Skip to content

feat!: drop Zod v3 support and remove vendored schema converter - #2465

Open
HAYDEN-OAI wants to merge 3 commits into
mainfrom
codex/drop-zod-v3-vendor-20260825
Open

feat!: drop Zod v3 support and remove vendored schema converter#2465
HAYDEN-OAI wants to merge 3 commits into
mainfrom
codex/drop-zod-v3-vendor-20260825

Conversation

@HAYDEN-OAI

Copy link
Copy Markdown
Contributor
  • I understand that this repository is auto-generated and my pull request may not be merged

Summary

Breaking change: this proposal must target the next major SDK release. Do not publish it in a 7.x minor or patch release.

  • Require Zod ^4.0 as an optional peer dependency and use Zod 4's native JSON Schema conversion for all five existing Zod helpers.
  • Remove the v3-only vendored zod-to-json-schema implementation, its strict-schema compatibility layer, the archived converter dependency from the examples workspace, and obsolete lint exceptions.
  • Preserve Zod 4 Classic and Mini, strict Structured Outputs normalization, named definitions and escaped references, discriminated unions, Classic ZodError behavior, and non-strict Realtime input schemas.
  • Keep the separately vendored partial JSON parser used for streaming; packed-package checks explicitly verify that it remains included while the removed Zod converter does not.
  • Update examples and document migration from zod/v3, including v3 compatibility schemas created from an installed Zod 4 package.

Compatibility and rollout

  • Existing applications passing Zod 3 schemas, including schemas imported through zod/v3 under Zod 4, must recreate them with zod, zod/v4, zod/mini, or zod/v4-mini.
  • Unsupported v3 schemas now fail with an actionable TypeError across every helper and inside named schema definitions; TypeScript also rejects them at compile time.
  • Zod remains optional and the SDK gains no required runtime dependencies.
  • The core SDK continues to support TypeScript 4.9 and later. Because Zod 4 itself requires a newer compiler, applications using the optional Zod helpers need TypeScript 5.5 or later.
  • Coordinate ecosystem consumers that still accept v3 schemas, including @langchain/openai, before scheduling the next major release.

Validation

  • pnpm install --frozen-lockfile --store-dir /tmp/openai-node-zod-v4-pnpm-store
  • pnpm lint
  • pnpm exec tsc
  • pnpm build
  • ./node_modules/typescript-4-9/bin/tsc --project dist/src/tsconfig.json --noEmit --incremental false
  • ./node_modules/typescript/bin/tsc --project dist/src/tsconfig.json --noEmit --incremental false
  • pnpm exec publint dist
  • Packed-package verification: node --experimental-strip-types scripts/test-packed-package.ts — CommonJS, ESM, optional-peer isolation, converter removal, streaming-parser preservation, and 1,104 source maps passed.
  • Published type-resolution analysis: 65 entrypoints, zero actionable ATTW findings after applying the existing repository allowlist.
  • OPENAI_TEST_SUITE=unit ./scripts/test --exclude tests/ecosystem-cloudflare-credential-lifecycle-security.test.ts143 suites / 5,518 tests passed.
  • Generated API tests: 82 suites / 556 tests passed.
  • Focused Zod/parser/security migration tests: 359 tests passed.
  • Structured-output and streaming benchmark: all 13 cases passed.

The complete unfiltered handwritten run passed 5,595 tests and hit two existing Cloudflare inode-fixture failures that reproduce unchanged on upstream main in this container. Those tests require /proc/<parent-pid>/fd/<fd>, which is unavailable in the container's PID namespace. Their test and production files are unchanged, and both remain enabled for normal CI.

BREAKING CHANGE: Zod helpers now require Zod v4 schemas, and the optional Zod peer dependency is narrowed to ^4.0.
@HAYDEN-OAI
HAYDEN-OAI requested a review from a team as a code owner August 25, 2026 18:27
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 25, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-08-25T21:24:42.188693Z b6497c5 New commits
🔒 Security Review Completed 2026-08-25T21:24:46.684086Z b6497c5 New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@openai-sdks

openai-sdks Bot commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

OkTest Summary

237/237 SDK tests passed in 10.631s for Node SDK PR #2465.

Test results — 42 files
Test Result Time
tests/chat-completions-complex-body.test.ts ✅ Passed 167ms
tests/chat-completions-create.test.ts ✅ Passed 257ms
tests/chat-completions-stream.test.ts ✅ Passed 202ms
tests/files-content-binary.test.ts ✅ Passed 180ms
tests/files-create-multipart.test.ts ✅ Passed 151ms
tests/files-list-pagination.test.ts ✅ Passed 154ms
tests/initialize-config.test.ts ✅ Passed 167ms
tests/instance-isolation.test.ts ✅ Passed 99ms
tests/models-list.test.ts ✅ Passed 153ms
tests/responses-background-lifecycle.test.ts ✅ Passed 249ms
tests/responses-body-method-errors.test.ts ✅ Passed 312ms
tests/responses-cancel-timeout.test.ts ✅ Passed 222ms
tests/responses-cancel.test.ts ✅ Passed 289ms
tests/responses-compact-retries.test.ts ✅ Passed 291ms
tests/responses-compact.test.ts ✅ Passed 211ms
tests/responses-create-advanced-stream.test.ts ✅ Passed 128ms
tests/responses-create-advanced.test.ts ✅ Passed 189ms
tests/responses-create-disconnect.test.ts ✅ Passed 1.165s
tests/responses-create-errors.test.ts ✅ Passed 206ms
tests/responses-create-malformed-api-responses.test.ts ✅ Passed 207ms
tests/responses-create-retries.test.ts ✅ Passed 270ms
tests/responses-create-stream-failures.test.ts ✅ Passed 222ms
tests/responses-create-stream-timeout.test.ts ✅ Passed 2.155s
tests/responses-create-stream-wire.test.ts ✅ Passed 2.631s
tests/responses-create-stream.test.ts ✅ Passed 73ms
tests/responses-create-terminal-states.test.ts ✅ Passed 230ms
tests/responses-create-timeout.test.ts ✅ Passed 230ms
tests/responses-create.test.ts ✅ Passed 152ms
tests/responses-delete.test.ts ✅ Passed 212ms
tests/responses-input-items-errors.test.ts ✅ Passed 181ms
tests/responses-input-items-list.test.ts ✅ Passed 181ms
tests/responses-input-items-options.test.ts ✅ Passed 110ms
tests/responses-input-tokens-count-timeout.test.ts ✅ Passed 245ms
tests/responses-input-tokens-count.test.ts ✅ Passed 315ms
tests/responses-malformed-inputs.test.ts ✅ Passed 2.214s
tests/responses-not-found-errors.test.ts ✅ Passed 241ms
tests/responses-parse.test.ts ✅ Passed 205ms
tests/responses-retrieve-retries.test.ts ✅ Passed 185ms
tests/responses-retrieve.test.ts ✅ Passed 256ms
tests/responses-stored-method-errors.test.ts ✅ Passed 620ms
tests/retry-behavior.test.ts ✅ Passed 3.122s
tests/sdk-error-shape.test.ts ✅ Passed 260ms

View OkTest run #32900694237

SDK merge (06cdbb19d408) · head (b6497c54fa78) · base (9dd86484d9d5) · OkTest (2b1bdfd25e98)

@github-actions

github-actions Bot commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Castiron custom code

✅ No new custom-code files detected.

32 mixed files remain; 0 existing customizations changed.

Compared 9dd86484d9d5b6497c54fa78. Generated baselines verified.

32 existing customizations unchanged
  • api.md
  • scripts/castiron/README.md
  • scripts/castiron/custom_code_report.py
  • scripts/castiron/test_custom_code_report.py
  • src/client.ts
  • src/resources/audio/transcriptions.ts
  • src/resources/audio/translations.ts
  • src/resources/beta/assistants.ts
  • src/resources/beta/beta.ts
  • src/resources/beta/index.ts
  • src/resources/beta/responses/internal-base.ts
  • src/resources/beta/responses/responses.ts
  • src/resources/beta/threads/index.ts
  • src/resources/beta/threads/runs/index.ts
  • src/resources/beta/threads/runs/runs.ts
  • src/resources/beta/threads/threads.ts
  • src/resources/chat/completions/completions.ts
  • src/resources/chat/completions/index.ts
  • src/resources/conversations/index.ts
  • src/resources/embeddings.ts
  • src/resources/files.ts
  • src/resources/fine-tuning/checkpoints/permissions.ts
  • src/resources/images.ts
  • src/resources/responses/internal-base.ts
  • src/resources/responses/responses.ts
  • src/resources/skills/skills.ts
  • src/resources/skills/versions/versions.ts
  • src/resources/vector-stores/file-batches.ts
  • src/resources/vector-stores/files.ts
  • src/resources/webhooks/index.ts
  • src/resources/webhooks/webhooks.ts
  • tests/lib/data-residency.test.ts

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 32900725487 --repo openai/openai-node \
  --name castiron-custom-code-32900725487-1 --dir /tmp/castiron-custom-code-32900725487-1
git apply --stat /tmp/castiron-custom-code-32900725487-1/custom-code.patch
cat /tmp/castiron-custom-code-32900725487-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 9dd86484d9d5a2212ea8ec472fad6f76c747ba14 b6497c54fa7814ee7216524fc4d6b27e7325b3f0
python3 scripts/castiron/custom_code_report.py report \
  --base 9dd86484d9d5a2212ea8ec472fad6f76c747ba14 \
  --head b6497c54fa7814ee7216524fc4d6b27e7325b3f0 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-b6497c54fa78
cat /tmp/castiron-custom-code-b6497c54fa78/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 71b9ff03ad

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread examples/package.json Outdated

@jbeckwith-oai jbeckwith-oai left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Requesting changes for the existing P2 discussion on examples/package.json:14. The updated examples import zod/v4 but remove their only transitive Zod provider without declaring Zod as a direct examples dependency; the SDK peer is optional, so independently installed examples fail with ERR_MODULE_NOT_FOUND. Please add a direct Zod 4 dependency to examples/package.json and update the lockfile. Existing inline discussion already captures the issue, so no duplicate comment is needed.

@apcha-oai apcha-oai left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[sdk codex review] Approved at 5780f7e after two independent full reviews of all 72 changed paths, including the complete removed converter/validator/test files and retained Zod 4 helpers, tests, examples, documentation and packaging. No substantiated blocking issue found.

The existing examples dependency finding (#discussion_r3856041936) is fixed by the direct Zod 4 dependency and matching lockfile importer. The five helpers retain Zod 4 Classic/Mini behavior, strict-schema normalization, named/escaped references, parser error behavior and the separate streaming partial-JSON parser; Zod remains optional for core SDK consumers.

I verified existing hosted results for this exact head: Node 22/24/26 each passed 5,597 handwritten tests plus 556 generated tests (one skip); lint, builds, published-source TypeScript 4.9/current checks and packed CJS/ESM checks passed. The current head-plus-base merge also passed 14 ecosystem fixtures and OkTest's 237 tests across 42 suites. These are hosted results, not tests or scans I ran locally.

This approval is for the explicitly proposed NEXT MAJOR release only. Removing Zod 3 support is intentionally breaking: do not publish this in a 7.x minor/patch release, and retain the documented ecosystem coordination before scheduling the major release. Approval does not authorize publishing or merging.

Immediately before submission, the PR remained open, non-draft and mergeable, authored by HAYDEN-OAI; PR base, actual merge-base and live main were all a90581e. Existing feedback was rechecked; no duplicate inline comment added.

@jbeckwith-oai jbeckwith-oai left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-reviewed the updated commit and confirmed the previous blocker is fixed: examples now declare Zod 4 directly and the matching pnpm lock importer is updated. Zod 4 Classic/Mini behavior, optional-peer semantics, helper/privacy coverage, packed-package assertions, explicit Zod 3 migration guidance, and the documented semver-major adoption plan remain sound. Approved.

@apcha-oai apcha-oai left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(human): lets figure out when to do breaking changes manually

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants