chore(deps): dedupe zod to a single v4 resolution

[Tonours]

Pins zod to one v4 resolution via the root resolutions block. Lockfile drops from two v4 entries (4.3.6, 4.3.5) to one, single copy on disk at 4.3.6. No source code touched.

fixes PRD-888

Why

agent-bff and workflow-executor pin 4.3.6 exact, ai-proxy and mcp-server ask ^4.3.5. Nothing is broken today. It breaks the moment something takes zod as a peer dep: yarn v1 binds it to whichever copy sits at the root while agent-bff builds schemas from its own, and cross-copy zod introspection quietly returns nothing. @asteasolutions/zod-to-openapi is that shape and the OpenAPI work adds it next.

Aligning the ranges instead does not work. ^4.3.6 floats to 4.4.3, so you get three resolutions. Exact pins in the two packages leave the transitive OR ranges (^3.25 || ^4.0, ^3.25.76 || ^4, ^3.25.32 || ^4.2.0) on their own 4.3.5 entry, because yarn v1 does not dedupe on its own.

Bare name, no **/ glob, like the other version pins in that block.

Scope and safety

No v3-only consumer exists in the tree. hono (^3.23.8) and langsmith (^4.3.6) declare zod as a devDependency of a transitive package, so neither is installed or resolved. Every range actually present accepts 4.3.6.

resolutions is not published: downstream consumers still get ^4.3.5. What protects agent-bff published is its own exact pin, untouched here.

How to test

yarn install
grep -A2 '^zod@' yarn.lock   # one v4 entry, version 4.3.6
yarn build

Package	Result
mcp-server	728 passed
ai-proxy	429 passed, 40 skipped
agent-bff	726 passed
workflow-executor	1476 passed, 7 skipped
agent	1008 passed

yarn build green on 24 projects.

Known limitations

Two failures hit while validating, both reproduced on a clean main without this diff:

• Full yarn test fails ~69 suites on Cannot find module '@anthropic-ai/sdk/lib/transform-json-schema' (required by @langchain/anthropic). Same count, same 44 errors on main, zero mentions of zod.
• mcp-server's enabledTools test flakes on EADDRINUSE, a port race. 728/728 on two re-runs.

ai-proxy and mcp-server still declare ^4.3.5 while the resolution forces 4.3.6. Harmonising is a follow-up, not needed for the invariant.

The pin freezes zod at 4.3.6 while upstream is at 4.4.3. Upgrades go through the root resolution now.

Definition of Done

General

• Write an explicit title for the Pull Request, following Conventional Commits specification
• Test manually the implemented changes
• Validate the code quality (indentation, syntax, style, simplicity, readability)

Security

• Consider the security impact of the changes made

[linear-code]

PRD-888

[qltysh]

Coverage Impact

This PR will not change total coverage.

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.