[dependabot]

Bumps the minor-and-patch group with 24 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.10	2.5.14
fallow	3.17.0	3.28.0
@hono/zod-validator	0.9.0	0.9.1
@workos-inc/node	10.10.0	10.14.0
drizzle-orm	0.45.2	0.45.3
hono	4.13.3	4.13.9
zod	4.4.3	4.6.5
@cloudflare/workers-types	5.20260822.1	5.20260925.1
drizzle-kit	0.31.10	0.31.11
wrangler	4.125.0	4.140.0
@rive-app/react-canvas	4.32.1	4.35.0
@tanstack/react-query	5.101.4	5.103.2
lucide-react	1.33.0	1.48.0
react	19.2.8	19.3.0
@types/react	19.2.18	19.3.0
react-dom	19.2.8	19.3.0
@types/react-dom	19.2.4	19.3.0
wouter	3.10.0	3.11.0
@happy-dom/global-registrator	20.11.6	20.14.5
@testing-library/react	16.3.2	16.3.3
@types/node	26.2.0	26.6.2
@types/react	19.2.18	19.3.0
@types/react-dom	19.2.4	19.3.0
@vitejs/plugin-react	6.1.0	6.1.1
oxlint	1.79.0	1.85.0
vite	8.2.2	8.3.1

Updates @biomejs/biome from 2.5.10 to 2.5.14

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.14

2.5.14

Patch Changes

• #9022 0d49e24 Thanks @​dyc3! - Added the nursery rule noReturnInFinally. This rule disallows return statements in Promise.prototype.finally() callbacks, including inside nested blocks and conditional branches. Returns in nested functions are ignored by the rule.

  // Invalid: return in finally callback
  Promise.resolve(1).finally(() => { return 2 })
  // Valid: no return in finally callback
  Promise.resolve(1).finally(() => { console.log(2) })

  Returning a value from a Promise.prototype.finally() callback does not replace the original promise's fulfillment value, which can be confusing. Returned promises and thenables are awaited, and their rejection rejects the resulting promise.

• #11754 71eaa0d Thanks @​griff-rees! - Added the nursery rule noSvelteAtDebugTags, which disallows Svelte's {@debug} tag.

  <!-- Invalid: leftover debugging tag -->
  {@debug user}

  The {@debug} tag is a debugging aid and should be removed once you no longer need it, as it should not remain in production code. The rule provides a safe fix that removes the tag.

• #11725 5eb5f09 Thanks @​m1handr! - Added the nursery rule useValidTestTitle, which enforces valid titles for unit test cases and suites.

• #11735 9bd70c7 Thanks @​ematipico! - Fixed #8471: source.fixAll.biome ignored formatter.formatWithErrors. It now applies safe fixes without formatting files that have parse errors when the option is disabled.

• #11715 f05a3c3 Thanks @​ematipico! - Fixed #7771: Grit plugins that use sequential no longer panic when Biome processes files.

• #11766 c2542c6 Thanks @​dyc3! - Fixed validation of readonly and accessor modifiers: combining them in either order now reports that they cannot be used together.

• #11461 22e9966 Thanks @​FoundDream! - Fixed #11423: Multiline template interpolations now preserve the indentation of their closing brace when the source indentation is not a multiple of tabWidth.

   const value = `
        ${
          condition
            ? "yes"
            : "no"
  -}
  +     }
   `;

• #11766 c2542c6 Thanks @​dyc3! - Fixed #11763: TypeScript class members using override accessor, such as override accessor value = 1, now parse correctly. The reversed order, accessor override, now reports that override must precede accessor.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.14

Patch Changes

• #9022 0d49e24 Thanks @​dyc3! - Added the nursery rule noReturnInFinally. This rule disallows return statements in Promise.prototype.finally() callbacks, including inside nested blocks and conditional branches. Returns in nested functions are ignored by the rule.

  // Invalid: return in finally callback
  Promise.resolve(1).finally(() => { return 2 })
  // Valid: no return in finally callback
  Promise.resolve(1).finally(() => { console.log(2) })

  Returning a value from a Promise.prototype.finally() callback does not replace the original promise's fulfillment value, which can be confusing. Returned promises and thenables are awaited, and their rejection rejects the resulting promise.

• #11754 71eaa0d Thanks @​griff-rees! - Added the nursery rule noSvelteAtDebugTags, which disallows Svelte's {@debug} tag.

  <!-- Invalid: leftover debugging tag -->
  {@debug user}

  The {@debug} tag is a debugging aid and should be removed once you no longer need it, as it should not remain in production code. The rule provides a safe fix that removes the tag.

• #11725 5eb5f09 Thanks @​m1handr! - Added the nursery rule useValidTestTitle, which enforces valid titles for unit test cases and suites.

• #11735 9bd70c7 Thanks @​ematipico! - Fixed #8471: source.fixAll.biome ignored formatter.formatWithErrors. It now applies safe fixes without formatting files that have parse errors when the option is disabled.

• #11715 f05a3c3 Thanks @​ematipico! - Fixed #7771: Grit plugins that use sequential no longer panic when Biome processes files.

• #11766 c2542c6 Thanks @​dyc3! - Fixed validation of readonly and accessor modifiers: combining them in either order now reports that they cannot be used together.

• #11461 22e9966 Thanks @​FoundDream! - Fixed #11423: Multiline template interpolations now preserve the indentation of their closing brace when the source indentation is not a multiple of tabWidth.

   const value = `
        ${
          condition
            ? "yes"
            : "no"
  -}
  +     }
   `;

• #11766 c2542c6 Thanks @​dyc3! - Fixed #11763: TypeScript class members using override accessor, such as override accessor value = 1, now parse correctly. The reversed order, accessor override, now reports that override must precede accessor.

• #11790 17d0ff0 Thanks @​ematipico! - Fixed #10248: noUselessFragments now allows fragments with props in Astro files, such as <Fragment slot="name">{text}</Fragment> inside template expressions.

... (truncated)

Commits

• af4365d ci: release (#11711)
• 7ee3a6c fix(useExhaustiveSwitchCases): add option requireExplicitCase (#11777)
• 02ea438 feat(json_analyze): implement noJsonUnsafeValues (#9758)
• 64fd314 feat(json_analyze): implement useConsistentObjectKeys (#9797)
• a9c4aa0 feat(html): detect undeclared custom Vue directives (#11651)
• 1fc17e3 feat: expand useIncludes (#11739)
• 71eaa0d feat(lint/html/svelte): add noSvelteAtDebugTags (#11754)
• 9bd70c7 fix: various bug fixes (#11735)
• c7c4e2b fix(analyzer): various bugs (#11720)
• 5eb5f09 feat(biome_js_analyze): implement useValidTestTitle rule (#9176) (#11725)
• Additional commits viewable in compare view

Updates fallow from 3.17.0 to 3.28.0

Release notes

Sourced from fallow's releases.

v3.28.0: baselines carry a kind, request outcomes on every surface, Module Federation and Nuxt reads

Features

• Every saved baseline now says which command wrote it. --save-baseline writes a top-level kind field with dead-code, dupes or health. Older baselines without it still load, and an older fallow still loads a baseline saved by this release.
• Pointing --baseline at the wrong command's file is no longer silent. The run prints a warning with both command names and the path, and the file suppresses nothing. In the JSON output, baseline_staleness.unrecognised_format is true. The same warning appears in the pull-request comment, the merge-request note and the Check Run. The GitHub job summary shows the file path through the new baseline-path output, and fallow audit prints one warning per baseline it cannot use.
• The JSON output says what narrowed a run. baseline_staleness.scope_reasons lists the reasons, for example changed-since or production. A narrowed run with a baseline also gets a recheck-baseline entry in next_steps, and the bare fallow command gets it too.
• request_outcomes is now in the output of fallow flags, fallow suppressions and fallow security. The first two report their changed-since entry, and fallow security --sarif-file gets a sarif-file entry.
• An empty diff no longer looks like a clean project. When a diff filter applies, its request_outcomes entry has a scope_size with the number of added lines. A diff with zero added lines reports scope_size: 0. The Action, the GitLab template, the MCP tools and the pull-request comment then all say that the clean result covers nothing.
• hotspots-skipped now has a cause: not-a-repository, invalid-since or churn-file-unreadable.
• A config that a plugin cannot read shows up in workspace_diagnostics. When a Module Federation exposes or remotes is not a static object literal, the run records plugin-config-unreadable with the plugin, the key and the reason. It sets degrades_analysis, so the Action and the GitLab template print it in their degraded-inputs warning. Nuxt has a related case: a components: or imports: shape that fallow cannot model. Such a project records plugin-effect-not-modeled, and that entry is silent.
• The JSON output and both CI integrations report a run that widened to the whole project. They also report a --sarif-file that could not be written, and a format that cannot group results with --group-by.
• fallow reads Module Federation exposes and remotes. It reads module-federation.config.* and inline plugin options in webpack, rspack, rsbuild, vite and Next.js configs. The plugin call can sit anywhere in the config: in a nested plugin array, in a variable, under tools.rspack.plugins or in a webpack(config) hook. Options held in a const in the same file are read, and so is the array form of exposes. Each exposes target becomes a runtime entry point, and each remotes alias counts as a provided dependency for the code under that config's directory.
• Nuxt autoImports credits a global/ or islands/ component under the name Nuxt gives it. Each workspace root now gets its own verdict from its own config. components: true, imports: {} and imports: { dirs: [] } count as the Nuxt default. A name imported or re-exported from #components or #imports marks its file as used, and #layers/<name>/ works as a path alias.

Changed

• fallow dead-code no longer exits 2 when the baseline belongs to another command. It warns and continues. --fail-on-stale-baseline fails the run on such a file. Saving over a baseline of another kind is refused with exit 2.
• The GitHub Action and the GitLab template log why a JSON read failed. The cause goes to the debug log, and a green run gets no extra line.
• fallow security --base warns when it cannot map the analysis root into the base worktree.

Bug fixes

• A package name in a bundler entry is credited as a dependency. A value like react-hot-loader/patch or webpack-hot-middleware/client?reload=true in a webpack, rspack or rsbuild entry used to become an entry pattern that matched no file. The package then showed up as unused.
• The MCP audit and decision_surface tools detect the base ref again. This regressed in 3.1.0. Thanks @​codingthat for the report and the reproduction (#2699).
• autoImports: true works in a Nuxt project that turns the scan off. components: false, imports: { scan: false } and the other scan-off shapes no longer count as a custom layout, so unused convention files are reported. Thanks @​Tsuyoshi84 for the report (#2695).

Upgrade notes

• A CI job that points --baseline at another command's file now fails when --fail-on-stale-baseline is set. Give each command its own baseline file.
• A Nuxt project with autoImports: true and one of the scan-off shapes will see new unused-file findings. Add a file to entry when it is used in a way fallow cannot see.
• If you switch on workspace_diagnostics[].kind, handle the two new kinds. Every new JSON field is optional.

Full Changelog: fallow-rs/fallow@v3.27.0...v3.28.0

v3.27.0: every CI gate can fail the job, baseline staleness in CI, gate results in MCP

Features

• An armed gate reports its result in the JSON output. A run that arms a gate gets gate_outcomes, an object keyed by gate name. Each entry has status (pass, warn, fail or skipped) and enforced. Where a comparison happened, you also get observed, threshold and threshold_label. Only the gates the run armed appear in the object. A dead-code run can exit 1 on the default severity rules with no object at all. The key set is open, and a gate name you do not recognise means "some gate". (#2680, #2681, #2683, #2685)
• The JSON output reports a stale baseline, and CI can fail on it. 3.26.0 printed the stale-baseline warning and --fail-on-stale-baseline on stderr only, and --quiet removes that output. The GitHub Action and the GitLab template both run with --quiet. dead-code / check, the bare run, dupes and health report one baseline_staleness object, in grouped output too. It holds the entry counts, change_scoped, the warning result and gate_trips. Both integrations show a stale baseline as a warning and in the job summary. On a pull request the main run covers changed files only. The integrations therefore re-read the baseline once over the whole project. That re-read took 0.11s with a cache and 0.24s with type-aware analysis on an 870-file TypeScript project. Whether a stale baseline fails the job depends on the new fail-on-stale-baseline input and the FALLOW_FAIL_ON_STALE_BASELINE variable. The pull-request comment and the merge-request note do not include the warning yet. Thanks @​cloud-walker for the report, which traced the gap through the action scripts. (#2673)
• min-score is an Action input and a GitLab variable. Before this release you could set it only through args: / FALLOW_ARGS. --min-score implies --score, so the integrations add --complexity when no health section input is set. That keeps the annotations, the SARIF upload and the pull-request comment populated. The CLI turns its own findings rule off for such a run, and the integrations do the same, which leaves the decision to the score. min-score and min-severity apply to command: health and exit 2 elsewhere. (#2682)
• A run that analyzed no source file reports it. The run prints a warning and passes by default. fail-on-empty-analysis: true (FALLOW_FAIL_ON_EMPTY_ANALYSIS on GitLab) makes it fail. The JSON output has a no-source-files-analyzed diagnostic and the new workspace_diagnostics[].degrades_analysis field. When findings cover less than the whole project, the integrations print one combined warning with the diagnostic kinds and their counts. (#2686)
• An MCP tool result reports what each gate concluded. The tools run the CLI with --quiet and turn exit 1 into a successful result, which hid every gate result from the agent. The root warnings array reports a stale baseline together with the re-save remedy. It also lists every gate that concluded fail or warn, with its numbers. A run that covered less than the whole project gets one entry too. The subprocess, Code Mode and typed routes all do this. find_dupes with a threshold takes the route that can evaluate it. A response with nothing to report is unchanged. (#2676)
• fallow report --from shows the gate results in CI. It prints them as a notice annotation and as a line in the job summary, the pull-request comment and the merge-request note. The line is informational and never fails a step. (#2684)

Changed

• security-gate fails the job independently of fail-on-issues. In both integrations the security branch sat inside the fail-on-issues conditional, and fail-on-issues: false meant that branch never ran.
• The Action's inline Check threshold step is gone. Its logic moved into the analyze step, and the gates-failed output names the gates that decided the result.
• In combined mode the duplication threshold does not fail the run, and the JSON output has enforced: false for it. Standalone dupes exits 1 as before. The default GitLab job forwards the threshold in combined mode, and that pipeline prints a warning with the reason.
• --fail-on-stale-baseline changes one field in the output. That field is gate_outcomes["stale-baseline"].enforced. Nothing in baseline_staleness depends on the flag, not even gate_trips.

... (truncated)

Commits

• bd8fca5 chore: release v3.28.0
• b04ec44 docs(changelog): edit the unreleased entries for the 3.28.0 release (#2759)
• f9fb3f9 refactor(cli): resolve the base analysis root and the short HEAD through the ...
• c3197ec feat(plugins): read Module Federation options wherever a config declares them...
• 234d24c feat(baseline): give saved baselines a kind and report an unrecognised one on...
• 7e2e7ad feat(plugins): record a plugin config fallow cannot read as a workspace diagn...
• 4cec981 docs(release): let the preflight name repository secrets instead of blocking ...
• d4264c2 fix(plugins): credit bundler entry packages and close the Nuxt autoImports pr...
• 173ee40 ci(release): run credential jobs in a main-only release environment (#2746)
• 731a504 feat(output): carry the request outcomes and skip causes four commands left o...
• Additional commits viewable in compare view

Updates @hono/zod-validator from 0.9.0 to 0.9.1

Release notes

Sourced from @​hono/zod-validator's releases.

@​hono/zod-validator@​0.9.1

Patch Changes

• #2112 51b7f976286d0429179142e8058dcc59d1e82d75 Thanks @​T4ko0522! - Cached case-insensitive header schema metadata when creating validator middleware.

Changelog

Sourced from @​hono/zod-validator's changelog.

0.9.1

Patch Changes

• #2112 51b7f976286d0429179142e8058dcc59d1e82d75 Thanks @​T4ko0522! - Cached case-insensitive header schema metadata when creating validator middleware.

Commits

• 8de0f1e Version Packages (#2114)
• 51b7f97 perf(zod-validator): Caching the key mapping table of the header scheme (#2112)
• 40f956e chore(dev-deps): partial upgrade to TypeScript 7 (#2048)
• See full diff in compare view

Updates @workos-inc/node from 10.10.0 to 10.14.0

Release notes

Sourced from @​workos-inc/node's releases.

v10.14.0

10.14.0 (2026-09-21)

Features

• Add optional issuer option for session token validation (#1694) (02effa7)
• audit-logs: Add Audit Log Retention methods (#1705) (ab1c464)

Bug Fixes

• ci: harden dep-bump workflow against sed injection (#1709) (6e1e1fe)
• encode caller-supplied path parameters in legacy modules (#1710) (1fe77c6)
• keep request timeouts active while reading response bodies (#1711) (26eaed6)
• reject 5-byte LEB128 encodings that overflow uint32 in decodeUInt32 (#1690) (fb303c9)
• session: return refreshed user and impersonator from refresh() (#1708) (855063b)

v10.13.0

10.13.0 (2026-08-31)

Features

• Add Agent Blueprints API support (#1687) (364e223)
• Add Waitlists API support (#1689) (0faa84f)

v10.12.0

10.12.0 (2026-08-27)

Features

• Add IT Contacts API (#1681) (5237aa2)

Bug Fixes

• events: Type Pipes connected account events (#1686) (b880c76)
• Surface the error field and request ID on 422 exceptions (#1656) (2bc92ef)

v10.11.0

10.11.0 (2026-08-21)

Features

• Evaluate custom targets in the feature flags runtime client (#1674) (f30c3fa)

Changelog

Sourced from @​workos-inc/node's changelog.

10.14.0 (2026-09-21)

Features

• Add optional issuer option for session token validation (#1694) (02effa7)
• audit-logs: Add Audit Log Retention methods (#1705) (ab1c464)

Bug Fixes

• ci: harden dep-bump workflow against sed injection (#1709) (6e1e1fe)
• encode caller-supplied path parameters in legacy modules (#1710) (1fe77c6)
• keep request timeouts active while reading response bodies (#1711) (26eaed6)
• reject 5-byte LEB128 encodings that overflow uint32 in decodeUInt32 (#1690) (fb303c9)
• session: return refreshed user and impersonator from refresh() (#1708) (855063b)

10.13.0 (2026-08-31)

Features

• Add Agent Blueprints API support (#1687) (364e223)
• Add Waitlists API support (#1689) (0faa84f)

10.12.0 (2026-08-27)

Features

• Add IT Contacts API (#1681) (5237aa2)

Bug Fixes

• events: Type Pipes connected account events (#1686) (b880c76)
• Surface the error field and request ID on 422 exceptions (#1656) (2bc92ef)

10.11.0 (2026-08-21)

Features

• Evaluate custom targets in the feature flags runtime client (#1674) (f30c3fa)

Commits

• 4c12d5a chore(main): release 10.14.0 (#1706)
• 26eaed6 fix: keep request timeouts active while reading response bodies (#1711)
• 1fe77c6 fix: encode caller-supplied path parameters in legacy modules (#1710)
• 855063b fix(session): return refreshed user and impersonator from refresh() (#1708)
• fb303c9 fix: reject 5-byte LEB128 encodings that overflow uint32 in decodeUInt32 (#1690)
• 02effa7 feat: Add optional issuer option for session token validation (#1694)
• b6e42b0 chore(deps): update minor and patch updates (#1707)
• 6e1e1fe fix(ci): harden dep-bump workflow against sed injection (#1709)
• ab1c464 feat(audit-logs): Add Audit Log Retention methods (#1705)
• a3e5545 chore: protect package installs with Socket Firewall (#1695)
• Additional commits viewable in compare view

Updates drizzle-orm from 0.45.2 to 0.45.3

Release notes

Sourced from drizzle-orm's releases.

0.45.3

New Netlify DB Driver

Note: The Netlify DB driver is developed and maintained by the Netlify team.

Installation:

npm i @netlify/db

Usage example:

import { drizzle } from 'drizzle-orm/netlify-db';
// reads NETLIFY_DB_URL and NETLIFY_DB_DRIVER env vars
const db = drizzle();
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';
const db = drizzle(process.env.DATABASE_URL);
const result = await db.execute('select 1');

import { drizzle } from 'drizzle-orm/netlify-db';

// Explicit client — consumer controls the driver
const db = drizzle({ client: netlifyDbClient });

const result = await db.execute('select 1');

Commits

• 15454db +
• 54e436f exclude gel from pull
• 0fd1cc6 remove gel
• d028db7 skip gel
• 93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
• b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
• f9fc5bf Add drizzle-kit announcement manifest and schema doc
• 9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
• 0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
• 6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
• Additional commits viewable in compare view

Updates hono from 4.13.3 to 4.13.9

Release notes

Sourced from hono's releases.

v4.13.9

What's Changed

• fix(jsx): replace Suspense and ErrorBoundary content across newlines in honojs/hono#5380
• fix(accepts): match media types and language tags case-insensitively in honojs/hono#5376
• fix(linear-router): don't match an empty path segment as a param in honojs/hono#5373
• fix(pretty-json): don't break responses with unparseable JSON bodies in honojs/hono#5377
• fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in honojs/hono#5379
• fix(aws-lambda): treat binary +xml archive media types as binary in honojs/hono#5424
• fix(aws-lambda): preserve empty query parameters in honojs/hono#5292
• fix(lambda-edge): sync content type detection with aws-lambda in honojs/hono#5426
• fix(lambda-edge): fail with a descriptive error on a malformed event in honojs/hono#5358

Full Changelog: honojs/hono@v4.13.8...v4.13.9

v4.13.8

What's Changed

• docs: fix typos in code comments and link third-party middleware section in honojs/hono#5343
• perf(jsx/dom): reduce lookup work for large keyed updates in honojs/hono#5340
• fix(aws-lambda): respect backpressure when streaming the response body in honojs/hono#5351
• fix(accepts, language): skip accept entries with quality 0 when matching in honojs/hono#5311
• fix(accept): treat the q parameter name as case-insensitive in honojs/hono#5349
• fix(accept): clamp a negative q to 0, not 1 in honojs/hono#5357
• fix(request): keep the request media type when reusing a cached body in honojs/hono#5366
• docs(combine): fix except() JSDoc param and add missing @​returns in honojs/hono#5346
• perf(jsx/dom): optimize matching-head child lookup during reconciliation in honojs/hono#5329

Full Changelog: honojs/hono@v4.13.7...v4.13.8

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297
• fix(client): normalize root WebSocket URLs in honojs/hono#5291
• fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300
• chore: bump editorconfig-checker in honojs/hono#5336
• refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

... (truncated)

Commits

• 7c3b0df 4.13.9
• 6cadf75 fix(lambda-edge): fail with a descriptive error on a malformed event (#5358)
• de310ac fix(lambda-edge): sync content type detection with aws-lambda (#5426)
• 28e8572 fix(aws-lambda): preserve empty query parameters (#5292)
• 0d86899 fix(aws-lambda): treat binary +xml archive media types as binary (#5424)
• 52febbc fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url (#5...
• f950277 fix(pretty-json): don't break responses with unparseable JSON bodies (#5377)
• 00ee875 fix(linear-router): don't match an empty path segment as a param (#5373)
• f5a5346 fix(accepts): match media types and language tags case-insensitively (#5376)
• cb5bea3 fix(jsx): replace Suspense and ErrorBoundary content across newlines (#5380)
• Additional commits viewable in compare view

Updates zod from 4.4.3 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits

• 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
• 0f3f5ee 4.6.5
• cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
• ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
• 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
• de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.