z.object() strips unknown keys by default in both Zod 3 and Zod 4, and that has not changed. What changed is how the other two behaviors are expressed. The .strict() and .passthrough() methods are deprecated in favor of constructing the schema with z.strictObject() or z.looseObject() up front.
The practical consequence of the default is worth restating because it causes real data loss: parsing an API response with z.object() returns an object without any field the schema did not declare. Adding a field to the API and forgetting the schema means the value silently disappears rather than failing loudly.
Use z.strictObject() for request bodies where an unexpected key indicates a client bug worth rejecting, and z.looseObject() where extra data must survive round-tripping. The methods still function in Zod 4, so this is a lint-level migration rather than a breaking one, but .deepPartial() was removed outright and has no replacement.