upgrade everything-server to zod v4, latest MCP sdk

[KKonstantinov]

Upgrade the everything server from Zod v3 to Zod v4, replacing deprecated APIs with their v4 equivalents.

Description

Migrate @modelcontextprotocol/server-everything from Zod v3 (^3.25.0) to Zod v4 (^4.0.0). This is a pragmatic migration that replaces deprecated APIs with clean v4 replacements while keeping .describe() (still supported in v4) for schema metadata.

Dependency changes:

• zod: ^3.25.0 → ^4.0.0
• @modelcontextprotocol/sdk: ^1.26.0 → ^1.29.0 (adds Zod v4 type compatibility)
• zod-to-json-schema: removed (never directly imported; Zod v4 has built-in z.toJSONSchema())

Code changes (3 files):

• tools/gzip-file-as-resource.ts: z.string().url() → z.url() (deprecated string method → top-level function)
• tools/trigger-elicitation-request-async.ts: z.object({...}).passthrough() → z.looseObject({...}) (deprecated method → top-level function)
• tools/trigger-sampling-request-async.ts: same .passthrough() → z.looseObject() change

Server Details

• Server: everything
• Changes to: tools (3 files), dependencies (package.json)

Motivation and Context

Zod v4 is the current stable release. The deprecated v3 APIs (.url() on strings, .passthrough() on objects) will be removed in the next major version. Upgrading the reference server keeps it current and demonstrates idiomatic Zod v4 usage for MCP server authors.

How Has This Been Tested?

• All 95 existing tests pass across 5 test files (vitest run --coverage)
• TypeScript build (tsc) passes with no type errors
• All changes are mechanical 1:1 API replacements with identical runtime semantics

Breaking Changes

None. The tool input schemas, behavior, and MCP protocol surface are unchanged. This is a dependency upgrade with internal API modernization only.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Protocol Documentation
• My changes follows MCP security best practices
• I have updated the server's README accordingly
• I have tested this with an LLM client
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have documented all environment variables and configuration options

Additional context

Zod v4 APIs that remain unchanged in this migration:

• .describe() — still supported in v4 (.meta() is preferred but .describe() is not removed). Kept as-is to avoid churning 50+ usages across 15 files.
• .default() — behavior changed in v4 (skips re-validation when input is undefined), but all defaults in this codebase are valid values within their schema constraints, so no impact.
• .parse(), z.object(), z.string(), z.number(), z.enum(), z.union(), z.any(), .optional(), .min(), .max(), z.infer<> — all unchanged in v4.

[KKonstantinov]

PS. Also bumped other packages to 1.29.0 SDK.

[cliffhall]

LGTM! 👍

Tested all features locally with the Inspector.