refactor(backend): migrate validate.ts + schemas to Zod 4 API

[LucasSantana-Dev]

Summary

Closes the Zod 3/4 drift that's been blocking the brace-expansion CVE patch (issue #907) since this morning.

3 changes / ~6 lines net:

File	Before (Zod 3)	After (Zod 4)
packages/backend/src/middleware/validate.ts:4	z.ZodType<T, z.ZodTypeDef, unknown>	z.ZodType<T, unknown>
packages/backend/src/schemas/autoMessages.ts:9	{ required_error: 'Type is required' }	{ error: () => 'Type is required' }
packages/backend/src/schemas/autoMessages.ts:37	{ required_error: 'Enabled is required' }	{ error: () => 'Enabled is required' }

Plus a clean lockfile regen (Zod 4.4.3 now hoists at root; npm audit 0 vulnerabilities; no rolldown/optional-deps fallout).

Why

frontend and shared both pin zod: ^4.4.3. The backend code was using Zod 3 API. The current package-lock.json hoisted Zod 3 at root by historical luck — any regen flipped it and the backend stopped compiling. PR #915 (brace-expansion CVE) tripped this twice and had to be closed.

After this PR lands, the CVE override is a 3-line edit that no longer fights the lockfile.

Verified

• ✓ npm run build:shared
• ✓ npm run type:check --workspace=packages/backend
• ✓ npm test --workspace=packages/backend — 66 suites / 832 tests pass
• ✓ npm audit 0 vulnerabilities

Decision record

docs/decisions/2026-05-21-backend-zod-3-to-4-migration.md (added on the main branch earlier this session, references this PR by-name).

Test plan

• CI runs the full quality.yml suite + Quality Gates against this PR
• Confirm the new OSV-Scanner job (from .github PR Bump @sentry/profiling-node from 9.15.0 to 9.16.1 #4) reports clean
• After merge: open the CVE follow-up PR (brace-expansion + ws overrides), verify it's a small lockfile-only diff this time

Lucky base-branch note

This targets release/v2.13.0 (cut this session from the archived release/v2.12.0 tip). Lucky's bare-release migration is pending the user unprotecting release/v2.11.0 — once that lands, retarget any in-flight PRs.

Summary by CodeRabbit

• Chores
  • Updated development and production dependencies across the project to latest patch and minor versions.
  • Upgraded Docker image base to a newer stable version.
  • Updated GitHub Actions workflows to use current action versions.
  • Reorganized automated dependency management policy for improved update handling.
  • Added architectural decision documentation for dependency maintenance practices.

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
lucky	Ready	Preview, Comment	May 21, 2026 5:22pm

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR updates Dependabot configuration to separate dependency updates by type and maturity level, pins GitHub Actions workflows to specific commits, bumps Docker base images to a newer Nginx version, and updates dependency versions across the monorepo's packages and root configuration.

Changes

Infrastructure, configuration, and dependency updates

Layer / File(s)	Summary
Dependabot batch-handling policy and configuration \.github/dependabot\.yml, docs/decisions/2026-05-16-dependabot-batch-handling-policy\.md	Dependabot configuration replaced with four explicit groups separating development vs production dependencies and major vs patch/minor update types. ADR documents the policy rationale, current batch remediation steps, considered alternatives, and conditions for revisiting the policy.
GitHub Actions workflow updates \.github/workflows/ci\.yml, \.github/workflows/pr-agent\.yml, \.github/workflows/quality\.yml, \.github/workflows/release-branch-autosync\.yml, \.github/workflows/release-train-changelog-check\.yml	TruffleHog, PR Agent, and quality gates workflow actions pinned to new commit SHAs; checkout action updated from v4/v5 to v6 across release automation workflows.
Docker base image updates Dockerfile, Dockerfile\.nginx	Nginx unprivileged base image bumped from 1\.27-alpine to 1\.31-alpine in both main and dedicated Nginx Dockerfiles.
Monorepo dependency version bumps package\.json, packages/backend/package\.json, packages/bot/package\.json, packages/frontend/package\.json, packages/shared/package\.json	Development and production dependency versions updated: root devtools, workspace libraries (@sentry/node, @tanstack/react-query, axios, i18next, react-hook-form, react-router-dom), and infrastructure packages (express-rate-limit) across all workspace package.json files.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• LucasSantana-Dev/Lucky#897: Updates .github/dependabot.yml with the same four-group npm configuration strategy (dev-patches, dev-majors, production-patches, production-majors).
• LucasSantana-Dev/Lucky#848: Updates Dockerfile and Dockerfile.nginx to bump the nginxinc/nginx-unprivileged base image version.
• LucasSantana-Dev/Lucky#855: Modifies .github/workflows/quality.yml to reference the external quality gates reusable workflow.

Suggested labels

backend, dependencies, ci, size/s

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title describes a Zod 3 to Zod 4 migration, but the raw_summary shows changes to Dependabot config, GitHub workflows, Dockerfiles, and dependency updates unrelated to Zod migration.	The title should reflect the actual primary changes: dependency updates (dev tools, Docker base images, Sentry, TanStack, etc.) and CI/CD/Dependabot configuration updates, not just the backend Zod migration.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch main

⚔️ Resolve merge conflicts

• Resolve merge conflict in branch main

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (2)

packages/frontend/package.json (1)

75-76: 💤 Low value

Same plugin/parser drift as root.

@typescript-eslint/eslint-plugin is ^8.59.3 while @typescript-eslint/parser stays at ^8.54.0. Recommend aligning them here as well so both workspaces declare the same baseline.

♻️ Proposed alignment

     "`@typescript-eslint/eslint-plugin`": "^8.59.3",
-    "`@typescript-eslint/parser`": "^8.54.0",
+    "`@typescript-eslint/parser`": "^8.59.3",

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/frontend/package.json` around lines 75 - 76, The package.json in the
frontend workspace declares mismatched TypeScript ESLint versions; update the
dependency version for "`@typescript-eslint/parser`" to match
"`@typescript-eslint/eslint-plugin`" (i.e., align both to the same version string
used for "`@typescript-eslint/eslint-plugin`", such as "^8.59.3") so both
workspaces declare the same baseline; locate and modify the entries for
"`@typescript-eslint/eslint-plugin`" and "`@typescript-eslint/parser`" in
packages/frontend/package.json to keep them identical.

package.json (1)

84-85: 💤 Low value

Align @typescript-eslint/eslint-plugin and @typescript-eslint/parser versions

typescript-eslint publishes these packages using the same version number across the project; keeping mismatched baselines (plugin ^8.59.3 vs parser ^8.54.0) can cause drift and inconsistent tooling behavior. Align the parser to ^8.59.3 in the same PR.

♻️ Proposed alignment

     "`@typescript-eslint/eslint-plugin`": "^8.59.3",
-    "`@typescript-eslint/parser`": "^8.54.0",
+    "`@typescript-eslint/parser`": "^8.59.3",

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 84 - 85, package.json lists mismatched
typescript-eslint packages: "`@typescript-eslint/eslint-plugin`": "^8.59.3" and
"`@typescript-eslint/parser`": "^8.54.0"; update the parser dependency to
"^8.59.3" so both "`@typescript-eslint/parser`" and
"`@typescript-eslint/eslint-plugin`" share the same version baseline, then run
your install/lint task to verify no tooling regressions (look for the
dependencies named "`@typescript-eslint/parser`" and
"`@typescript-eslint/eslint-plugin`" in package.json and update the parser entry).

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release-branch-autosync.yml:
- Line 18: The workflow currently references actions/checkout@v6 which is
mutable; replace that tag with the immutable SHA
de0fac2e4500dabe0009e67214ff5f5447ce83dd so the step "uses: actions/checkout@v6"
is changed to use the pinned commit SHA (i.e., "uses:
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd") to prevent
supply-chain drift while keeping the rest of the workflow and existing
permissions intact.

---

Nitpick comments:
In `@package.json`:
- Around line 84-85: package.json lists mismatched typescript-eslint packages:
"`@typescript-eslint/eslint-plugin`": "^8.59.3" and "`@typescript-eslint/parser`":
"^8.54.0"; update the parser dependency to "^8.59.3" so both
"`@typescript-eslint/parser`" and "`@typescript-eslint/eslint-plugin`" share the
same version baseline, then run your install/lint task to verify no tooling
regressions (look for the dependencies named "`@typescript-eslint/parser`" and
"`@typescript-eslint/eslint-plugin`" in package.json and update the parser entry).

In `@packages/frontend/package.json`:
- Around line 75-76: The package.json in the frontend workspace declares
mismatched TypeScript ESLint versions; update the dependency version for
"`@typescript-eslint/parser`" to match "`@typescript-eslint/eslint-plugin`" (i.e.,
align both to the same version string used for
"`@typescript-eslint/eslint-plugin`", such as "^8.59.3") so both workspaces
declare the same baseline; locate and modify the entries for
"`@typescript-eslint/eslint-plugin`" and "`@typescript-eslint/parser`" in
packages/frontend/package.json to keep them identical.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: be2bb29c-3275-453f-b797-3f0448f2e68d

📥 Commits

Reviewing files that changed from the base of the PR and between 0751f4b and 802f102.

⛔ Files ignored due to path filters (2)

• package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json
• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (14)

• .github/dependabot.yml
• .github/workflows/ci.yml
• .github/workflows/pr-agent.yml
• .github/workflows/quality.yml
• .github/workflows/release-branch-autosync.yml
• .github/workflows/release-train-changelog-check.yml
• Dockerfile
• Dockerfile.nginx
• docs/decisions/2026-05-16-dependabot-batch-handling-policy.md
• package.json
• packages/backend/package.json
• packages/bot/package.json
• packages/frontend/package.json
• packages/shared/package.json

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Current checkout reference:"
rg -n 'uses:\s*actions/checkout@' .github/workflows/release-branch-autosync.yml

echo "Resolve actions/checkout v6 tag to commit SHA:"
gh api repos/actions/checkout/git/ref/tags/v6 --jq '.object.sha'

Repository: LucasSantana-Dev/Lucky

Length of output: 219

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
sed -n '1,120p' .github/workflows/release-branch-autosync.yml | cat -n

Repository: LucasSantana-Dev/Lucky

Length of output: 2258

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
sed -n '1,160p' .github/workflows/release-branch-autosync.yml | cat -n

Repository: LucasSantana-Dev/Lucky

Length of output: 2258

---

Pin actions/checkout to an immutable SHA.
.github/workflows/release-branch-autosync.yml uses actions/checkout@v6 (line 18) in a workflow with permissions.contents: write (line 7-8); pin v6 to de0fac2e4500dabe0009e67214ff5f5447ce83dd to avoid supply-chain drift.

🔧 Suggested change

-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

🧰 Tools

🪛 zizmor (1.25.2)

[warning] 18-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

---

[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release-branch-autosync.yml at line 18, The workflow
currently references actions/checkout@v6 which is mutable; replace that tag with
the immutable SHA de0fac2e4500dabe0009e67214ff5f5447ce83dd so the step "uses:
actions/checkout@v6" is changed to use the pinned commit SHA (i.e., "uses:
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd") to prevent
supply-chain drift while keeping the rest of the workflow and existing
permissions intact.

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

[LucasSantana-Dev]

Closing — head SHA desynced from branch tip after force-push during base-branch creation. Reopening as new PR with same content.