Upgrade to Zod 4

.changeset/busy-humans-smoke.md

@@ -0,0 +1,7 @@
+---
+'@astrojs/sitemap': patch
+'@astrojs/rss': patch
+'@astrojs/db': patch
+---
+
+Updates usage of zod to own dependency rather than relying on `astro/zod`

.changeset/dance-ornate-keen.md

@@ -0,0 +1,5 @@
+---
+'astro': major
+---
+
+Astro v6.0 upgrades to Zod v4 for schema validation - ([v6 upgrade guidance](https://v6.docs.astro.build/en/guides/upgrade-to/v6/#zod-4))

examples/blog/src/content.config.ts

@@ -1,6 +1,6 @@
 import { defineCollection } from 'astro:content';
 import { glob } from 'astro/loaders';
-import { z } from 'astro/zod';
+import { z } from 'astro/zod'
 
 const blog = defineCollection({
 	// Load Markdown and MDX files in the `src/content/blog/` directory.
@@ -13,7 +13,7 @@ const blog = defineCollection({
 			// Transform string to Date object
 			pubDate: z.coerce.date(),
 			updatedDate: z.coerce.date().optional(),
-			heroImage: image().optional(),
+			heroImage: z.optional(image()),
 		}),
 });
 

examples/starlog/src/content.config.ts

@@ -16,7 +16,7 @@ const releases = defineCollection({
 				alt: z.string(),
 			}),
 			// Transform string to Date object
-			date: z.date({ coerce: true }),
+			date: z.coerce.date(),
 		}),
 });
 

packages/astro-rss/package.json

@@ -30,6 +30,7 @@
     "@types/xml2js": "^0.4.14",
     "astro": "workspace:*",
     "astro-scripts": "workspace:*",
+    "zod": "^3.25.76",
     "xml2js": "0.6.2"
   },
   "dependencies": {

packages/astro-rss/src/index.ts

@@ -1,4 +1,4 @@
-import { z } from 'astro/zod';
+import { z } from 'zod/v3';
 import { XMLBuilder, XMLParser } from 'fast-xml-parser';
 import colors from 'piccolore';
 import { rssSchema } from './schema.js';

packages/astro-rss/src/schema.ts

@@ -1,4 +1,4 @@
-import { z } from 'astro/zod';
+import { z } from 'zod/v3';
 
 export const rssSchema = z.object({
 	title: z.string().optional(),

packages/astro-rss/src/util.ts

@@ -1,4 +1,4 @@
-import type { z } from 'astro/zod';
+import type { z } from 'zod/v3';
 import type { RSSOptions } from './index.js';
 
 /** Normalize URL to its canonical form */

packages/astro/components/Code.astro

@@ -3,8 +3,8 @@ import type { ThemePresets } from '@astrojs/markdown-remark';
 import type { ShikiTransformer, ThemeRegistration, ThemeRegistrationRaw } from 'shiki';
 import { bundledLanguages } from 'shiki/langs';
 import { getCachedHighlighter } from '../dist/core/shiki.js';
-import type { CodeLanguage } from '../dist/types/public';
-import type { HTMLAttributes } from '../types';
+import type { CodeLanguage } from '../dist/types/public/common.js';
+import type { HTMLAttributes } from '../types.js';
 
 interface Props extends Omit<HTMLAttributes<'pre'>, 'lang'> {
 	/** The code to highlight. Required. */

packages/astro/components/Image.astro

@@ -1,8 +1,8 @@
 ---
 import { getImage, imageConfig, type LocalImageProps, type RemoteImageProps } from 'astro:assets';
-import type { UnresolvedImageTransform } from '../dist/assets/types';
+import type { UnresolvedImageTransform } from '../dist/assets/types.js';
 import { AstroError, AstroErrorData } from '../dist/core/errors/index.js';
-import type { HTMLAttributes } from '../types';
+import type { HTMLAttributes } from '../types.js';
 
 // The TypeScript diagnostic for JSX props uses the last member of the union to suggest props, so it would be better for
 // LocalImageProps to be last. Unfortunately, when we do this the error messages that remote images get are complete nonsense

packages/astro/components/Picture.astro

@@ -8,7 +8,7 @@ import type {
 	ImageOutputFormat,
 	UnresolvedImageTransform,
 } from '../dist/types/public/index.js';
-import type { HTMLAttributes } from '../types';
+import type { HTMLAttributes } from '../types.js';
 
 export type Props = (LocalImageProps | RemoteImageProps) & {
 	formats?: ImageOutputFormat[];

packages/astro/e2e/actions-blog.test.js

@@ -81,7 +81,7 @@ test.describe('Astro Actions - Blog', () => {
 		const submitButton = form.getByRole('button');
 		await submitButton.click();
 
-		const expectedText = 'Expected string, received null';
+		const expectedText = 'Invalid input: expected string, received null';
 
 		const fields = ['one', 'two', 'three', 'four', 'five', 'six', 'seven', 'eight', 'nine', 'ten'];
 

packages/astro/e2e/fixtures/cloudflare/src/content.config.ts

@@ -1,7 +1,8 @@
-import { defineCollection, z, reference } from 'astro:content';
+import { defineCollection, reference } from 'astro:content';
 import { file, glob } from 'astro/loaders';
 import { loader } from './loaders/post-loader.js';
 import { readFile } from 'fs/promises';
+import { z } from 'astro/zod';
 
 const blog = defineCollection({
 	loader: loader({ url: 'https://jsonplaceholder.typicode.com/posts' }),
@@ -82,8 +83,8 @@ const spacecraft = defineCollection({
 			description: z.string(),
 			publishedDate: z.coerce.date(),
 			tags: z.array(z.string()),
-			heroImage: image().optional(),
-			cat: reference('cats').default('siamese'),
+			heroImage: z.optional(image()),
+			cat: reference('cats').prefault('siamese'),
 			something: z
 				.string()
 				.optional()

packages/astro/e2e/fixtures/custom-client-directives/astro.config.mjs

@@ -22,7 +22,7 @@ function astroClientClickDirective() {
 
 function astroClientPasswordDirective() {
   return {
-    name: 'astro-client-click',
+    name: 'astro-client-password',
     hooks: {
       'astro:config:setup': (opts) => {
         opts.addClientDirective({

packages/astro/package.json

@@ -171,8 +171,7 @@
     "xxhash-wasm": "^1.1.0",
     "yargs-parser": "^21.1.1",
     "yocto-spinner": "^0.2.3",
-    "zod": "^3.25.76",
-    "zod-to-json-schema": "^3.25.0"
+    "zod": "^4.0.0"
   },
   "optionalDependencies": {
     "sharp": "^0.34.0"

packages/astro/src/actions/runtime/client.ts

@@ -1,7 +1,7 @@
 // It's safe to import this file on both server and client
 
 import { parse as devalueParse } from 'devalue';
-import type z from 'zod';
+import type * as z from 'zod/v4/core';
 import { ACTION_QUERY_PARAMS } from '../consts.js';
 import type {
 	ActionClient,
@@ -132,10 +132,10 @@ export class ActionInputError<T extends ErrorInferenceObject> extends ActionErro
 	// Not all properties will serialize from server to client,
 	// and we don't want to import the full ZodError object into the client.
 
-	issues: z.ZodIssue[];
-	fields: z.ZodError<T>['formErrors']['fieldErrors'];
+	issues: z.$ZodIssue[];
+	fields: { [P in keyof T]?: string[] | undefined };
 
-	constructor(issues: z.ZodIssue[]) {
+	constructor(issues: z.$ZodIssue[]) {
 		super({
 			message: `Failed to validate: ${JSON.stringify(issues, null, 2)}`,
 			code: 'BAD_REQUEST',

packages/astro/src/actions/runtime/server.ts

@@ -1,5 +1,5 @@
 import { stringify as devalueStringify } from 'devalue';
-import { z } from 'zod';
+import * as z from 'zod/v4/core';
 import type { Pipeline } from '../../core/base-pipeline.js';
 import { shouldAppendForwardSlash } from '../../core/build/util.js';
 import { pipelineSymbol, REDIRECT_STATUS_CODES } from '../../core/constants.js';
@@ -32,9 +32,9 @@ import type {
 export function defineAction<
 	TOutput,
 	TAccept extends ActionAccept | undefined = undefined,
-	TInputSchema extends z.ZodType | undefined = TAccept extends 'form'
+	TInputSchema extends z.$ZodType | undefined = TAccept extends 'form'
 		? // If `input` is omitted, default to `FormData` for forms and `any` for JSON.
-			z.ZodType<FormData>
+			z.$ZodType<FormData>
 		: undefined,
 >({
 	accept,
@@ -70,7 +70,7 @@ export function defineAction<
 	return safeServerHandler as ActionClient<TOutput, TAccept, TInputSchema> & string;
 }
 
-function getFormServerHandler<TOutput, TInputSchema extends z.ZodType>(
+function getFormServerHandler<TOutput, TInputSchema extends z.$ZodType>(
 	handler: ActionHandler<TInputSchema, TOutput>,
 	inputSchema?: TInputSchema,
 ) {
@@ -84,20 +84,27 @@ function getFormServerHandler<TOutput, TInputSchema extends z.ZodType>(
 
 		if (!inputSchema) return await handler(unparsedInput, context);
 
-		const baseSchema = unwrapBaseObjectSchema(inputSchema, unparsedInput);
-		const parsed = await inputSchema.safeParseAsync(
-			baseSchema instanceof z.ZodObject
-				? formDataToObject(unparsedInput, baseSchema)
-				: unparsedInput,
-		);
+		const parsed = await parseFormInput(inputSchema, unparsedInput);
+
 		if (!parsed.success) {
 			throw new ActionInputError(parsed.error.issues);
 		}
 		return await handler(parsed.data, context);
 	};
 }
 
-function getJsonServerHandler<TOutput, TInputSchema extends z.ZodType>(
+async function parseFormInput(inputSchema: z.$ZodType, unparsedInput: FormData) {
+	const baseSchema = unwrapBaseZ4ObjectSchema(inputSchema, unparsedInput);
+	const input =
+		baseSchema instanceof z.$ZodObject
+			? formDataToObject(unparsedInput, baseSchema)
+			: unparsedInput;
+
+	const parsed = await z.safeParseAsync(inputSchema, input);
+	return parsed;
+}
+
+function getJsonServerHandler<TOutput, TInputSchema extends z.$ZodType>(
 	handler: ActionHandler<TInputSchema, TOutput>,
 	inputSchema?: TInputSchema,
 ) {
@@ -110,7 +117,7 @@ function getJsonServerHandler<TOutput, TInputSchema extends z.ZodType>(
 		}
 
 		if (!inputSchema) return await handler(unparsedInput, context);
-		const parsed = await inputSchema.safeParseAsync(unparsedInput);
+		const parsed = await z.safeParseAsync(inputSchema, unparsedInput);
 		if (!parsed.success) {
 			throw new ActionInputError(parsed.error.issues);
 		}
@@ -275,34 +282,38 @@ function isActionAPIContext(ctx: ActionAPIContext): boolean {
 }
 
 /** Transform form data to an object based on a Zod schema. */
-export function formDataToObject<T extends z.AnyZodObject>(
+export function formDataToObject<T extends z.$ZodObject>(
 	formData: FormData,
 	schema: T,
 ): Record<string, unknown> {
-	const obj: Record<string, unknown> =
-		schema._def.unknownKeys === 'passthrough' ? Object.fromEntries(formData.entries()) : {};
-	for (const [key, baseValidator] of Object.entries(schema.shape)) {
+	const obj: Record<string, unknown> = schema._zod.def.catchall
+		? Object.fromEntries(formData.entries())
+		: {};
+	for (const [key, baseValidator] of Object.entries(schema._zod.def.shape)) {
 		let validator = baseValidator;
 
 		while (
-			validator instanceof z.ZodOptional ||
-			validator instanceof z.ZodNullable ||
-			validator instanceof z.ZodDefault
+			validator instanceof z.$ZodOptional ||
+			validator instanceof z.$ZodNullable ||
+			validator instanceof z.$ZodDefault
 		) {
 			// use default value when key is undefined
-			if (validator instanceof z.ZodDefault && !formData.has(key)) {
-				obj[key] = validator._def.defaultValue();
+			if (validator instanceof z.$ZodDefault && !formData.has(key)) {
+				obj[key] =
+					validator._zod.def.defaultValue instanceof Function
+						? validator._zod.def.defaultValue()
+						: validator._zod.def.defaultValue;
 			}
-			validator = validator._def.innerType;
+			validator = validator._zod.def.innerType;
 		}
 
 		if (!formData.has(key) && key in obj) {
 			// continue loop if form input is not found and default value is set
 			continue;
-		} else if (validator instanceof z.ZodBoolean) {
+		} else if (validator instanceof z.$ZodBoolean) {
 			const val = formData.get(key);
 			obj[key] = val === 'true' ? true : val === 'false' ? false : formData.has(key);
-		} else if (validator instanceof z.ZodArray) {
+		} else if (validator instanceof z.$ZodArray) {
 			obj[key] = handleFormDataGetAll(key, formData, validator);
 		} else {
 			obj[key] = handleFormDataGet(key, formData, validator, baseValidator);
@@ -311,16 +322,12 @@ export function formDataToObject<T extends z.AnyZodObject>(
 	return obj;
 }
 
-function handleFormDataGetAll(
-	key: string,
-	formData: FormData,
-	validator: z.ZodArray<z.ZodUnknown>,
-) {
+function handleFormDataGetAll(key: string, formData: FormData, validator: z.$ZodArray) {
 	const entries = Array.from(formData.getAll(key));
-	const elementValidator = validator._def.type;
-	if (elementValidator instanceof z.ZodNumber) {
+	const elementValidator = validator._zod.def.element;
+	if (elementValidator instanceof z.$ZodNumber) {
 		return entries.map(Number);
-	} else if (elementValidator instanceof z.ZodBoolean) {
+	} else if (elementValidator instanceof z.$ZodBoolean) {
 		return entries.map(Boolean);
 	}
 	return entries;
@@ -334,26 +341,23 @@ function handleFormDataGet(
 ) {
 	const value = formData.get(key);
 	if (!value) {
-		return baseValidator instanceof z.ZodOptional ? undefined : null;
+		return baseValidator instanceof z.$ZodOptional ? undefined : null;
 	}
-	return validator instanceof z.ZodNumber ? Number(value) : value;
+	return validator instanceof z.$ZodNumber ? Number(value) : value;
 }
 
-function unwrapBaseObjectSchema(schema: z.ZodType, unparsedInput: FormData) {
-	while (schema instanceof z.ZodEffects || schema instanceof z.ZodPipeline) {
-		if (schema instanceof z.ZodEffects) {
-			schema = schema._def.schema;
-		}
-		if (schema instanceof z.ZodPipeline) {
-			schema = schema._def.in;
-		}
+function unwrapBaseZ4ObjectSchema(schema: z.$ZodType, unparsedInput: FormData) {
+	if (schema instanceof z.$ZodPipe) {
+		return unwrapBaseZ4ObjectSchema(schema._zod.def.in, unparsedInput);
 	}
-	if (schema instanceof z.ZodDiscriminatedUnion) {
-		const typeKey = schema._def.discriminator;
+	if (schema instanceof z.$ZodDiscriminatedUnion) {
+		const typeKey = schema._zod.def.discriminator;
 		const typeValue = unparsedInput.get(typeKey);
 		if (typeof typeValue !== 'string') return schema;
 
-		const objSchema = schema._def.optionsMap.get(typeValue);
+		const objSchema = schema._zod.def.options.find((option) =>
+			(option as any).def.shape[typeKey].values.has(typeValue),
+		);
 		if (!objSchema) return schema;
 
 		return objSchema;
@@ -363,7 +367,7 @@ function unwrapBaseObjectSchema(schema: z.ZodType, unparsedInput: FormData) {
 
 async function callSafely<TOutput>(
 	handler: () => MaybePromise<TOutput>,
-): Promise<SafeResult<z.ZodType, TOutput>> {
+): Promise<SafeResult<z.$ZodType, TOutput>> {
 	try {
 		const data = await handler();
 		return { data, error: undefined };

packages/astro/src/actions/runtime/types.ts

@@ -1,12 +1,12 @@
-import type z from 'zod';
+import type * as z from 'zod/v4/core';
 import type { APIContext } from '../../types/public/index.js';
 import type { ActionError, codeToStatusMap } from './client.js';
 
 export type ActionErrorCode = keyof typeof codeToStatusMap;
 
 export type ActionAccept = 'form' | 'json';
 
-export type ActionHandler<TInputSchema, TOutput> = TInputSchema extends z.ZodType
+export type ActionHandler<TInputSchema, TOutput> = TInputSchema extends z.$ZodType
 	? (input: z.infer<TInputSchema>, context: ActionAPIContext) => MaybePromise<TOutput>
 	: (input: any, context: ActionAPIContext) => MaybePromise<TOutput>;
 
@@ -28,8 +28,8 @@ export type ActionInputSchema<T extends ActionClient<any, any, any>> = T extends
 export type ActionClient<
 	TOutput,
 	TAccept extends ActionAccept | undefined,
-	TInputSchema extends z.ZodType | undefined,
-> = TInputSchema extends z.ZodType
+	TInputSchema extends z.$ZodType | undefined,
+> = TInputSchema extends z.$ZodType
 	? ((
 			input: TAccept extends 'form' ? FormData : z.input<TInputSchema>,
 		) => Promise<

packages/astro/src/actions/vite-plugin-actions.ts

@@ -30,7 +30,11 @@ export function vitePluginActionsBuild(
 		name: '@astro/plugin-actions-build',
 
 		applyToEnvironment(environment) {
-			return environment.name === ASTRO_VITE_ENVIRONMENT_NAMES.ssr;
+			return (
+ 				environment.name === ASTRO_VITE_ENVIRONMENT_NAMES.ssr ||
+				environment.name === ASTRO_VITE_ENVIRONMENT_NAMES.prerender ||
+				environment.name === ASTRO_VITE_ENVIRONMENT_NAMES.astro
+			);
 		},
 
 		writeBundle(_, bundle) {