## Bug: Zod v3/v4 incompatibility with Medusa 2.14.x causes middleware crash

[juansoler]

Description

There is a compatibility issue between @lambdacurry/medusa-product-reviews and Medusa 2.14.x.

Medusa 2.14.2 changed internally from Zod v3 to Zod v4. However, @lambdacurry/medusa-product-reviews versions 1.3.1 and 1.4.0 still use Zod v3.

As a result, the application crashes when Medusa evaluates the plugin middlewares.

This is not a configuration issue. It is a compatibility bug between the plugin and Medusa 2.14.x.

---

Affected versions

• Medusa: 2.14.2
• Plugin: @lambdacurry/medusa-product-reviews
  • 1.3.1
  • 1.4.0
• Zod:
  • Medusa uses Zod v4
  • The plugin uses Zod v3

---

Root cause

The crash happens when the plugin evaluates middleware validation schemas using code similar to:

createFindParams({ ... }).merge(z.object({ ... }))

In this expression:

createFindParams({ ... })

returns a Zod v4 schema from Medusa, while:

z.object({ ... })

creates a Zod v3 schema from the plugin dependency.

The problem is that .merge() is being executed on a Zod v4 schema, but the schema passed into .merge() is a Zod v3 object.

Zod v4 expects the merged schema to expose the internal structure:

b._zod.def.shape

However, Zod v3 schemas use:

_def

instead of:

_zod

Therefore, b._zod is undefined, which leads to a crash when Zod v4 tries to access:

b._zod.def.shape

This results in an undefined.def / undefined access error during middleware evaluation.

---

Why it works in older Medusa versions

The same plugin works correctly with Medusa 2.13.5.

For example, in our environment:

• fp51 is running Medusa 2.13.5
• Medusa 2.13.5 still uses Zod v3 internally
• The plugin also uses Zod v3
• Therefore, there is no Zod v3/v4 schema conflict

The issue only appears after upgrading to Medusa 2.14.x, where Medusa internally uses Zod v4.

---

Expected behavior

The plugin should work correctly with Medusa 2.14.x.

Middleware validation schemas should not crash when evaluated.

The plugin should either:

• use the same Zod major version as Medusa,
• avoid mixing Zod schemas from different major versions,
• or update its validation logic to be compatible with Medusa 2.14.x.

---

Actual behavior

The application crashes during middleware evaluation because a Zod v4 schema returned by Medusa attempts to merge with a Zod v3 schema created by the plugin.

The crash is caused by the internal incompatibility between Zod v3 and Zod v4 schema objects.

---

Current workaround

We worked around the issue by replacing the affected plugin routes with our own API routes:

/store/product-reviews
/store/product-review-stats

These custom routes use:

query.graph()

and do not perform any Zod .merge() operation.

Because of that, they avoid the Zod v3/v4 incompatibility entirely.

The database tables already exist from a previous migration, so the issue appears to be isolated to the plugin middleware validation layer.

With this workaround in place, we can proceed using:

medusa develop

---

Steps to reproduce

1. Install Medusa 2.14.2.
2. Install @lambdacurry/medusa-product-reviews version 1.3.1 or 1.4.0.
3. Configure the plugin normally.
4. Start the Medusa application.
5. Medusa crashes while evaluating the plugin middlewares.

---

Suggested fix

The plugin should be updated to be compatible with Medusa 2.14.x.

Possible fixes:

1. Upgrade the plugin to use Zod v4.
2. Ensure that schemas passed into Medusa helpers such as createFindParams() are created using the same Zod version as Medusa.
3. Avoid merging plugin-created Zod schemas with Medusa-generated schemas when the Zod major versions may differ.
4. Replace .merge() usage with a Medusa/Zod-version-safe validation approach.

---

Additional context

This bug was confirmed by comparing two environments:

Working environment

• Medusa: 2.13.5
• Plugin: @lambdacurry/medusa-product-reviews
• Result: works correctly

Failing environment

• Medusa: 2.14.2
• Plugin: @lambdacurry/medusa-product-reviews 1.3.1 / 1.4.0
• Result: crashes during middleware evaluation

The difference is that Medusa 2.13.5 still uses Zod v3, while Medusa 2.14.2 uses Zod v4 internally.