chore: upgrade zod to 4.5.4

[JAIVIGNESH2002]

UpgradePilot verified zod from 3.25.76 to 4.5.4.

Verification evidence:

• Create sandbox: TrueForge deterministic sandbox
• Clone repository: git clone --depth 1 https://github.com/JAIVIGNESH2002/SiftLane /opt/tf/tool-results/upgradepilot-upgrade-worktree/repo
• Install target dependency: npm install zod@4.5.4
• Repair and re-verify: TrueForge repair agent + deterministic verification

[qodo-code-review]

PR Summary by Qodo

Upgrade Zod to 4.5.4 and migrate validation APIs

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Upgrades Zod from 3.25.76 to 4.5.4.
• Migrates schemas and error handling to Zod 4 APIs.
• Preserves feed and article-state validation behavior.

Diagram

graph TD
  Manifest["package.json"] --> Lockfile["package-lock.json"] --> Runtime["Zod 4.5.4"] --> Validation["Validation schemas"] --> Action["Feed action"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Keep an exact Zod version

• ➕ Matches the repository's existing exact-version dependency policy
• ➕ Prevents unreviewed minor-version drift during lockfile regeneration
• ➖ Requires explicit updates to receive compatible Zod 4 fixes and features

Recommendation: Keep the Zod 4 migration and compatibility changes, but consider declaring "zod": "4.5.4" instead of ^4.5.4. The repository pins its other runtime dependencies exactly, and an exact constraint better matches the PR's verified target while preserving deterministic future installs.

Files changed (3) +9 / -14

Bug fix (1) +4 / -9

validation.tsMigrate shared validation helpers to Zod 4 +4/-9

Migrate shared validation helpers to Zod 4

• Removes obsolete string error options, supplies explicit record key and value schemas, and reads validation messages from 'ZodError.issues'. Existing feed and article-state validation semantics remain intact.

src/lib/validation.ts

Other (2) +5 / -5

package-lock.jsonLock Zod 4.5.4 package metadata +4/-4

Lock Zod 4.5.4 package metadata

• Updates the root dependency constraint and resolved Zod artifact from 3.25.76 to 4.5.4, including its registry URL and integrity hash.

package-lock.json

package.jsonDeclare Zod 4.5.4 dependency +1/-1

Declare Zod 4.5.4 dependency

• Moves the application from Zod 3.25.76 to the Zod 4 line beginning at 4.5.4.

package.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📜 Skill insights (0)

1. Validation messages become generic 🐞 Bug ≡ Correctness

Description

Replacing the configured string schemas with bare z.string() removes the explicit required/type
messages, so malformed add-feed submissions now return Zod's generic type errors instead of messages
such as “Feed URL is required.” The server action passes raw FormData values into this schema and
returns those issue messages directly to the user.

Code

src/lib/validation.ts[5]

+    .string()

Evidence

The previous schema explicitly distinguished a missing URL and non-text URL/category, while the
added bare string schemas no longer provide those messages. addFeedAction supplies
FormData.get() results directly and joins zodErrorMessages into its returned user-visible
message, proving the changed schema text reaches users.

src/lib/validation.ts[3-12]
src/lib/validation.ts[17-21]
src/app/actions.ts[23-30]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Restore the custom required/type validation messages removed during the Zod 4 migration.

## Issue Context
`addFeedAction` validates raw `FormData` and displays schema issue messages directly. Use Zod 4's unified `error` customization API (or equivalent schema logic) to preserve the previous URL and category messages.

## Fix Focus Areas
- src/lib/validation.ts[3-12]
- src/app/actions.ts[23-30]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Pinned dependency now floats 🐞 Bug ☼ Reliability

Description

Changing Zod to ^4.5.4 allows later 4.x releases to be selected when the lockfile is regenerated,
violating the repository's explicit requirement that Zod remain pinned and making validation
behavior dependent on install timing. This upgrade should change the pinned baseline to exactly
4.5.4, not introduce a version range.

Code

package.json[30]

+    "zod": "^4.5.4"

Evidence

The manifest now uses a caret range, while maintainer documentation names Zod as deliberately pinned
and explicitly warns against floating it; repository constraints likewise require preserving the
pinned Zod scenario unless the baseline is intentionally changed.

package.json[21-30]
package-lock.json[17-20]
README.md[50-59]
AGENTS.md[14-20]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Replace the floating Zod range with an exact version.

## Issue Context
Repository guidance identifies Zod as an intentional dependency pin. Keep the upgraded baseline deterministic by using `4.5.4` in both package manifests/lock metadata.

## Fix Focus Areas
- package.json[30-30]
- package-lock.json[20-20]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

Review mode: ⚖️ Balanced

Tip of the day

💡 Did you know, you can enable the Remediation agent and Qodo fixes findings in a dedicated fix PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

1. Validation messages become generic 🐞 Bug ≡ Correctness

Replacing the configured string schemas with bare z.string() removes the explicit required/type
messages, so malformed add-feed submissions now return Zod's generic type errors instead of messages
such as “Feed URL is required.” The server action passes raw FormData values into this schema and
returns those issue messages directly to the user.

Agent Prompt

## Issue description
Restore the custom required/type validation messages removed during the Zod 4 migration.

## Issue Context
`addFeedAction` validates raw `FormData` and displays schema issue messages directly. Use Zod 4's unified `error` customization API (or equivalent schema logic) to preserve the previous URL and category messages.

## Fix Focus Areas
- src/lib/validation.ts[3-12]
- src/app/actions.ts[23-30]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

2. Pinned dependency now floats 🐞 Bug ☼ Reliability

Changing Zod to ^4.5.4 allows later 4.x releases to be selected when the lockfile is regenerated,
violating the repository's explicit requirement that Zod remain pinned and making validation
behavior dependent on install timing. This upgrade should change the pinned baseline to exactly
4.5.4, not introduce a version range.

Agent Prompt

## Issue description
Replace the floating Zod range with an exact version.

## Issue Context
Repository guidance identifies Zod as an intentional dependency pin. Keep the upgraded baseline deterministic by using `4.5.4` in both package manifests/lock metadata.

## Fix Focus Areas
- package.json[30-30]
- package-lock.json[20-20]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools