[peterj]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• mcp/package.json
• mcp/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Allocation of Resources Without Limits or Throttling SNYK-JS-ZOD-20510278	721

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[peterj]

The upgrade from zod v3 to v4 is a major version jump with a ground-up rewrite of the library, introducing significant performance improvements but also numerous breaking changes that require code modifications.

Key Breaking Changes:

• Error Handling: The ZodError.errors property has been removed; you must now use ZodError.issues.
• Error Customization: The API for custom errors has been unified. The message, invalid_type_error, and required_error parameters are deprecated or removed in favor of a single error parameter.
• String Format Validators: Chained string format methods are deprecated. For example, z.string().email() should be replaced with the top-level, tree-shakeable z.email().
• Object Strictness: The .strict() and .passthrough() methods on objects are deprecated. You should now use the top-level z.strictObject() and z.looseObject() functions or the .catchall() method.
• Type Inference: Using ReturnType<typeof schema.parse> to infer types may no longer work as expected. The correct method is to use z.infer<typeof schema>.

Recommendation: This upgrade requires a careful migration. Developers should review the official migration guide thoroughly. A community-maintained codemod is available to automate many of the required changes and is highly recommended to start the migration process.

npx @zod/codemod --transform v3-to-v4 ./src

Source: Official Migration Guide

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.