From 92abe5aaf9f5e834a26a41d45b982beedb0cc179 Mon Sep 17 00:00:00 2001
From: Jithin <jithin.k@keyvalue.systems>
Date: Tue, 30 Jun 2026 23:36:28 +0530
Subject: [PATCH] fix: bump zod to ^4.0.0 to satisfy claude-agent-sdk peer
 dependency

---
 core/package.json             |  2 +-
 core/src/evaluators/schema.ts |  2 +-
 package-lock.json             | 14 +++++++-------
 package.json                  |  2 +-
 runners/cli/package.json      |  2 +-
 runners/mcp/package.json      |  2 +-
 runners/mcp/src/index.ts      |  5 ++++-
 7 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/core/package.json b/core/package.json
index c031f41..2e97ef2 100644
--- a/core/package.json
+++ b/core/package.json
@@ -100,7 +100,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "ai": "^6.0.0",
     "yaml": "^2.8.3",
-    "zod": "^3.0.0"
+    "zod": "^4.0.0"
   },
   "peerDependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.165",
diff --git a/core/src/evaluators/schema.ts b/core/src/evaluators/schema.ts
index 150222e..0d5b796 100644
--- a/core/src/evaluators/schema.ts
+++ b/core/src/evaluators/schema.ts
@@ -92,7 +92,7 @@ export const SourceAnalysisFrontmatterSchema = z
     correlates_with: z.string().min(1),
     description: z.string().optional(),
     /** SAST config (languages, sink/source patterns, taint question) — freeform internally. */
-    source_scan: z.record(z.unknown()).optional(),
+    source_scan: z.record(z.string(), z.unknown()).optional(),
     pass_criteria: z.string().min(1),
     fail_criteria: z.string().min(1),
     /** Static evaluators carry no attack patterns; an empty list is expected. */
diff --git a/package-lock.json b/package-lock.json
index bb5209d..e35e8fa 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -28,7 +28,7 @@
         "tsx": "^4.20.0",
         "typescript": "^5.8.3",
         "typescript-eslint": "^8.59.2",
-        "zod": "^3.25.76"
+        "zod": "^4.0.0"
       },
       "engines": {
         "node": ">=20"
@@ -48,7 +48,7 @@
         "@modelcontextprotocol/sdk": "^1.29.0",
         "ai": "^6.0.0",
         "yaml": "^2.8.3",
-        "zod": "^3.0.0"
+        "zod": "^4.0.0"
       },
       "devDependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.3.165",
@@ -5732,9 +5732,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "3.25.76",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
-      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
@@ -5779,7 +5779,7 @@
         "tsx": "^4.20.0",
         "typescript": "^5.8.3",
         "yaml": "^2.8.3",
-        "zod": "^3.0.0"
+        "zod": "^4.0.0"
       },
       "engines": {
         "node": ">=20"
@@ -6781,7 +6781,7 @@
         "esbuild": "^0.25.0",
         "tsx": "^4.20.0",
         "typescript": "^5.8.3",
-        "zod": "^3.0.0"
+        "zod": "^4.0.0"
       },
       "engines": {
         "node": ">=20"
diff --git a/package.json b/package.json
index d3d1957..93e24cb 100644
--- a/package.json
+++ b/package.json
@@ -56,6 +56,6 @@
     "tsx": "^4.20.0",
     "typescript": "^5.8.3",
     "typescript-eslint": "^8.59.2",
-    "zod": "^3.25.76"
+    "zod": "^4.0.0"
   }
 }
diff --git a/runners/cli/package.json b/runners/cli/package.json
index ee261f0..6ee877b 100644
--- a/runners/cli/package.json
+++ b/runners/cli/package.json
@@ -74,6 +74,6 @@
     "tsx": "^4.20.0",
     "typescript": "^5.8.3",
     "yaml": "^2.8.3",
-    "zod": "^3.0.0"
+    "zod": "^4.0.0"
   }
 }
diff --git a/runners/mcp/package.json b/runners/mcp/package.json
index e73abbf..5e0ab89 100644
--- a/runners/mcp/package.json
+++ b/runners/mcp/package.json
@@ -57,6 +57,6 @@
     "esbuild": "^0.25.0",
     "tsx": "^4.20.0",
     "typescript": "^5.8.3",
-    "zod": "^3.0.0"
+    "zod": "^4.0.0"
   }
 }
diff --git a/runners/mcp/src/index.ts b/runners/mcp/src/index.ts
index e6db5f9..299b775 100644
--- a/runners/mcp/src/index.ts
+++ b/runners/mcp/src/index.ts
@@ -172,7 +172,10 @@ server.tool(
     mcp_transport: z.enum(["stdio", "url"]).optional().describe("MCP transport type"),
     mcp_command: z.string().optional().describe("Command to start MCP server (stdio transport)"),
     mcp_args: z.array(z.string()).optional().describe("Args for MCP server command"),
-    mcp_env: z.record(z.string()).optional().describe("Env vars for MCP server process"),
+    mcp_env: z
+      .record(z.string(), z.string())
+      .optional()
+      .describe("Env vars for MCP server process"),
     mcp_url: z.string().url().optional().describe("MCP server URL (url transport)"),
 
     // Evaluators