Bump zod from 3.25.67 to 4.3.6

[dependabot]

Bumps zod from 3.25.67 to 4.3.6.

Release notes

Sourced from zod's releases.

v4.3.6

Commits:

• 9977fb0868432461de265a773319e80a90ba3e37 Add brand.dev to sponsors
• f4b7bae3468f6188b8f004e007d722148fc91d77 Update pullfrog.yml (#5634)
• 251d7163a0ac7740fee741428d913e3c55702ace Clean up workflow_call
• edd4132466da0f5065a8e051b599d01fdd1081d8 fix: add missing User-agent to robots.txt and allow all (#5646)
• 85db85e9091d0706910d60c7eb2e9c181edd87bd fix: typo in codec.test.ts file (#5628)
• cbf77bb12bdfda2e054818e79001f5cb3798ce76 Avoid non null assertion (#5638)
• dfbbf1c1ae0c224b8131d80ddf0a264262144086 Avoid re-exported star modules (#5656)
• 762e911e5773f949452fd6dd4e360f2362110e8e Generalize numeric key handling
• ca3c8629c0c2715571f70b44c2433cad3db7fe4e v4.3.6

v4.3.5

Commits:

• 21afffdb42ccab554036312e33fed0ea3cb8f982 [Docs] Update migration guide docs for deprecation of message (#5595)
• e36743e513aadb307b29949a80d6eb0dcc8fc278 Improve mini treeshaking
• 0cdc0b8597999fd9ca99767b912c1e82c1ff2d6c 4.3.5

v4.3.4

Commits:

• 1a8bea3b474eada6f219c163d0d3ad09fadabe72 Add integration tests
• e01cd02b2f23d7e9078d3813830b146f8a2258b4 Support patternProperties for looserecord (#5592)
• 089e5fbb0f58ce96d2c4fb34cd91724c78df4af5 Improve looseRecord docs
• decef9c418d9a598c3f1bada06891ba5d922c5cd Fix lint
• 9443aab00d44d5d5f4a7eada65fc0fc851781042 Drop iso time in fromJSONSchema
• 66bda7491a1b9eab83bdeec0c12f4efc7290bd48 Remove .refine() from ZodMiniType
• b4ab94ca608cd5b581bfc12b20dd8d95b35b3009 4.3.4

v4.3.3

Commits:

• f3b2151959d215d405f54dff3c7ab3bf1fd887ca v4.3.3

v4.3.2

Commits:

• bf96635d243118de6e4f260077aa137453790bf6 Loosen strictObjectinside intersection (#5587)
• f71dc0182ab0f0f9a6be6295b07faca269e10179 Remove Juno (#5590)
• 0f41e5a12a43e6913c9dcb501b2b5136ea86500d 4.3.2

v4.3.1

Commits:

• 0fe88407a4149c907929b757dc6618d8afe998fc allow non-overwriting extends with refinements. 4.3.1

v4.3.0

This is Zod's biggest release since 4.0. It addresses several of Zod's longest-standing feature requests.

... (truncated)

Commits

• ca3c862 v4.3.6
• 762e911 Generalize numeric key handling
• dfbbf1c Avoid re-exported star modules (#5656)
• cbf77bb Avoid non null assertion (#5638)
• 85db85e fix: typo in codec.test.ts file (#5628)
• edd4132 fix: add missing User-agent to robots.txt and allow all (#5646)
• 251d716 Clean up workflow_call
• f4b7bae Update pullfrog.yml (#5634)
• 9977fb0 Add brand.dev to sponsors
• 0cdc0b8 4.3.5
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Note

Medium Risk
Major-version upgrade of a runtime schema/validation library may introduce API/behavior changes that can break validation or parsing at runtime. Lockfile churn is otherwise mechanical.

Overview
Bumps the zod dependency from 3.25.x to 4.3.6 in package.json.

Updates package-lock.json accordingly, including resolving chromium-bidi to use its own nested zod@3.25.76 while the root dependency moves to zod@4.3.6, and removing some now-unneeded lockfile entries under addons-linter.

^{Written by Cursor Bugbot for commit 365a209. This will update automatically on new commits. Configure here.}

[cursor]

ZodError .errors property removed in Zod 4

High Severity

The upgrade from Zod 3 to Zod 4 introduces a breaking change that will cause a runtime error. The codebase at shared/js/background/classes/tracker-stats.js line 179 uses result.error.errors.length, but in Zod 4, the .errors alias on ZodError has been removed. The official Zod 4 documentation shows ZodError now only has .issues. When validation fails, accessing .errors will return undefined, causing a TypeError: Cannot read property 'length' of undefined.

---

_{Please tell me if this was useful or not with a 👍 or 👎.}

 

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

[cursor]

Major zod v3→v4 bump without source code migration

High Severity

This bumps zod across a major version (v3 → v4) with no corresponding source code changes. The codebase uses z.discriminatedUnion('messageType', [...]) in shared/js/newtab/schema.js, which relies on the v3 two-argument API where the discriminator key is the first argument. In v4, z.discriminatedUnion was reworked to auto-detect the discriminator and primarily accepts a single array argument. Other v4 breaking changes — including .default() behavior within optional fields and error structure changes — could also cause subtle runtime regressions in shared/js/background/classes/tracker-stats.js where .default(0) and .default([]) are used inside z.object().

---

_{Please tell me if this was useful or not with a 👍 or 👎.}

Additional Locations (1)

• package-lock.json#L13367-L13370