[kwburns-kong]

Summary

Split out of #10587. The zod major bump may affect INS-3039 (relies on V3 parser behavior) and git sync, so it is reviewed and validated independently.

Dependency bumps

• zod@3.25.76 to zod@4.6.5

Adjustments for major upgrade

• changed z.undefined() to z.undefined().optional() for the method, url, parameters, pathParameters and children keys in import-v5-parser.ts due to zod 4 treating a required z.undefined() key as non-optional, so absent keys failed the RequestCollectionSchema union discriminators
• changed the deep-strict.test.ts auth expectation from invalid_union to unrecognized_keys (with keys ['type', 'apiKey']) due to zod 4 reporting the strict empty-object fallback branch's issue directly instead of a wrapping invalid_union
• changed schemas/insomnia.schema.5.1.json and packages/insomnia/scripts/generate-schema.ts: zod 4 emits format: "starts_with" for z.string().startsWith(), which is not a draft 2020-12 format and makes strict Ajv fail to compile the schema. The generator now drops that format; the sibling pattern keys still enforce the prefix

To validate

• INS-3039 and git sync behavior under zod 4
• check-schema-mismatch.ts still receives the wrapping invalid_union that pickBestBranch unwraps

[github-actions]

✅ KSAI Review: Finished

1. 22:24 UTC Reviewing changed files against schema and conventions
2. 22:28 UTC Inspecting schema validation logic and related model definitions
3. 22:30 UTC Cross-checking validation schemas against generated schema and models

---

Run report (federated) · 1 paid run · $0.1081 total

#	Engine	Result	Model	Turns	Cost
1	opencode	success	glm-5.3-flash/max	37	$0.1077

Reviewing cost $0.1077; deciding how to run it cost $0.0004

[github-actions]

Check	Result
Scope	Zod 3.25 to 4.6.5 upgrade: version bumps in two packages, z.undefined().optional() union fixes, regenerated JSON schema (oneOf, type arrays, format drop), updated union-error test expectation.
Mandate	typescript-code-review
Findings	None
Findings audit	Skipped (no candidate findings)

The migration is consistent. z.undefined().optional() preserves union discrimination: present non-undefined values still fail a branch, absent keys pass. The unchanged parser tests cover both directions.

The regenerated schema keeps validation semantics. Every converted union has unique const discriminators with required: ["type"], so oneOf matches anyOf for all inputs. The permissive outer fallback stays anyOf. The generator's format drop matches the committed file; the sibling pattern keys enforce the prefixes.

No additional concerns found.