Skip to content

fix: restore admin form validation under zod v4 (@hookform/resolvers v5)#16128

Open
shanikonimbo wants to merge 2 commits into
medusajs:developfrom
shanikonimbo:fix/zod-v4-resolvers
Open

fix: restore admin form validation under zod v4 (@hookform/resolvers v5)#16128
shanikonimbo wants to merge 2 commits into
medusajs:developfrom
shanikonimbo:fix/zod-v4-resolvers

Conversation

@shanikonimbo

Copy link
Copy Markdown

What

Upgrades @hookform/resolvers (3.4.2 → ^5.2.2) and react-hook-form (7.49.1 → ^7.55.0) in @medusajs/dashboard and the @medusajs/draft-order plugin — the only two packages that pin them — plus a regenerated yarn.lock and a changeset.

Why

Medusa's internal zod moved to v4 in 2.14. In zod v4 a ZodError exposes only .issues — the old .errors alias was removed. @hookform/resolvers@3.x guards on error.errors != null, which is now always false, so the ZodError is re-thrown instead of being mapped into react-hook-form's formState.errors. Result: admin form validation errors are silently dropped — no inline field errors render on an invalid submit. Purely client-side (the backend reads .issues and is unaffected).

How

@hookform/resolvers@5 detects the schema shape (zod v4 schemas expose _zod) and reads error.issues, so it maps validation errors correctly. resolvers v5 declares react-hook-form@^7.55.0 as a peer, so both must be bumped together. The lockfile was regenerated with yarn install --mode=update-lockfile (resolvers → 5.4.0, react-hook-form → 7.82.0; no other entries affected).

Testing

Additional context

@hookform/resolvers@3.x reads the removed ZodError.errors property, so under
zod v4 (Medusa's internal zod since 2.14) validation errors are silently
dropped instead of populating react-hook-form's formState.errors — no inline
field errors render on invalid submit.

Bump @hookform/resolvers to ^5.2.2 (auto-detects zod v3/v4, reads .issues) and
react-hook-form to ^7.55.0 (peer requirement of resolvers v5) in the dashboard
and draft-order plugin, regenerate the lockfile, and add a changeset.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@shanikonimbo
shanikonimbo requested a review from a team as a code owner July 20, 2026 11:04
@changeset-bot

changeset-bot Bot commented Jul 20, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: ae6c1c7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 79 packages
Name Type
@medusajs/dashboard Patch
@medusajs/draft-order Patch
@medusajs/loyalty-plugin Patch
@medusajs/admin-bundler Patch
@medusajs/medusa Patch
@medusajs/test-utils Patch
@medusajs/medusa-oas-cli Patch
integration-tests-http Patch
@medusajs/analytics Patch
@medusajs/api-key Patch
@medusajs/auth Patch
@medusajs/caching Patch
@medusajs/cart Patch
@medusajs/currency Patch
@medusajs/customer Patch
@medusajs/file Patch
@medusajs/fulfillment Patch
@medusajs/index Patch
@medusajs/inventory Patch
@medusajs/link-modules Patch
@medusajs/locking Patch
@medusajs/notification Patch
@medusajs/order Patch
@medusajs/payment Patch
@medusajs/pricing Patch
@medusajs/product Patch
@medusajs/promotion Patch
@medusajs/rbac Patch
@medusajs/region Patch
@medusajs/sales-channel Patch
@medusajs/settings Patch
@medusajs/stock-location Patch
@medusajs/store Patch
@medusajs/tax Patch
@medusajs/translation Patch
@medusajs/user Patch
@medusajs/workflow-engine-inmemory Patch
@medusajs/workflow-engine-redis Patch
@medusajs/oas-github-ci Patch
@medusajs/cache-inmemory Patch
@medusajs/cache-redis Patch
@medusajs/event-bus-local Patch
@medusajs/event-bus-redis Patch
@medusajs/analytics-local Patch
@medusajs/analytics-posthog Patch
@medusajs/auth-emailpass Patch
@medusajs/auth-github Patch
@medusajs/auth-google Patch
@medusajs/caching-redis Patch
@medusajs/file-local Patch
@medusajs/file-s3 Patch
@medusajs/fulfillment-manual Patch
@medusajs/locking-postgres Patch
@medusajs/locking-redis Patch
@medusajs/notification-local Patch
@medusajs/notification-sendgrid Patch
@medusajs/payment-stripe Patch
@medusajs/core-flows Patch
@medusajs/framework Patch
@medusajs/js-sdk Patch
@medusajs/modules-sdk Patch
@medusajs/orchestration Patch
@medusajs/query Patch
@medusajs/types Patch
@medusajs/utils Patch
@medusajs/workflows-sdk Patch
@medusajs/http-types-generator Patch
@medusajs/cli Patch
@medusajs/deps Patch
@medusajs/eslint-plugin Patch
@medusajs/telemetry Patch
@medusajs/admin-sdk Patch
@medusajs/admin-shared Patch
@medusajs/admin-vite-plugin Patch
@medusajs/icons Patch
@medusajs/toolbox Patch
@medusajs/ui-preset Patch
create-medusa-app Patch
@medusajs/ui Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@medusa-os-bot

medusa-os-bot Bot commented Jul 20, 2026

Copy link
Copy Markdown

Thanks for the contribution! Initial automated review looks good.

Dependency bump: @hookform/resolvers 3.4.2 -> 5.4.0 and react-hook-form 7.49.1 -> 7.82.0 in dashboard and draft-order. Root cause verified: dashboard declares zod 4.2.0, and resolvers 3.x reads the removed ZodError.errors; resolvers 5.1.0+ supports zod v4 (still zod v3 compat) and maps validation errors correctly. RHF jump is in-range 7.x (adds React 19 peer). Supply chain clean: genuine packages, one legit new transitive dep @standard-schema/utils, no new lifecycle scripts, lockfile consistent. Areas to test: dashboard typecheck/build and admin form validation, since resolvers 3->5 is a major

Triggered by: new PR opened

@shahednasser shahednasser left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your contribution @shanikonimbo !

Have you tried running the build command? The @medusajs/dashboard package has build errors following this update. Can you fix them?

Under @hookform/resolvers v5 the zodResolver is typed on the schema's zod v4
output type, which no longer matches react-hook-form's field value generics in
a few generic form wrappers. This restores a clean typecheck/build:

- useExtendableForm: default TTransformedValues to the schema's inferred type
  (v5's rhf peer >=7.55 otherwise resolves handleSubmit's data to `undefined`),
  and cast the useForm options to keep the declared value types over the
  extended (base + additional_data) schema.
- tiered-price-form / property-labels: cast the generically-typed zodResolver
  call to the form's Resolver type.
- data-grid-root: cast the memoized control to Control<any> for the context value.
- order-balance-settlement: guard optional nested field value access.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants