fieldErrors as Record<string, string[]>,
+							z.flattenError(parsed.error).fieldErrors as Record<
+								string,
+								string[]
+							>,
 						);
 					}
 					data = parsed.data;

src/lib/safe-action-shared.ts

@@ -1,4 +1,4 @@
-import { ZodError } from "zod";
+import { ZodError, z } from "zod";
 import { handleActionError as foundationHandle } from "@/lib/foundation/action";
 
 export type ActionResult<T = Record<string, unknown>> =
@@ -27,7 +27,7 @@ export function handleActionError(error: unknown): ActionResult<never> {
 		return {
 			ok: false,
 			error: "Validation failed",
-			fieldErrors: error.flatten().fieldErrors as Record<string, string[]>,
+			fieldErrors: z.flattenError(error).fieldErrors as Record<string, string[]>,
 		};
 	}
 	if (error instanceof Error && error.name === "ActionError") {

tsconfig.json

@@ -18,7 +18,6 @@
 				"name": "next"
 			}
 		],
-		"baseUrl": ".",
 		"paths": {
 			"@/*": ["./src/*"]
 		}