fix(v4): restrict the first ULID character to [0-7] (#6095)

A ULID is 128 bits in 26 Crockford base32 characters, so the encoding carries two more bits than the value does. Those bits are discarded on decode rather than rejected, which is why `0…`, `8…`, `G…` and `R…` all decode to the same 128-bit value. The spec caps the largest ULID at `7ZZZZZZZZZZZZZZZZZZZZZZZZZ` for that reason, and oklog/ulid added its own `v[0] > '7'` guard after the collision was found in production.

The regex accepted the full alphabet in the first position, so `z.ulid()` validated strings the reference implementation refuses to decode — `ulid.decodeTime("8AAAAAAAAAAAAAAAAAAAAAAAAA")` throws "timestamp too large" on a string that just passed validation. `validator.js` ships the identical `[0-7]` class, and Go's oklog/ulid and python-ulid enforce the same ceiling.

`7ZZZZZZZZZZZZZZZZZZZZZZZZZ` still validates, and a generated ULID does not reach a first character of `1` until the year 3084, so nothing a conforming generator emits is affected. Strings that previously passed and were never ULIDs now fail — that includes every letter first character, not only `8` and `9`, which is what the tests pin.

Note that this changes the `pattern` emitted by `z.toJSONSchema(z.ulid())`.

Zod 3 is in maintenance mode and is intentionally left untouched.

Author: JSap0914

packages/zod/src/v4/classic/tests/continuability.test.ts

@@ -318,7 +318,7 @@ test("continuability", () => {
         "message": "Invalid ULID",
         "origin": "string",
         "path": [],
-        "pattern": "/^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/",
+        "pattern": "/^[0-7][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{25}$/",
       },
       {
         "code": "custom",

packages/zod/src/v4/classic/tests/string.test.ts

@@ -730,14 +730,20 @@ test("ulid", () => {
   const caseInsensitive = ulid.safeParse("01arZ3nDeKTsV4RRffQ69G5FAV");
   expect(caseInsensitive.success).toEqual(true);
 
+  // first char is capped at 7: the spec's largest ULID is 7ZZZZZZZZZZZZZZZZZZZZZZZZZ, so 8-9 and every letter overflow 2^48-1
+  expect(ulid.safeParse("7ZZZZZZZZZZZZZZZZZZZZZZZZZ").success).toEqual(true);
+  for (const first of ["8", "9", "A", "Z", "z"]) {
+    expect(ulid.safeParse(`${first}AAAAAAAAAAAAAAAAAAAAAAAAA`).success).toEqual(false);
+  }
+
   expect(result.error!.issues[0].message).toEqual("Invalid ULID");
   expect(result.error).toMatchInlineSnapshot(`
     [ZodError: [
       {
         "origin": "string",
         "code": "invalid_format",
         "format": "ulid",
-        "pattern": "/^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/",
+        "pattern": "/^[0-7][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{25}$/",
         "path": [],
         "message": "Invalid ULID"
       }

packages/zod/src/v4/classic/tests/template-literal.test.ts

@@ -579,7 +579,7 @@ test("regexes", () => {
   expect(mac._zod.pattern.source).toMatchInlineSnapshot(
     `"^(?:[0-9A-F]{2}:){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}:){5}[0-9a-f]{2}$"`
   );
-  expect(ulid._zod.pattern.source).toMatchInlineSnapshot(`"^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$"`);
+  expect(ulid._zod.pattern.source).toMatchInlineSnapshot(`"^[0-7][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{25}$"`);
   expect(uuid._zod.pattern.source).toMatchInlineSnapshot(
     `"^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"`
   );

packages/zod/src/v4/classic/tests/to-json-schema.test.ts

@@ -255,7 +255,7 @@ describe("toJSONSchema", () => {
       {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "format": "ulid",
-        "pattern": "^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$",
+        "pattern": "^[0-7][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{25}$",
         "type": "string",
       }
     `);

packages/zod/src/v4/core/regexes.ts

@@ -7,7 +7,7 @@ import * as util from "./util.js";
  */
 export const cuid: RegExp = /^[cC][0-9a-z]{6,}$/;
 export const cuid2: RegExp = /^[0-9a-z]+$/;
-export const ulid: RegExp = /^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/;
+export const ulid: RegExp = /^[0-7][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{25}$/;
 export const xid: RegExp = /^[0-9a-vA-V]{20}$/;
 export const ksuid: RegExp = /^[A-Za-z0-9]{27}$/;
 export const nanoid: RegExp = /^[a-zA-Z0-9_-]{21}$/;