Repository navigation
Update non-major dependencies - #4
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
3 times, most recently
from
September 12, 2026 07:50
6ca239d to
72c5323
Compare
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
2 times, most recently
from
September 19, 2026 16:08
c87b7d4 to
f0b922d
Compare
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
2 times, most recently
from
October 4, 2026 11:49
8fb53c4 to
39049ea
Compare
renovate
Bot
force-pushed
the
renovate/non-major-dependencies
branch
from
October 12, 2026 21:23
39049ea to
ade0a0e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
20.19.42→20.19.436.2.3→6.2.124.21.0→4.23.154.4.3→4.6.5Release Notes
panva/jose (jose)
v6.2.12Compare Source
Documentation
Refactor
Performance
v6.2.11Compare Source
Documentation
Refactor
v6.2.10Compare Source
Fixes
Documentation
Refactor
v6.2.9Compare Source
Fixes
v6.2.8Compare Source
Fixes
Refactor
v6.2.7Compare Source
Fixes
Refactor
v6.2.6Compare Source
Fixes
v6.2.5Compare Source
Fixes
Documentation
Refactor
v6.2.4Compare Source
Documentation
Refactor
privatenumber/tsx (tsx)
v4.23.15Compare Source
Bug Fixes
This release is also available on:
v4.23.14Compare Source
Bug Fixes
This release is also available on:
v4.23.13Compare Source
Bug Fixes
This release is also available on:
v4.23.12Compare Source
Bug Fixes
import.metawhen tokens are split by comments or newlines (#829) (ed9d330), closes #828This release is also available on:
v4.23.11Compare Source
Bug Fixes
This release is also available on:
v4.23.10Compare Source
Bug Fixes
This release is also available on:
v4.23.9Compare Source
Bug Fixes
This release is also available on:
v4.23.8Compare Source
Bug Fixes
This release is also available on:
v4.23.7Compare Source
Bug Fixes
This release is also available on:
v4.23.6Compare Source
Bug Fixes
This release is also available on:
v4.23.5Compare Source
Bug Fixes
This release is also available on:
v4.23.4Compare Source
Bug Fixes
This release is also available on:
v4.23.3Compare Source
Bug Fixes
This release is also available on:
v4.23.2Compare Source
Bug Fixes
This release is also available on:
v4.23.1Compare Source
Bug Fixes
Performance Improvements
This release is also available on:
v4.23.0Compare Source
Bug Fixes
Features
This release is also available on:
v4.22.5Compare Source
Bug Fixes
This release is also available on:
v4.22.4Compare Source
Bug Fixes
This release is also available on:
v4.22.3Compare Source
Bug Fixes
This release is also available on:
v4.22.2Compare Source
Bug Fixes
This release is also available on:
v4.22.1Compare Source
Bug Fixes
This release is also available on:
v4.22.0Compare Source
Features
This release is also available on:
v4.21.1Compare Source
Bug Fixes
This release is also available on:
colinhacks/zod (zod)
v4.6.5Compare Source
Commits:
d2b135cdocs: add the 4.6.x patch highlights to the 4.6 postf1448f7docs: fold the 4.6.x patch highlights into the 4.6 post's own sectionsde65a5cdocs: lead the properties section with the check and add a Zod Mini tab (#6598)56222cdfeat(instanceof): key the .properties() shape off the instance type (#6600)ca0229aRevert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"cc4cd4eRevert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""0f3f5ee4.6.559bbc03chore: re-pin the integration peers to the workspace zod after the 4.6.5 bumpv4.6.4Compare Source
A patch on top of 4.6.3.
d6bc1e30feat: addz.currencyCode()over a vendored ISO 4217 list, refreshed weekly by CI (#6595)ad32d751perf:z.url()rejects an invalid URL withURL.canParse()instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)2bb08717chore: re-pin the integration peers to the workspace zod after the 4.6.4 bumpf6e1701achore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)v4.6.3Compare Source
A patch on top of 4.6.2.
413cce9afix(v4): make z.properties() a check again (#6594) — removes the standalonez.properties()schema from 4.6.0;z.instanceof().properties()and.check(...z.properties())are unchanged75d63ee1docs: show only the.properties()method form in the 4.6 post46da9572docs: match the error-message examples to what the parsers emitv4.6.2Compare Source
A patch on top of 4.6.1.
9446b5ccfix: preserve undefined prefault outputs and object keys (#6587) — closes #65850c483c58docs: the Zod 4.6 announcement post (#6546)a00c3f34docs: use Trigger.dev's brand-kit lockups for the platinum cardv4.6.1Compare Source
A patch on top of 4.6.0.
b12aa523fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577dd9c36fafix(v4): defer recursive object index inference (#6580)3b154992feat(lang): add Tajik (tg) locale (#6581) by @ismoil772efa8b80ci: give the npm wait a real budget and drop the back-publish path (#6583)v4.6.0Compare Source
Zod 4.6 is now available.
At a glance:
.validate()— checks input validity without building a result (up to 35x faster than.safeParse().successon a compiled schema)z.instanceof().properties()— validates properties of an instancefromJSONSchema()— enforces six validation keywords it used to ignorez.iban()— electronic-format IBAN plus mod-97 checksumz.withParser()— installs a parser generated elsewhere, for environments withoutnew Functionz.validate()underrequire)@zod/mini— Zod Mini as a standalone package, versioned in lockstep withzodsince 4.5.validate()Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a
ZodError, which makes rejection cheap. The return type is a guard on the schema's input type.It is a method on Zod Classic schemas too. (#6547)
In conjunction with
z.compile(), this can be up to 35x faster than.safeParse().successon invalid input.Time per call on invalid input, compiled with z.compile() — lower is better (benchmark)
Uncompiled schemas
Without compilation it is up to 5.9x faster. The saving is the result object:
.safeParse()allocates one with an accessor pair on every call, and.validate()allocates nothing.Time per call on invalid input, plain schemas — lower is better (benchmark)
Both charts measure the failure path. The key feature of
.validate()is that it can short-circuit on the first issue it encounters, instead of aggregating a fullZodIssue[]array.z.properties()A new API for validating specific properties of an object. Unlike
z.object()it validates in-place, so it plays nice with class instances. (#6536)A corresponding
.properties()method has been added toZodInstanceOf.Zod
Zod Mini
The input comes back untouched, so the prototype survives and the methods still work. That is the part
z.object()cannot do: it would hand back a plain object and theResponsewould be gone.fromJSONSchema()Six additional JSON Schema keywords are now supported in
z.fromJSONSchema(). (#6535)minProperties/maxPropertiesuniqueItemscontainsminContains/maxContainsBoth property bounds count the input's own keys. Array uniqueness is structural, so
[{ a: 1 }, { a: 1 }]is a duplicate.z.iban()A new string format: an IBAN in electronic format, with a valid ISO 7064 MOD 97-10 checksum. (#6571)
z.withParser()z.compile()builds its parser withnew Function, which a strict Content Security Policy blocks.z.withParser()is that installer on its own: it takes a parser generated somewhere else, at build time or by a native compiler, and installs it under the same contract. (#6575)The supplied parser owns the whole result, so it has to return what the schema would have returned. This one rebuilds the object rather than handing back its input, because
z.object()strips unknown keys. Returningz.INVALIDhands the input to the runtime, which stays the only source ofZodErrors.Faster CommonJS
TypeScript compiles a re-export to a getter, and 252 of the 255 exports on Zod 4.5's CommonJS entrypoint were getters. V8 could not see a constant callee behind one, so it could not inline the call. The 4.6 build emits plain properties and freezes the exports object. On a compiled schema,
z.validate()underrequireis about 3x faster than it was in Zod 4.5. (#6564)Only calls through the namespace were affected. A method call like
Player.safeParse(data)never reads the exports object, and the ESM build is unchanged.Memory retention in recursive schemas
A recursive schema held the input and output of its last parse until the next parse replaced it, so one long-lived schema pinned every object it had touched. Zod 4.4 released that input and Zod 4.5 did not, which surfaced as an out-of-memory failure on a repository-wide lint run. The parse state is weak throughout now: one parse of a 29k-node tree retains 2.2 MB where it used to retain 10.1 MB, and recursive parses give up about 6% for it. (#6572)
Bug fixes
errorBecause
safeParse()now builds its error lazily, error maps — global, locale, and per-schemaerror— run whenresult.erroris first read, not at parse time. Code that swapsz.config()between the parse and the read gets the newer configuration. (#6519)An error map with a side effect never runs if nothing reads the error. Throwing parses are unaffected —
.parse()builds and throws its error immediately, never takes the lazy path, and its stack still points at your call site.z.emoji()rejects component-only stringsUnicode's
Emoji_Componentproperty covers the pieces that attach to an emoji, soz.emoji()accepted"123","#","*", and a lone zero-width joiner, variation selector, or skin tone modifier. The pattern now requires at least one pictograph, regional indicator, or keycap. (#6532)Flags, subdivision flags, skin-tone-modified emoji, and ZWJ sequences are unchanged. Closes #6515.
A numeric TypeScript enum also carries its reverse mapping (
0to"UK") at runtime. The parser already ignored those keys, but.optionswas read straight off the enum object, so a three-member enum listed six values and three of them failed to parse. (#6542)The runtime patterns for
z.base64()andz.base64url()are the character sets, with length and padding enforced in code, so a multi-megabyte string can no longer overflow the regex stack through a composed schema. The JSON Schema output still emits the exact block forms, soz.toJSONSchema()is unchanged. (#6534, #6527)Composing
z.base64()into a template literal now checks the alphabet but not the length, which is howz.creditCard()already behaves there. The exportedz.regexes.base64urlis now the length-aware form, so it overflows on a multi-megabyte input the same wayz.regexes.base64does.z.email()opened with two lookaheads, and the second scanned the whole string before the match began. Both are gone, and the rule they enforced — no empty segment in the local part — is expressed structurally instead, soz.email()accepts and rejects exactly what it did before. Valid addresses validate roughly twice as fast. (#6573)The pattern string is user-visible, and every copy of it changes:
z.regexes.email, which has no capture groups now — neither of the two it used to expose held a usable value;issue.patternon a failedz.email(); and thepatternthatz.toJSONSchema()emits, which no longer carries a lookahead, so validators outside ECMAScript can compile it.Composing an email into a template literal also stops applying its no-consecutive-dots rule to the rest of the string.
Each check used to write its own bounds into the schema as it attached, in chain order, so a format check applied after
.min()and.max()replaced the tighter values with its own range. The converter folds the checks as a conjunction now. The order they are chained in no longer changes the output. (#6554, #6553)Runtime parsing enforced the bounds in every version. Only the emitted schema was wrong. The same fold fixes two more cases: a repeated
multipleOfkept the first divisor and dropped the rest, soz.number().multipleOf(2).multipleOf(3)emitted a schema that accepts 4, andz.string().min(8).length(5)emittedminLength: 5, widening a bound the runtime still rejected. Closes #6550.Eight members on a Zod Classic schema —
.format,.minLength,.maxLength,.minValue,.maxValue,.isInt,.minDateand.maxDate— are computed from the checks now instead of being written onto every instance at construction. Each one is a prototype getter that becomes an own property on first read. (#6554)A key is absent until something reads it, and
Object.assign({}, schema)copies only the members that have been read. Deleting one restores the getter, and the next read recomputes it.The values can move too, because the getters read the same fold the JSON Schema converter does. An order-dependent chain reports the tighter bound now instead of whichever check wrote last.
Commits
Zod 4.6 rolls up 72 commits.
661673aedocs: make the 9thCO logo visible on the light theme by @colinhacks6de10dcedocs: reconcile the sponsor listings against every active sponsorship (#6579) by @colinhacks213ee75dfeat(compile): add z.withParser for externally generated parsers (#6575) by @colinhacksf9465d4edocs: reconcile the sponsor listings with active sponsorships (#6576) by @colinhacksf7fd5548perf(v4): drop the lookaheads from the email regex (#6573) by @colinhacks36f17960fix(v4): stop the memoizer from pinning a finished parse (#6572) by @colinhacks22bed613feat(v4): add z.iban() string format with mod-97 checksum (#6571) by @colinhacksc5b9bcb3bench: measure what a runtime island's leaked indent cost the generated source by @colinhackse54716cbdocs(ecosystem): add @apical-ts/craft (#5946) by @gunzipdcbcf052fix(compile): unwind the doc indent when a child generator throws (#6570) by [@colinhacks](httConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.