trails-cool/trails

Watch

Fork 0

chore(deps): Update production (non-major) #138

Merged

renovate merged 1 commit from renovate/production-(non-major) into main

2026-09-09 21:29:42 +00:00

renovate commented

2026-09-09 21:02:55 +00:00

Collaborator

This PR contains the following updates:

Package	Change	Age	Confidence
@logtape/logtape (source)	`2.3.3` → `2.3.4`
@sentry/node (source)	`10.73.0` → `10.74.0`
@sentry/react (source)	`10.73.0` → `10.74.0`
@types/node (source)	`22.20.1` → `22.20.2`
@types/react (source)	`19.2.18` → `19.3.0`
@types/react-dom (source)	`19.2.7` → `19.3.0`
nodemailer (source)	`10.0.1` → `10.0.2`
zod (source)	`4.5.4` → `4.6.0`

Release Notes

dahlia/logtape (@logtape/logtape)

`v2.3.4`

Compare Source

Released on September 9, 2026.

@logtape/file

Fixed an error where importing @logtape/file could prevent a bundled
server from starting with Top-level await promise never resolved.
This could occur when Vite or Rollup placed shared dependencies in a chunk
waiting for the platform driver to load. Existing imports and sink APIs
continue to work without changes.
[#213]

getsentry/sentry-javascript (@sentry/node)

Path	Size
@sentry/browser	27.12 KB
@sentry/browser - with treeshaking flags	25.59 KB
@sentry/browser (incl. Tracing)	45.53 KB
@sentry/browser (incl. Tracing + Span Streaming)	47.29 KB
@sentry/browser (incl. Tracing, Profiling)	50.18 KB
@sentry/browser (incl. Tracing, Replay)	83.87 KB
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags	73.74 KB
@sentry/browser (incl. Tracing, Replay with Canvas)	88.49 KB
@sentry/browser (incl. Tracing, Replay, Feedback)	100.82 KB
@sentry/browser (incl. Feedback)	43.89 KB
@sentry/browser (incl. sendFeedback)	31.8 KB
@sentry/browser (incl. FeedbackAsync)	36.82 KB
@sentry/browser (incl. Metrics)	28.19 KB
@sentry/browser (incl. Logs)	28.41 KB
@sentry/browser (incl. Metrics & Logs)	29.09 KB
@sentry/react	28.89 KB
@sentry/react (incl. Tracing)	47.74 KB
@sentry/vue	32.42 KB
@sentry/vue (incl. Tracing)	47.47 KB
@sentry/svelte	27.15 KB
CDN Bundle	29.46 KB
CDN Bundle (incl. Tracing)	47.45 KB
CDN Bundle (incl. Logs, Metrics)	31.01 KB
CDN Bundle (incl. Tracing, Logs, Metrics)	48.75 KB
CDN Bundle (incl. Replay, Logs, Metrics)	69.37 KB
CDN Bundle (incl. Tracing, Replay)	84.11 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	85.38 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	89.75 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	91.01 KB
CDN Bundle - uncompressed	87.79 KB
CDN Bundle (incl. Tracing) - uncompressed	143.27 KB
CDN Bundle (incl. Logs, Metrics) - uncompressed	92.39 KB
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	147.15 KB
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	214.29 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	259.77 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	263.65 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	273.15 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	277.02 KB
@sentry/nextjs (client)	50.26 KB
@sentry/sveltekit (client)	45.95 KB
@sentry/core/server	78.9 KB
@sentry/core/browser	65.38 KB
@sentry/node-core	61.83 KB
@sentry/node	123.05 KB
@sentry/node (incl. diagnostics channel injection)	166.11 KB
@sentry/node/import (ESM hook with diagnostics-channel injection)	166 B
@sentry/node/light	50.24 KB
@sentry/node - without tracing	73.24 KB
@sentry/aws-serverless	82.28 KB
@sentry/cloudflare (withSentry) - minified	198 KB
@sentry/cloudflare (withSentry)	487.68 KB

`v10.0.2`

Compare Source

Bug Fixes

mime-node: flatten nested recipient arrays without recursion (ebe0849)
shared: keep the TLS server name out of the DNS cache (a6512db)

colinhacks/zod (zod)

`v4.6.0`

Compare Source

Zod 4.6 is now available.

npm install zod@latest

At a glance:

.validate() — checks input validity without building a result (up to 35x faster than .safeParse().success on a compiled schema)
z.instanceof().properties() — validates properties of an instance
fromJSONSchema() — enforces six validation keywords it used to ignore
z.iban() — electronic-format IBAN plus mod-97 checksum
z.withParser() — installs a parser generated elsewhere, for environments without new Function
Faster CommonJS — drops the getter on every export (~3x faster z.validate() under require)
Memory retention in recursive schemas — releases the parsed input, fixing a 4.5 out-of-memory regression
@zod/mini — Zod Mini as a standalone package, versioned in lockstep with zod since 4.5

`.validate()`

Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a ZodError, which makes rejection cheap. The return type is a guard on the schema's input type.

z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42);   // false

It is a method on Zod Classic schemas too. (#6547)

const Player = z.object({
  username: z.string(),
  xp: z.number(),
});

if (Player.validate(data)) {
  data.username; // narrowed
}

In conjunction with z.compile(), this can be up to 35x faster than .safeParse().success on invalid input.

Time per call on invalid input, compiled with z.compile() — lower is better (benchmark)

Uncompiled schemas

Without compilation it is up to 5.9x faster. The saving is the result object: .safeParse() allocates one with an accessor pair on every call, and .validate() allocates nothing.

Time per call on invalid input, plain schemas — lower is better (benchmark)

Both charts measure the failure path. The key feature of .validate() is that it can short-circuit on the first issue it encounters, instead of aggregating a full ZodIssue[] array.

[!NOTE]
Async refinements are covered by .validateAsync().

`z.properties()`

A new API for validating specific properties of an object. Unlike z.object() it validates in-place, so it plays nice with class instances. (#6536)

const responseLike = z.properties({ status: z.number().min(200).max(299) });

responseLike.parse(new Response("ok", { status: 200 }));  // ✅ a real Response
responseLike.parse({ status: 204 });                      // ✅ a plain object

A corresponding .properties() method has been added to ZodInstanceOf.

Zod

const okResponse = z.instanceof(Response).properties({
  ok: z.literal(true),
  status: z.number().min(200).max(299),
});

Zod Mini

const okResponse = z.instanceof(Response).check(...z.properties({
  ok: z.literal(true),
  status: z.number().check(z.minimum(200), z.maximum(299)),
}));

The input comes back untouched, so the prototype survives and the methods still work. That is the part z.object() cannot do: it would hand back a plain object and the Response would be gone.

const res = await fetch("/api/user");

okResponse.parse(res) === res; // ✅ true

`fromJSONSchema()`

Six additional JSON Schema keywords are now supported in z.fromJSONSchema(). (#6535)

const schema = z.fromJSONSchema({
  type: "object",
  minProperties: 2,      // also maxProperties
});

schema.parse({ a: 1 });        // ❌ too few properties
schema.parse({ a: 1, b: 2 });  // ✅

Both property bounds count the input's own keys. Array uniqueness is structural, so [{ a: 1 }, { a: 1 }] is a duplicate.

z.fromJSONSchema({ type: "array", uniqueItems: true }).parse([{ a: 1 }, { a: 1 }]); // ❌

z.fromJSONSchema({
  type: "array",
  contains: { type: "number" },   // also minContains and maxContains
  minContains: 2,
}).parse(["a", 2]);               // ❌ only one number

`z.iban()`

A new string format: an IBAN in electronic format, with a valid ISO 7064 MOD 97-10 checksum. (#6571)

z.iban().parse("DE89370400440532013000"); // ✅
z.iban().parse("DE89370400440532013001"); // ❌ bad checksum

`z.withParser()`

z.compile() builds its parser with new Function, which a strict Content Security Policy blocks. z.withParser() is that installer on its own: it takes a parser generated somewhere else, at build time or by a native compiler, and installs it under the same contract. (#6575)

const Player = z.object({ username: z.string(), xp: z.number() });

// isPlayer is a type guard your build step generated
const Fast = z.withParser(Player, (input) =>
  isPlayer(input) ? { username: input.username, xp: input.xp } : z.INVALID
);

The supplied parser owns the whole result, so it has to return what the schema would have returned. This one rebuilds the object rather than handing back its input, because z.object() strips unknown keys. Returning z.INVALID hands the input to the runtime, which stays the only source of ZodErrors.

Faster CommonJS

TypeScript compiles a re-export to a getter, and 252 of the 255 exports on Zod 4.5's CommonJS entrypoint were getters. V8 could not see a constant callee behind one, so it could not inline the call. The 4.6 build emits plain properties and freezes the exports object. On a compiled schema, z.validate() under require is about 3x faster than it was in Zod 4.5. (#6564)

const { z } = require("zod");
const CompiledPlayer = z.compile(Player);

z.validate(CompiledPlayer, data); // ~3x faster than Zod 4.5

Only calls through the namespace were affected. A method call like Player.safeParse(data) never reads the exports object, and the ESM build is unchanged.

Memory retention in recursive schemas

A recursive schema held the input and output of its last parse until the next parse replaced it, so one long-lived schema pinned every object it had touched. Zod 4.4 released that input and Zod 4.5 did not, which surfaced as an out-of-memory failure on a repository-wide lint run. The parse state is weak throughout now: one parse of a 29k-node tree retains 2.2 MB where it used to retain 10.1 MB, and recursive parses give up about 6% for it. (#6572)

const Category = z.object({
  name: z.string(),
  get children() {
    return z.array(Category);
  },
});

Bug fixes

⚠️ Error maps run on the first read of `error`

Because safeParse() now builds its error lazily, error maps — global, locale, and per-schema error — run when result.error is first read, not at parse time. Code that swaps z.config() between the parse and the read gets the newer configuration. (#6519)

const result = schema.safeParse(12);
z.config(z.locales.fr());
result.error.issues[0].message; // French in 4.6, English in 4.5

An error map with a side effect never runs if nothing reads the error. Throwing parses are unaffected — .parse() builds and throws its error immediately, never takes the lazy path, and its stack still points at your call site.

⚠️ `z.emoji()` rejects component-only strings

Unicode's Emoji_Component property covers the pieces that attach to an emoji, so z.emoji() accepted "123", "#", "*", and a lone zero-width joiner, variation selector, or skin tone modifier. The pattern now requires at least one pictograph, regional indicator, or keycap. (#6532)

z.emoji().parse("😀");   // ✅
z.emoji().parse("1️⃣");   // ✅ the keycap is the anchor
z.emoji().parse("123");  // ❌ was accepted in 4.5

Flags, subdivision flags, skin-tone-modified emoji, and ZWJ sequences are unchanged. Closes #6515.

⚠️ Numeric enum options no longer include the reverse mappings

A numeric TypeScript enum also carries its reverse mapping (0 to "UK") at runtime. The parser already ignored those keys, but .options was read straight off the enum object, so a three-member enum listed six values and three of them failed to parse. (#6542)

enum Country { UK, Germany, France }

z.enum(Country).options; // 4.5: ["UK", "Germany", "France", 0, 1, 2] — 4.6: [0, 1, 2]

⚠️ base64 patterns

The runtime patterns for z.base64() and z.base64url() are the character sets, with length and padding enforced in code, so a multi-megabyte string can no longer overflow the regex stack through a composed schema. The JSON Schema output still emits the exact block forms, so z.toJSONSchema() is unchanged. (#6534, #6527)

Composing z.base64() into a template literal now checks the alphabet but not the length, which is how z.creditCard() already behaves there. The exported z.regexes.base64url is now the length-aware form, so it overflows on a multi-megabyte input the same way z.regexes.base64 does.

⚠️ The email pattern dropped its lookaheads

z.email() opened with two lookaheads, and the second scanned the whole string before the match began. Both are gone, and the rule they enforced — no empty segment in the local part — is expressed structurally instead, so z.email() accepts and rejects exactly what it did before. Valid addresses validate roughly twice as fast. (#6573)

The pattern string is user-visible, and every copy of it changes: z.regexes.email, which has no capture groups now — neither of the two it used to expose held a usable value; issue.pattern on a failed z.email(); and the pattern that z.toJSONSchema() emits, which no longer carries a lookahead, so validators outside ECMAScript can compile it.

Composing an email into a template literal also stops applying its no-consecutive-dots rule to the rest of the string.

z.templateLiteral([z.email(), "|", z.string()]).parse("a@b.cc|a..b");
// 4.5: ❌ — the lookahead reached past the email segment — 4.6: ✅

⚠️ Chained checks no longer overwrite each other in JSON Schema

Each check used to write its own bounds into the schema as it attached, in chain order, so a format check applied after .min() and .max() replaced the tighter values with its own range. The converter folds the checks as a conjunction now. The order they are chained in no longer changes the output. (#6554, #6553)

z.toJSONSchema(z.number().min(0).max(23).int());
// 4.5: { minimum: -9007199254740991, maximum: 9007199254740991 }
// 4.6: { minimum: 0, maximum: 23 }

Runtime parsing enforced the bounds in every version. Only the emitted schema was wrong. The same fold fixes two more cases: a repeated multipleOf kept the first divisor and dropped the rest, so z.number().multipleOf(2).multipleOf(3) emitted a schema that accepts 4, and z.string().min(8).length(5) emitted minLength: 5, widening a bound the runtime still rejected. Closes #6550.

⚠️ Metadata members materialize on first read

Eight members on a Zod Classic schema — .format, .minLength, .maxLength, .minValue, .maxValue, .isInt, .minDate and .maxDate — are computed from the checks now instead of being written onto every instance at construction. Each one is a prototype getter that becomes an own property on first read. (#6554)

const s = z.string().min(3).max(9);

Object.keys(s); // 4.5: ["def", "type", "format", "minLength", "maxLength"] — 4.6: ["def", "type"]
s.minLength;    // 3 in both
Object.keys(s); // 4.6: ["def", "type", "minLength"]

A key is absent until something reads it, and Object.assign({}, schema) copies only the members that have been read. Deleting one restores the getter, and the next read recomputes it.

The values can move too, because the getters read the same fold the JSON Schema converter does. An order-dependent chain reports the tighter bound now instead of whichever check wrote last.

z.string().min(8).length(5).minLength; // 4.5: 5 — 4.6: 8

Commits

Zod 4.6 rolls up 72 commits.

661673ae docs: make the 9thCO logo visible on the light theme by @colinhacks
6de10dce docs: reconcile the sponsor listings against every active sponsorship (#6579) by @colinhacks
213ee75d feat(compile): add z.withParser for externally generated parsers (#6575) by @colinhacks
f9465d4e docs: reconcile the sponsor listings with active sponsorships (#6576) by @colinhacks
f7fd5548 perf(v4): drop the lookaheads from the email regex (#6573) by @colinhacks
36f17960 fix(v4): stop the memoizer from pinning a finished parse (#6572) by @colinhacks
22bed613 feat(v4): add z.iban() string format with mod-97 checksum (#6571) by @colinhacks
c5b9bcb3 bench: measure what a runtime island's leaked indent cost the generated source by @colinhacks
e54716cb docs(ecosystem): add @apical-ts/craft (#5946) by @gunzip
dcbcf052 fix(compile): unwind the doc indent when a child generator throws (#6570) by @colinhacks
277613a6 docs: move the release procedure to the maintainer-local notes by @colinhacks
eb1c1089 ci: release only on workflow_dispatch behind the npm environment (#6569) by @colinhacks
741981ff perf(compile): for-in record walk, cheaper issue finalization, and a generative compile differential (#6567) by @colinhacks
804e0f52 perf: seal the CommonJS exports so require("zod") stops reading through a getter (#6564) by @colinhacks
6f048367 fix(v4): derive JSON Schema constraints by folding checks in the converter (#6554) by @colinhacks
e4d67f3e Migrate development and CI to Nub (#6562) by @colinhacks
7a002366 fix(v4): don't let format checks overwrite tighter min/max bounds (#6553) by @colinhacks
5489a532 test(v4): pin the check-chain case that keeps compiled validate's definite guard (#6551) by @colinhacks
e7604717 docs: attribute the compiled failure cost to the fallback, not the double pass by @colinhacks
764ac59f perf(v4): settle z.validate on the first failure in parse order (#6544) by @colinhacks
07917f4c test(v4): pin the lazy safeParse error's stack behavior (#6548) by @colinhacks
62e6624b feat(v4): add .validate() and .validateAsync() to Zod Classic (#6547) by @colinhacks
cafbee47 fix(v4): parse recursive schemas built by a factory (#6530) by @colinhacks
4d730882 Release the parsed input once a failing safeParse builds its error (#6543) by @colinhacks
90269c60 Keep a numeric TS enum's reverse-mapping keys out of .options (#6542) by @colinhacks
18e71c71 Rename the JSON Schema process helper so bundler polyfills cannot collide (#6541) by @colinhacks
68aca3dc docs: cover the 4.5 API surface that never made it into the reference by @colinhacks
eca96871 fix(v4): enforce the six JSON Schema keywords fromJSONSchema silently dropped (#6535) by @colinhacks
81ded991 perf: answer z.validate from the compiled fast path on invalid input (#6538) by @colinhacks
51caf010 refactor: collapse cachedInternal back into cached (#6540) by @colinhacks
abfb3897 feat(v4): make z.properties() a schema, and give z.instanceof() a .properties() method (#6536) by @colinhacks
69f2a7ff Collapse toZod's normalizer and move its docs to the API reference (#6539) by @colinhacks
bf990216 perf: move util.cached's accessor to a prototype (#6537) by @colinhacks
bec73bea perf(v4): build the safeParse error on first read (#6519) by @colinhacks
07c43e2a Keep the runtime base64 regexes linear so composed parse paths cannot overflow (#6534) by @colinhacks
bc1157e7 docs: use a Response example for z.properties() by @colinhacks
2ec972ec refactor: collapse toZod's enum leaf normalizer to a dummy union (#6533) by @colinhacks
68a609ac Widen literal inputs in property check types (#6520) by @colinhacks
0227e53d docs: bump the star pill's GitHub mark to 20px by @colinhacks
84dd3b0f perf: build literal and enum pattern regexes lazily (#6531) by @colinhacks
f83ab511 fix(v4): reject component-only strings from z.emoji() (#6532) by @colinhacks
74f9a6d3 docs: drop the toZod enum block from basics and pin the page's curation rule in a comment by @colinhacks
a2a019a5 Accept enum-typed targets in z.toZod (#6528) by @colinhacks
319f47f4 Emit a length-aware base64url pattern in toJSONSchema (#6527) by @colinhacks
08ba069e perf(v4): read Luhn digits with charCodeAt instead of string indexing (#6529) by @colinhacks
1ec6b7c5 docs: add an RSS feed to the blog at /blog/rss.xml by @colinhacks
b801439b bench: add typebox (compiled and dynamic) to the moltar cross-library harness by @colinhacks
7ae49d64 docs: drop the circle around the star pill's GitHub mark and center it on the pill's arc by @colinhacks
93f3ab32 docs: replace the blog navbar's GitHub icon with a star-count pill by @colinhacks
fb2fedfd docs: tighten the memory chart callout, pad the canvas, say "less memory" by @colinhacks
ff56a551 docs: center the memory chart callout labels and pad them off the number by @colinhacks
8cd1250f docs: center the memory chart callout labels by @colinhacks
3195ed01 docs: label the memory chart like the compile chart by @colinhacks
a6b49390 Mark the compile internals @internal instead of hiding them (#6518) by @colinhacks
40b4d0b3 fix(ci): read zod's latest version with npm view when picking the backfill dist-tag by @colinhacks
5ff95665 Stop re-exporting the compile internals from zod/v4/core (#6511) by @colinhacks
f412178d ci: publish @zod/mini to JSR in lockstep with npm (#6510) by @colinhacks
f3e7c72e fix(docs): render the docs 404 page inside the (doc) layout once by @colinhacks
f3cb3644 docs: surface the blog on the home page and in the sidebar by @colinhacks
cd4f9a67 perf(v4): report Standard Schema issues without constructing a ZodError (#6509) by @colinhacks
43b9bfc5 docs: drop the bound-methods section from the Zod package page by @colinhacks
70eb2c07 docs: drop the traits section and the compilation feature bullet by @colinhacks
1c0bce0c docs: bring the 4.5 charts and worked examples into the docs pages by @colinhacks
a0898b4b ci: wait hours for npm to serve a publish, not ten minutes (#6502) by @colinhacks
c46eeff0 chore: narrow blanket biome-ignore comments (#6504) by @pullfrog[bot]
c7ec94d3 ci: check zod and @zod/mini lockstep on npm after every publish (#6507) by @colinhacks
81065739 chore(docs): build with Turbopack by @colinhacks
abd41adb docs(wiki): move plans and comparisons into a gitignored internal/ (#6506) by @colinhacks
2956c4c2 chore(mini): sync @zod/mini to 4.5.4 by @colinhacks
8ce9e8d5 feat(mini): publish Zod Mini as the standalone @zod/mini package (#6491) by @colinhacks
93186cab docs(wiki): drop the zod-compiler benchmark (#6505) by @colinhacks
908c9e17 fix(docs): retry the GitHub stars fetch and log the real status by @colinhacks

Configuration

📅 Schedule: (in timezone Europe/Copenhagen)

Branch creation
- "before 6am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@logtape/logtape](https://logtape.org/) ([source](https://github.com/dahlia/logtape/tree/HEAD/packages/logtape/)) | [`2.3.3` → `2.3.4`](https://renovatebot.com/diffs/npm/@logtape%2flogtape/2.3.3/2.3.4) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@logtape%2flogtape/2.3.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@logtape%2flogtape/2.3.3/2.3.4?slim=true) | | [@sentry/node](https://github.com/getsentry/sentry-javascript/tree/master/packages/node) ([source](https://github.com/getsentry/sentry-javascript)) | [`10.73.0` → `10.74.0`](https://renovatebot.com/diffs/npm/@sentry%2fnode/10.73.0/10.74.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@sentry%2fnode/10.74.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@sentry%2fnode/10.73.0/10.74.0?slim=true) | | [@sentry/react](https://github.com/getsentry/sentry-javascript/tree/master/packages/react) ([source](https://github.com/getsentry/sentry-javascript)) | [`10.73.0` → `10.74.0`](https://renovatebot.com/diffs/npm/@sentry%2freact/10.73.0/10.74.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@sentry%2freact/10.74.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@sentry%2freact/10.73.0/10.74.0?slim=true) | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | [`22.20.1` → `22.20.2`](https://renovatebot.com/diffs/npm/@types%2fnode/22.20.1/22.20.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/22.20.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/22.20.1/22.20.2?slim=true) | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/react) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react)) | [`19.2.18` → `19.3.0`](https://renovatebot.com/diffs/npm/@types%2freact/19.2.18/19.3.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2freact/19.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2freact/19.2.18/19.3.0?slim=true) | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/react-dom) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom)) | [`19.2.7` → `19.3.0`](https://renovatebot.com/diffs/npm/@types%2freact-dom/19.2.7/19.3.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2freact-dom/19.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2freact-dom/19.2.7/19.3.0?slim=true) | | [nodemailer](https://nodemailer.com/) ([source](https://github.com/nodemailer/nodemailer)) | [`10.0.1` → `10.0.2`](https://renovatebot.com/diffs/npm/nodemailer/10.0.1/10.0.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/nodemailer/10.0.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/nodemailer/10.0.1/10.0.2?slim=true) | | [zod](https://zod.dev) ([source](https://github.com/colinhacks/zod)) | [`4.5.4` → `4.6.0`](https://renovatebot.com/diffs/npm/zod/4.5.4/4.6.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/zod/4.6.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/zod/4.5.4/4.6.0?slim=true) | --- ### Release Notes <details> <summary>dahlia/logtape (@logtape/logtape)</summary> ### [`v2.3.4`](https://github.com/dahlia/logtape/blob/HEAD/CHANGES.md#Version-234) [Compare Source](https://github.com/dahlia/logtape/compare/2.3.3...2.3.4) Released on September 9, 2026. ##### [@logtape/file](https://github.com/logtape/file) - Fixed an error where importing `@logtape/file` could prevent a bundled server from starting with `Top-level await promise never resolved`. This could occur when Vite or Rollup placed shared dependencies in a chunk waiting for the platform driver to load. Existing imports and sink APIs continue to work without changes. \[[#213]] [#213]: https://github.com/dahlia/logtape/issues/213 </details> <details> <summary>getsentry/sentry-javascript (@sentry/node)</summary> ### [`v10.74.0`](https://github.com/getsentry/sentry-javascript/releases/tag/10.74.0) [Compare Source](https://github.com/getsentry/sentry-javascript/compare/10.73.0...10.74.0) - feat(v10): Streamline isolation scope handling & reset in isolation scopes ([#24152](https://github.com/getsentry/sentry-javascript/pull/24152)) - fix(server-utils): Include Gemini reasoning tokens in Vercel AI token usage ([#23433](https://github.com/getsentry/sentry-javascript/pull/23433)) - fix(v10/browser): Set `user_agent.original` on all spans for consistent filtering ([#24226](https://github.com/getsentry/sentry-javascript/pull/24226)) - fix(v10/cloudflare): Auto-instrument classes re-exported from the worker entry ([#24181](https://github.com/getsentry/sentry-javascript/pull/24181)) - fix(v10/core): Guard `loadModule` default parameter against ESM scope ([#24154](https://github.com/getsentry/sentry-javascript/pull/24154)) - fix(v10/core): Match wrapped Facebook Mobile browser errors in `DEFAULT_IGNORE_ERRORS` ([#23877](https://github.com/getsentry/sentry-javascript/pull/23877)) - fix(v10/core): Resolve MCP capture policy per operation ([#23796](https://github.com/getsentry/sentry-javascript/pull/23796)) - fix(v10/nextjs): Fix SDK import crashing under jsdom/happy-dom ([#23906](https://github.com/getsentry/sentry-javascript/pull/23906)) - fix(v10/nextjs): Keep the Pages Router runtime out of App Router client bundles ([#24223](https://github.com/getsentry/sentry-javascript/pull/24223)) - fix(v10/nextjs): Register Vercel AI span processors on Next.js ([#23773](https://github.com/getsentry/sentry-javascript/pull/23773)) - fix(v10/nuxt): Windows file:// for import-in-the-middle hook and isAbsolute for C:\ ([#24026](https://github.com/getsentry/sentry-javascript/pull/24026)) - fix(v10/profiling-node): Bump [@sentry/node-cpu-profiler](https://github.com/sentry/node-cpu-profiler) to 2.4.4 ([#24238](https://github.com/getsentry/sentry-javascript/pull/24238)) - fix(v10/sveltekit): Handle SvelteKit 3 error kinds in handleErrorWithSentry ([#23995](https://github.com/getsentry/sentry-javascript/pull/23995)) - fix(v10/sveltekit): Read Cloudflare execution context from platform.ctx ([#23994](https://github.com/getsentry/sentry-javascript/pull/23994)) - fix(v10/sveltekit): Read SvelteKit config from the Vite plugin ([#23998](https://github.com/getsentry/sentry-javascript/pull/23998)) <details> <summary><strong>Internal Changes</strong></summary> - test(e2e): Assert Next.js Cloudflare worker bundle stays free of orchestrion bundler plugins ([#23910](https://github.com/getsentry/sentry-javascript/pull/23910)) </details> Work in this release was contributed by [@halillusion](https://github.com/halillusion) and [@zkasuran](https://github.com/zkasuran). Thank you for your contributions! ##### Bundle size 📦 | Path | Size | | ----------------------------------------------------------------------------------------------------- | --------- | | [@sentry/browser](https://github.com/sentry/browser) | 27.12 KB | | [@sentry/browser](https://github.com/sentry/browser) - with treeshaking flags | 25.59 KB | | [@sentry/browser](https://github.com/sentry/browser) (incl. Tracing) | 45.53 KB | | [@sentry/browser](https://github.com/sentry/browser) (incl. Tracing + Span Streaming) | 47.29 KB | | [@sentry/browser](https://github.com/sentry/browser) (incl. Tracing, Profiling) | 50.18 KB | | [@sentry/browser](https://github.com/sentry/browser) (incl. Tracing, Replay) | 83.87 KB | | [@sentry/browser](https://github.com/sentry/browser) (incl. Tracing, Replay) - with treeshaking flags | 73.74 KB | | [@sentry/browser](https://github.com/sentry/browser) (incl. Tracing, Replay with Canvas) | 88.49 KB | | [@sentry/browser](https://github.com/sentry/browser) (incl. Tracing, Replay, Feedback) | 100.82 KB | | [@sentry/browser](https://github.com/sentry/browser) (incl. Feedback) | 43.89 KB | | [@sentry/browser](https://github.com/sentry/browser) (incl. sendFeedback) | 31.8 KB | | [@sentry/browser](https://github.com/sentry/browser) (incl. FeedbackAsync) | 36.82 KB | | [@sentry/browser](https://github.com/sentry/browser) (incl. Metrics) | 28.19 KB | | [@sentry/browser](https://github.com/sentry/browser) (incl. Logs) | 28.41 KB | | [@sentry/browser](https://github.com/sentry/browser) (incl. Metrics & Logs) | 29.09 KB | | [@sentry/react](https://github.com/sentry/react) | 28.89 KB | | [@sentry/react](https://github.com/sentry/react) (incl. Tracing) | 47.74 KB | | [@sentry/vue](https://github.com/sentry/vue) | 32.42 KB | | [@sentry/vue](https://github.com/sentry/vue) (incl. Tracing) | 47.47 KB | | [@sentry/svelte](https://github.com/sentry/svelte) | 27.15 KB | | CDN Bundle | 29.46 KB | | CDN Bundle (incl. Tracing) | 47.45 KB | | CDN Bundle (incl. Logs, Metrics) | 31.01 KB | | CDN Bundle (incl. Tracing, Logs, Metrics) | 48.75 KB | | CDN Bundle (incl. Replay, Logs, Metrics) | 69.37 KB | | CDN Bundle (incl. Tracing, Replay) | 84.11 KB | | CDN Bundle (incl. Tracing, Replay, Logs, Metrics) | 85.38 KB | | CDN Bundle (incl. Tracing, Replay, Feedback) | 89.75 KB | | CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) | 91.01 KB | | CDN Bundle - uncompressed | 87.79 KB | | CDN Bundle (incl. Tracing) - uncompressed | 143.27 KB | | CDN Bundle (incl. Logs, Metrics) - uncompressed | 92.39 KB | | CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed | 147.15 KB | | CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed | 214.29 KB | | CDN Bundle (incl. Tracing, Replay) - uncompressed | 259.77 KB | | CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed | 263.65 KB | | CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed | 273.15 KB | | CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed | 277.02 KB | | [@sentry/nextjs](https://github.com/sentry/nextjs) (client) | 50.26 KB | | [@sentry/sveltekit](https://github.com/sentry/sveltekit) (client) | 45.95 KB | | @sentry/core/server | 78.9 KB | | @sentry/core/browser | 65.38 KB | | [@sentry/node-core](https://github.com/sentry/node-core) | 61.83 KB | | [@sentry/node](https://github.com/sentry/node) | 123.05 KB | | [@sentry/node](https://github.com/sentry/node) (incl. diagnostics channel injection) | 166.11 KB | | @sentry/node/import (ESM hook with diagnostics-channel injection) | 166 B | | @sentry/node/light | 50.24 KB | | [@sentry/node](https://github.com/sentry/node) - without tracing | 73.24 KB | | [@sentry/aws-serverless](https://github.com/sentry/aws-serverless) | 82.28 KB | | [@sentry/cloudflare](https://github.com/sentry/cloudflare) (withSentry) - minified | 198 KB | | [@sentry/cloudflare](https://github.com/sentry/cloudflare) (withSentry) | 487.68 KB | </details> <details> <summary>nodemailer/nodemailer (nodemailer)</summary> ### [`v10.0.2`](https://github.com/nodemailer/nodemailer/blob/HEAD/CHANGELOG.md#1002-2026-09-09) [Compare Source](https://github.com/nodemailer/nodemailer/compare/v10.0.1...v10.0.2) ##### Bug Fixes - **mime-node:** flatten nested recipient arrays without recursion ([ebe0849](https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66)) - **shared:** keep the TLS server name out of the DNS cache ([a6512db](https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe)) </details> <details> <summary>colinhacks/zod (zod)</summary> ### [`v4.6.0`](https://github.com/colinhacks/zod/releases/tag/v4.6.0) [Compare Source](https://github.com/colinhacks/zod/compare/v4.5.4...v4.6.0) Zod 4.6 is now available. ```sh npm install zod@latest ``` At a glance: - [`.validate()`](https://zod.dev/blog/zod-4-6#validate) — checks input validity without building a result (up to 35x faster than `.safeParse().success` on a compiled schema) - [`z.instanceof().properties()`](https://zod.dev/blog/zod-4-6#zproperties) — validates properties of an instance - [`fromJSONSchema()`](https://zod.dev/blog/zod-4-6#fromjsonschema) — enforces six validation keywords it used to ignore - [`z.iban()`](https://zod.dev/blog/zod-4-6#ziban) — electronic-format IBAN plus mod-97 checksum - [`z.withParser()`](https://zod.dev/blog/zod-4-6#zwithparser) — installs a parser generated elsewhere, for environments without `new Function` - [Faster CommonJS](https://zod.dev/blog/zod-4-6#faster-commonjs) — drops the getter on every export (\~3x faster `z.validate()` under `require`) - [Memory retention in recursive schemas](https://zod.dev/blog/zod-4-6#memory-retention-in-recursive-schemas) — releases the parsed input, fixing a 4.5 out-of-memory regression - [`@zod/mini`](https://zod.dev/packages/mini) — Zod Mini as a standalone package, versioned in lockstep with `zod` since 4.5 ##### `.validate()` Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It answers "is this input valid?" without constructing a `ZodError`, which makes rejection cheap. The return type is a guard on the schema's input type. ```ts z.validate(z.string(), "hi"); // true z.validate(z.string(), 42); // false ``` It is a method on Zod Classic schemas too. ([#6547](https://github.com/colinhacks/zod/pull/6547)) ```ts const Player = z.object({ username: z.string(), xp: z.number(), }); if (Player.validate(data)) { data.username; // narrowed } ``` In conjunction with [`z.compile()`](https://zod.dev/compile), this can be up to 35x faster than `.safeParse().success` on invalid input. ![Time per call on invalid input, schemas compiled with z.compile(), safeParse().success as a gray bar with .validate() as a blue bar inside it: a union of 3 objects 28 ns (34.9x faster), an array of 10 strings 23 ns (24.6x), a 3-element tuple 28 ns (16.1x), a 5-key object 21 ns (16.3x), a discriminated union of 3 21 ns (15.7x), z.number() 19 ns (13.8x), z.string() 19 ns (13.2x), z.boolean() 19 ns (13.7x); up to 34.9x faster](https://raw.githubusercontent.com/colinhacks/zod/5cc3549ac77b33c1b7156a6ef158f593990cda60/packages/docs/public/blog/validate-compiled-invalid.svg) *Time per call on invalid input, compiled with z.compile() — lower is better ([benchmark](https://github.com/colinhacks/zod/blob/5cc3549ac77b33c1b7156a6ef158f593990cda60/packages/bench/validate-vs-safeparse.ts))* <details> <summary><b>Uncompiled schemas</b></summary> Without compilation it is up to 5.9x faster. The saving is the result object: `.safeParse()` allocates one with an accessor pair on every call, and `.validate()` allocates nothing. ![Time per call on invalid input, plain schemas, safeParse().success as a gray bar with .validate() as a blue bar inside it: a union of 3 objects 659 ns (1.5x faster), an array of 10 strings 211 ns (2.3x), a 3-element tuple 166 ns (2.5x), a discriminated union of 3 93 ns (3.3x), a 5-key object 75 ns (3.9x), z.number() 47 ns (5.3x), z.string() 42 ns (5.8x), z.boolean() 42 ns (5.9x); up to 5.9x faster](https://raw.githubusercontent.com/colinhacks/zod/5cc3549ac77b33c1b7156a6ef158f593990cda60/packages/docs/public/blog/validate-invalid.svg) *Time per call on invalid input, plain schemas — lower is better ([benchmark](https://github.com/colinhacks/zod/blob/5cc3549ac77b33c1b7156a6ef158f593990cda60/packages/bench/validate-vs-safeparse.ts))* </details> Both charts measure the failure path. The key feature of `.validate()` is that it can *short-circuit* on the first issue it encounters, instead of aggregating a full `ZodIssue[]` array. > \[!NOTE] > Async refinements are covered by `.validateAsync()`. ##### `z.properties()` A new API for validating specific properties of an object. Unlike `z.object()` it validates *in-place*, so it plays nice with class instances. ([#6536](https://github.com/colinhacks/zod/pull/6536)) ```ts const responseLike = z.properties({ status: z.number().min(200).max(299) }); responseLike.parse(new Response("ok", { status: 200 })); // ✅ a real Response responseLike.parse({ status: 204 }); // ✅ a plain object ``` A corresponding `.properties()` method has been added to `ZodInstanceOf`. **Zod** ```ts const okResponse = z.instanceof(Response).properties({ ok: z.literal(true), status: z.number().min(200).max(299), }); ``` **Zod Mini** ```ts const okResponse = z.instanceof(Response).check(...z.properties({ ok: z.literal(true), status: z.number().check(z.minimum(200), z.maximum(299)), })); ``` The input comes back untouched, so the prototype survives and the methods still work. That is the part `z.object()` cannot do: it would hand back a plain object and the `Response` would be gone. ```ts const res = await fetch("/api/user"); okResponse.parse(res) === res; // ✅ true ``` ##### `fromJSONSchema()` Six additional JSON Schema keywords are now supported in `z.fromJSONSchema()`. ([#6535](https://github.com/colinhacks/zod/pull/6535)) - [`minProperties`](https://json-schema.org/understanding-json-schema/reference/object#size) / [`maxProperties`](https://json-schema.org/understanding-json-schema/reference/object#size) - [`uniqueItems`](https://json-schema.org/understanding-json-schema/reference/array#uniqueItems) - [`contains`](https://json-schema.org/understanding-json-schema/reference/array#contains) - [`minContains`](https://json-schema.org/understanding-json-schema/reference/array#mincontains-maxcontains) / [`maxContains`](https://json-schema.org/understanding-json-schema/reference/array#mincontains-maxcontains) ```ts const schema = z.fromJSONSchema({ type: "object", minProperties: 2, // also maxProperties }); schema.parse({ a: 1 }); // ❌ too few properties schema.parse({ a: 1, b: 2 }); // ✅ ``` Both property bounds count the input's own keys. Array uniqueness is structural, so `[{ a: 1 }, { a: 1 }]` is a duplicate. ```ts z.fromJSONSchema({ type: "array", uniqueItems: true }).parse([{ a: 1 }, { a: 1 }]); // ❌ z.fromJSONSchema({ type: "array", contains: { type: "number" }, // also minContains and maxContains minContains: 2, }).parse(["a", 2]); // ❌ only one number ``` ##### `z.iban()` A new string format: an IBAN in electronic format, with a valid ISO 7064 MOD 97-10 checksum. ([#6571](https://github.com/colinhacks/zod/pull/6571)) ```ts z.iban().parse("DE89370400440532013000"); // ✅ z.iban().parse("DE89370400440532013001"); // ❌ bad checksum ``` ##### `z.withParser()` `z.compile()` builds its parser with `new Function`, which a strict Content Security Policy blocks. `z.withParser()` is that installer on its own: it takes a parser generated somewhere else, at build time or by a native compiler, and installs it under the same contract. ([#6575](https://github.com/colinhacks/zod/pull/6575)) ```ts const Player = z.object({ username: z.string(), xp: z.number() }); // isPlayer is a type guard your build step generated const Fast = z.withParser(Player, (input) => isPlayer(input) ? { username: input.username, xp: input.xp } : z.INVALID ); ``` The supplied parser owns the whole result, so it has to return what the schema would have returned. This one rebuilds the object rather than handing back its input, because `z.object()` strips unknown keys. Returning `z.INVALID` hands the input to the runtime, which stays the only source of `ZodError`s. ##### Faster CommonJS TypeScript compiles a re-export to a getter, and 252 of the 255 exports on Zod 4.5's CommonJS entrypoint were getters. V8 could not see a constant callee behind one, so it could not inline the call. The 4.6 build emits plain properties and freezes the exports object. On a compiled schema, `z.validate()` under `require` is about 3x faster than it was in Zod 4.5. ([#6564](https://github.com/colinhacks/zod/pull/6564)) ```ts const { z } = require("zod"); const CompiledPlayer = z.compile(Player); z.validate(CompiledPlayer, data); // ~3x faster than Zod 4.5 ``` Only calls through the namespace were affected. A method call like `Player.safeParse(data)` never reads the exports object, and the ESM build is unchanged. ##### Memory retention in recursive schemas A recursive schema held the input and output of its last parse until the next parse replaced it, so one long-lived schema pinned every object it had touched. Zod 4.4 released that input and Zod 4.5 did not, which surfaced as an out-of-memory failure on a repository-wide lint run. The parse state is weak throughout now: one parse of a 29k-node tree retains 2.2 MB where it used to retain 10.1 MB, and recursive parses give up about 6% for it. ([#6572](https://github.com/colinhacks/zod/pull/6572)) ```ts const Category = z.object({ name: z.string(), get children() { return z.array(Category); }, }); ``` ##### Bug fixes ##### ⚠️ Error maps run on the first read of `error` Because `safeParse()` now builds its error lazily, error maps — global, locale, and per-schema `error` — run when `result.error` is first read, not at parse time. Code that swaps `z.config()` between the parse and the read gets the newer configuration. ([#6519](https://github.com/colinhacks/zod/pull/6519)) ```ts const result = schema.safeParse(12); z.config(z.locales.fr()); result.error.issues[0].message; // French in 4.6, English in 4.5 ``` An error map with a side effect never runs if nothing reads the error. Throwing parses are unaffected — `.parse()` builds and throws its error immediately, never takes the lazy path, and its stack still points at your call site. ##### ⚠️ `z.emoji()` rejects component-only strings Unicode's `Emoji_Component` property covers the pieces that attach to an emoji, so `z.emoji()` accepted `"123"`, `"#"`, `"*"`, and a lone zero-width joiner, variation selector, or skin tone modifier. The pattern now requires at least one pictograph, regional indicator, or keycap. ([#6532](https://github.com/colinhacks/zod/pull/6532)) ```ts z.emoji().parse("😀"); // ✅ z.emoji().parse("1️⃣"); // ✅ the keycap is the anchor z.emoji().parse("123"); // ❌ was accepted in 4.5 ``` Flags, subdivision flags, skin-tone-modified emoji, and ZWJ sequences are unchanged. Closes [#6515](https://github.com/colinhacks/zod/issues/6515). ##### ⚠️ Numeric enum options no longer include the reverse mappings A numeric TypeScript enum also carries its reverse mapping (`0` to `"UK"`) at runtime. The parser already ignored those keys, but `.options` was read straight off the enum object, so a three-member enum listed six values and three of them failed to parse. ([#6542](https://github.com/colinhacks/zod/pull/6542)) ```ts enum Country { UK, Germany, France } z.enum(Country).options; // 4.5: ["UK", "Germany", "France", 0, 1, 2] — 4.6: [0, 1, 2] ``` ##### ⚠️ base64 patterns The runtime patterns for `z.base64()` and `z.base64url()` are the character sets, with length and padding enforced in code, so a multi-megabyte string can no longer overflow the regex stack through a composed schema. The JSON Schema output still emits the exact block forms, so `z.toJSONSchema()` is unchanged. ([#6534](https://github.com/colinhacks/zod/pull/6534), [#6527](https://github.com/colinhacks/zod/pull/6527)) Composing `z.base64()` into a template literal now checks the alphabet but not the length, which is how `z.creditCard()` already behaves there. The exported `z.regexes.base64url` is now the length-aware form, so it overflows on a multi-megabyte input the same way `z.regexes.base64` does. ##### ⚠️ The email pattern dropped its lookaheads `z.email()` opened with two lookaheads, and the second scanned the whole string before the match began. Both are gone, and the rule they enforced — no empty segment in the local part — is expressed structurally instead, so `z.email()` accepts and rejects exactly what it did before. Valid addresses validate roughly twice as fast. ([#6573](https://github.com/colinhacks/zod/pull/6573)) The pattern string is user-visible, and every copy of it changes: `z.regexes.email`, which has no capture groups now — neither of the two it used to expose held a usable value; `issue.pattern` on a failed `z.email()`; and the `pattern` that `z.toJSONSchema()` emits, which no longer carries a lookahead, so validators outside ECMAScript can compile it. Composing an email into a template literal also stops applying its no-consecutive-dots rule to the rest of the string. ```ts z.templateLiteral([z.email(), "|", z.string()]).parse("a@b.cc|a..b"); // 4.5: ❌ — the lookahead reached past the email segment — 4.6: ✅ ``` ##### ⚠️ Chained checks no longer overwrite each other in JSON Schema Each check used to write its own bounds into the schema as it attached, in chain order, so a format check applied after `.min()` and `.max()` replaced the tighter values with its own range. The converter folds the checks as a conjunction now. The order they are chained in no longer changes the output. ([#6554](https://github.com/colinhacks/zod/pull/6554), [#6553](https://github.com/colinhacks/zod/pull/6553)) ```ts z.toJSONSchema(z.number().min(0).max(23).int()); // 4.5: { minimum: -9007199254740991, maximum: 9007199254740991 } // 4.6: { minimum: 0, maximum: 23 } ``` Runtime parsing enforced the bounds in every version. Only the emitted schema was wrong. The same fold fixes two more cases: a repeated `multipleOf` kept the first divisor and dropped the rest, so `z.number().multipleOf(2).multipleOf(3)` emitted a schema that accepts 4, and `z.string().min(8).length(5)` emitted `minLength: 5`, widening a bound the runtime still rejected. Closes [#6550](https://github.com/colinhacks/zod/issues/6550). ##### ⚠️ Metadata members materialize on first read Eight members on a Zod Classic schema — `.format`, `.minLength`, `.maxLength`, `.minValue`, `.maxValue`, `.isInt`, `.minDate` and `.maxDate` — are computed from the checks now instead of being written onto every instance at construction. Each one is a prototype getter that becomes an own property on first read. ([#6554](https://github.com/colinhacks/zod/pull/6554)) ```ts const s = z.string().min(3).max(9); Object.keys(s); // 4.5: ["def", "type", "format", "minLength", "maxLength"] — 4.6: ["def", "type"] s.minLength; // 3 in both Object.keys(s); // 4.6: ["def", "type", "minLength"] ``` A key is absent until something reads it, and `Object.assign({}, schema)` copies only the members that have been read. Deleting one restores the getter, and the next read recomputes it. The values can move too, because the getters read the same fold the JSON Schema converter does. An order-dependent chain reports the tighter bound now instead of whichever check wrote last. ```ts z.string().min(8).length(5).minLength; // 4.5: 5 — 4.6: 8 ``` ##### Commits Zod 4.6 rolls up 72 commits. - [`661673ae`](https://github.com/colinhacks/zod/commit/661673ae) docs: make the 9thCO logo visible on the light theme by [@colinhacks](https://github.com/colinhacks) - [`6de10dce`](https://github.com/colinhacks/zod/commit/6de10dce) docs: reconcile the sponsor listings against every active sponsorship ([#6579](https://github.com/colinhacks/zod/pull/6579)) by [@colinhacks](https://github.com/colinhacks) - [`213ee75d`](https://github.com/colinhacks/zod/commit/213ee75d) feat(compile): add z.withParser for externally generated parsers ([#6575](https://github.com/colinhacks/zod/pull/6575)) by [@colinhacks](https://github.com/colinhacks) - [`f9465d4e`](https://github.com/colinhacks/zod/commit/f9465d4e) docs: reconcile the sponsor listings with active sponsorships ([#6576](https://github.com/colinhacks/zod/pull/6576)) by [@colinhacks](https://github.com/colinhacks) - [`f7fd5548`](https://github.com/colinhacks/zod/commit/f7fd5548) perf(v4): drop the lookaheads from the email regex ([#6573](https://github.com/colinhacks/zod/pull/6573)) by [@colinhacks](https://github.com/colinhacks) - [`36f17960`](https://github.com/colinhacks/zod/commit/36f17960) fix(v4): stop the memoizer from pinning a finished parse ([#6572](https://github.com/colinhacks/zod/pull/6572)) by [@colinhacks](https://github.com/colinhacks) - [`22bed613`](https://github.com/colinhacks/zod/commit/22bed613) feat(v4): add z.iban() string format with mod-97 checksum ([#6571](https://github.com/colinhacks/zod/pull/6571)) by [@colinhacks](https://github.com/colinhacks) - [`c5b9bcb3`](https://github.com/colinhacks/zod/commit/c5b9bcb3) bench: measure what a runtime island's leaked indent cost the generated source by [@colinhacks](https://github.com/colinhacks) - [`e54716cb`](https://github.com/colinhacks/zod/commit/e54716cb) docs(ecosystem): add [@apical-ts/craft](https://github.com/apical-ts/craft) ([#5946](https://github.com/colinhacks/zod/pull/5946)) by [@gunzip](https://github.com/gunzip) - [`dcbcf052`](https://github.com/colinhacks/zod/commit/dcbcf052) fix(compile): unwind the doc indent when a child generator throws ([#6570](https://github.com/colinhacks/zod/pull/6570)) by [@colinhacks](https://github.com/colinhacks) - [`277613a6`](https://github.com/colinhacks/zod/commit/277613a6) docs: move the release procedure to the maintainer-local notes by [@colinhacks](https://github.com/colinhacks) - [`eb1c1089`](https://github.com/colinhacks/zod/commit/eb1c1089) ci: release only on workflow\_dispatch behind the npm environment ([#6569](https://github.com/colinhacks/zod/pull/6569)) by [@colinhacks](https://github.com/colinhacks) - [`741981ff`](https://github.com/colinhacks/zod/commit/741981ff) perf(compile): for-in record walk, cheaper issue finalization, and a generative compile differential ([#6567](https://github.com/colinhacks/zod/pull/6567)) by [@colinhacks](https://github.com/colinhacks) - [`804e0f52`](https://github.com/colinhacks/zod/commit/804e0f52) perf: seal the CommonJS exports so require("zod") stops reading through a getter ([#6564](https://github.com/colinhacks/zod/pull/6564)) by [@colinhacks](https://github.com/colinhacks) - [`6f048367`](https://github.com/colinhacks/zod/commit/6f048367) fix(v4): derive JSON Schema constraints by folding checks in the converter ([#6554](https://github.com/colinhacks/zod/pull/6554)) by [@colinhacks](https://github.com/colinhacks) - [`e4d67f3e`](https://github.com/colinhacks/zod/commit/e4d67f3e) Migrate development and CI to Nub ([#6562](https://github.com/colinhacks/zod/pull/6562)) by [@colinhacks](https://github.com/colinhacks) - [`7a002366`](https://github.com/colinhacks/zod/commit/7a002366) fix(v4): don't let format checks overwrite tighter min/max bounds ([#6553](https://github.com/colinhacks/zod/pull/6553)) by [@colinhacks](https://github.com/colinhacks) - [`5489a532`](https://github.com/colinhacks/zod/commit/5489a532) test(v4): pin the check-chain case that keeps compiled validate's definite guard ([#6551](https://github.com/colinhacks/zod/pull/6551)) by [@colinhacks](https://github.com/colinhacks) - [`e7604717`](https://github.com/colinhacks/zod/commit/e7604717) docs: attribute the compiled failure cost to the fallback, not the double pass by [@colinhacks](https://github.com/colinhacks) - [`764ac59f`](https://github.com/colinhacks/zod/commit/764ac59f) perf(v4): settle z.validate on the first failure in parse order ([#6544](https://github.com/colinhacks/zod/pull/6544)) by [@colinhacks](https://github.com/colinhacks) - [`07917f4c`](https://github.com/colinhacks/zod/commit/07917f4c) test(v4): pin the lazy safeParse error's stack behavior ([#6548](https://github.com/colinhacks/zod/pull/6548)) by [@colinhacks](https://github.com/colinhacks) - [`62e6624b`](https://github.com/colinhacks/zod/commit/62e6624b) feat(v4): add .validate() and .validateAsync() to Zod Classic ([#6547](https://github.com/colinhacks/zod/pull/6547)) by [@colinhacks](https://github.com/colinhacks) - [`cafbee47`](https://github.com/colinhacks/zod/commit/cafbee47) fix(v4): parse recursive schemas built by a factory ([#6530](https://github.com/colinhacks/zod/pull/6530)) by [@colinhacks](https://github.com/colinhacks) - [`4d730882`](https://github.com/colinhacks/zod/commit/4d730882) Release the parsed input once a failing safeParse builds its error ([#6543](https://github.com/colinhacks/zod/pull/6543)) by [@colinhacks](https://github.com/colinhacks) - [`90269c60`](https://github.com/colinhacks/zod/commit/90269c60) Keep a numeric TS enum's reverse-mapping keys out of `.options` ([#6542](https://github.com/colinhacks/zod/pull/6542)) by [@colinhacks](https://github.com/colinhacks) - [`18e71c71`](https://github.com/colinhacks/zod/commit/18e71c71) Rename the JSON Schema `process` helper so bundler polyfills cannot collide ([#6541](https://github.com/colinhacks/zod/pull/6541)) by [@colinhacks](https://github.com/colinhacks) - [`68aca3dc`](https://github.com/colinhacks/zod/commit/68aca3dc) docs: cover the 4.5 API surface that never made it into the reference by [@colinhacks](https://github.com/colinhacks) - [`eca96871`](https://github.com/colinhacks/zod/commit/eca96871) fix(v4): enforce the six JSON Schema keywords fromJSONSchema silently dropped ([#6535](https://github.com/colinhacks/zod/pull/6535)) by [@colinhacks](https://github.com/colinhacks) - [`81ded991`](https://github.com/colinhacks/zod/commit/81ded991) perf: answer z.validate from the compiled fast path on invalid input ([#6538](https://github.com/colinhacks/zod/pull/6538)) by [@colinhacks](https://github.com/colinhacks) - [`51caf010`](https://github.com/colinhacks/zod/commit/51caf010) refactor: collapse cachedInternal back into cached ([#6540](https://github.com/colinhacks/zod/pull/6540)) by [@colinhacks](https://github.com/colinhacks) - [`abfb3897`](https://github.com/colinhacks/zod/commit/abfb3897) feat(v4): make z.properties() a schema, and give z.instanceof() a .properties() method ([#6536](https://github.com/colinhacks/zod/pull/6536)) by [@colinhacks](https://github.com/colinhacks) - [`69f2a7ff`](https://github.com/colinhacks/zod/commit/69f2a7ff) Collapse toZod's normalizer and move its docs to the API reference ([#6539](https://github.com/colinhacks/zod/pull/6539)) by [@colinhacks](https://github.com/colinhacks) - [`bf990216`](https://github.com/colinhacks/zod/commit/bf990216) perf: move util.cached's accessor to a prototype ([#6537](https://github.com/colinhacks/zod/pull/6537)) by [@colinhacks](https://github.com/colinhacks) - [`bec73bea`](https://github.com/colinhacks/zod/commit/bec73bea) perf(v4): build the safeParse error on first read ([#6519](https://github.com/colinhacks/zod/pull/6519)) by [@colinhacks](https://github.com/colinhacks) - [`07c43e2a`](https://github.com/colinhacks/zod/commit/07c43e2a) Keep the runtime base64 regexes linear so composed parse paths cannot overflow ([#6534](https://github.com/colinhacks/zod/pull/6534)) by [@colinhacks](https://github.com/colinhacks) - [`bc1157e7`](https://github.com/colinhacks/zod/commit/bc1157e7) docs: use a Response example for z.properties() by [@colinhacks](https://github.com/colinhacks) - [`2ec972ec`](https://github.com/colinhacks/zod/commit/2ec972ec) refactor: collapse toZod's enum leaf normalizer to a dummy union ([#6533](https://github.com/colinhacks/zod/pull/6533)) by [@colinhacks](https://github.com/colinhacks) - [`68a609ac`](https://github.com/colinhacks/zod/commit/68a609ac) Widen literal inputs in property check types ([#6520](https://github.com/colinhacks/zod/pull/6520)) by [@colinhacks](https://github.com/colinhacks) - [`0227e53d`](https://github.com/colinhacks/zod/commit/0227e53d) docs: bump the star pill's GitHub mark to 20px by [@colinhacks](https://github.com/colinhacks) - [`84dd3b0f`](https://github.com/colinhacks/zod/commit/84dd3b0f) perf: build literal and enum pattern regexes lazily ([#6531](https://github.com/colinhacks/zod/pull/6531)) by [@colinhacks](https://github.com/colinhacks) - [`f83ab511`](https://github.com/colinhacks/zod/commit/f83ab511) fix(v4): reject component-only strings from z.emoji() ([#6532](https://github.com/colinhacks/zod/pull/6532)) by [@colinhacks](https://github.com/colinhacks) - [`74f9a6d3`](https://github.com/colinhacks/zod/commit/74f9a6d3) docs: drop the toZod enum block from basics and pin the page's curation rule in a comment by [@colinhacks](https://github.com/colinhacks) - [`a2a019a5`](https://github.com/colinhacks/zod/commit/a2a019a5) Accept enum-typed targets in z.toZod ([#6528](https://github.com/colinhacks/zod/pull/6528)) by [@colinhacks](https://github.com/colinhacks) - [`319f47f4`](https://github.com/colinhacks/zod/commit/319f47f4) Emit a length-aware base64url pattern in toJSONSchema ([#6527](https://github.com/colinhacks/zod/pull/6527)) by [@colinhacks](https://github.com/colinhacks) - [`08ba069e`](https://github.com/colinhacks/zod/commit/08ba069e) perf(v4): read Luhn digits with charCodeAt instead of string indexing ([#6529](https://github.com/colinhacks/zod/pull/6529)) by [@colinhacks](https://github.com/colinhacks) - [`1ec6b7c5`](https://github.com/colinhacks/zod/commit/1ec6b7c5) docs: add an RSS feed to the blog at /blog/rss.xml by [@colinhacks](https://github.com/colinhacks) - [`b801439b`](https://github.com/colinhacks/zod/commit/b801439b) bench: add typebox (compiled and dynamic) to the moltar cross-library harness by [@colinhacks](https://github.com/colinhacks) - [`7ae49d64`](https://github.com/colinhacks/zod/commit/7ae49d64) docs: drop the circle around the star pill's GitHub mark and center it on the pill's arc by [@colinhacks](https://github.com/colinhacks) - [`93f3ab32`](https://github.com/colinhacks/zod/commit/93f3ab32) docs: replace the blog navbar's GitHub icon with a star-count pill by [@colinhacks](https://github.com/colinhacks) - [`fb2fedfd`](https://github.com/colinhacks/zod/commit/fb2fedfd) docs: tighten the memory chart callout, pad the canvas, say "less memory" by [@colinhacks](https://github.com/colinhacks) - [`ff56a551`](https://github.com/colinhacks/zod/commit/ff56a551) docs: center the memory chart callout labels and pad them off the number by [@colinhacks](https://github.com/colinhacks) - [`8cd1250f`](https://github.com/colinhacks/zod/commit/8cd1250f) docs: center the memory chart callout labels by [@colinhacks](https://github.com/colinhacks) - [`3195ed01`](https://github.com/colinhacks/zod/commit/3195ed01) docs: label the memory chart like the compile chart by [@colinhacks](https://github.com/colinhacks) - [`a6b49390`](https://github.com/colinhacks/zod/commit/a6b49390) Mark the compile internals [@internal](https://github.com/internal) instead of hiding them ([#6518](https://github.com/colinhacks/zod/pull/6518)) by [@colinhacks](https://github.com/colinhacks) - [`40b4d0b3`](https://github.com/colinhacks/zod/commit/40b4d0b3) fix(ci): read zod's latest version with npm view when picking the backfill dist-tag by [@colinhacks](https://github.com/colinhacks) - [`5ff95665`](https://github.com/colinhacks/zod/commit/5ff95665) Stop re-exporting the compile internals from zod/v4/core ([#6511](https://github.com/colinhacks/zod/pull/6511)) by [@colinhacks](https://github.com/colinhacks) - [`f412178d`](https://github.com/colinhacks/zod/commit/f412178d) ci: publish [@zod/mini](https://github.com/zod/mini) to JSR in lockstep with npm ([#6510](https://github.com/colinhacks/zod/pull/6510)) by [@colinhacks](https://github.com/colinhacks) - [`f3e7c72e`](https://github.com/colinhacks/zod/commit/f3e7c72e) fix(docs): render the docs 404 page inside the (doc) layout once by [@colinhacks](https://github.com/colinhacks) - [`f3cb3644`](https://github.com/colinhacks/zod/commit/f3cb3644) docs: surface the blog on the home page and in the sidebar by [@colinhacks](https://github.com/colinhacks) - [`cd4f9a67`](https://github.com/colinhacks/zod/commit/cd4f9a67) perf(v4): report Standard Schema issues without constructing a ZodError ([#6509](https://github.com/colinhacks/zod/pull/6509)) by [@colinhacks](https://github.com/colinhacks) - [`43b9bfc5`](https://github.com/colinhacks/zod/commit/43b9bfc5) docs: drop the bound-methods section from the Zod package page by [@colinhacks](https://github.com/colinhacks) - [`70eb2c07`](https://github.com/colinhacks/zod/commit/70eb2c07) docs: drop the traits section and the compilation feature bullet by [@colinhacks](https://github.com/colinhacks) - [`1c0bce0c`](https://github.com/colinhacks/zod/commit/1c0bce0c) docs: bring the 4.5 charts and worked examples into the docs pages by [@colinhacks](https://github.com/colinhacks) - [`a0898b4b`](https://github.com/colinhacks/zod/commit/a0898b4b) ci: wait hours for npm to serve a publish, not ten minutes ([#6502](https://github.com/colinhacks/zod/pull/6502)) by [@colinhacks](https://github.com/colinhacks) - [`c46eeff0`](https://github.com/colinhacks/zod/commit/c46eeff0) chore: narrow blanket biome-ignore comments ([#6504](https://github.com/colinhacks/zod/pull/6504)) by [@pullfrog\[bot\]](https://github.com/pullfrog\[bot]) - [`c7ec94d3`](https://github.com/colinhacks/zod/commit/c7ec94d3) ci: check zod and [@zod/mini](https://github.com/zod/mini) lockstep on npm after every publish ([#6507](https://github.com/colinhacks/zod/pull/6507)) by [@colinhacks](https://github.com/colinhacks) - [`81065739`](https://github.com/colinhacks/zod/commit/81065739) chore(docs): build with Turbopack by [@colinhacks](https://github.com/colinhacks) - [`abd41adb`](https://github.com/colinhacks/zod/commit/abd41adb) docs(wiki): move plans and comparisons into a gitignored internal/ ([#6506](https://github.com/colinhacks/zod/pull/6506)) by [@colinhacks](https://github.com/colinhacks) - [`2956c4c2`](https://github.com/colinhacks/zod/commit/2956c4c2) chore(mini): sync [@zod/mini](https://github.com/zod/mini) to 4.5.4 by [@colinhacks](https://github.com/colinhacks) - [`8ce9e8d5`](https://github.com/colinhacks/zod/commit/8ce9e8d5) feat(mini): publish Zod Mini as the standalone [@zod/mini](https://github.com/zod/mini) package ([#6491](https://github.com/colinhacks/zod/pull/6491)) by [@colinhacks](https://github.com/colinhacks) - [`93186cab`](https://github.com/colinhacks/zod/commit/93186cab) docs(wiki): drop the zod-compiler benchmark ([#6505](https://github.com/colinhacks/zod/pull/6505)) by [@colinhacks](https://github.com/colinhacks) - [`908c9e17`](https://github.com/colinhacks/zod/commit/908c9e17) fix(docs): retry the GitHub stars fetch and log the real status by [@colinhacks](https://github.com/colinhacks) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Copenhagen) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added the

dependencies

label

2026-09-09 21:02:55 +00:00

renovate added 1 commit

2026-09-09 21:02:56 +00:00

chore(deps): Update production (non-major)

CD Staging / Build & Push Docker Images (pull_request) Has been skipped

Details

CD Staging / Build & Push Docker Images-1 (pull_request) Has been skipped

Details

CD Staging / Deploy Staging (pull_request) Has been skipped

Details

CD Staging / Deploy PR Preview (pull_request) Has been skipped

Details

renovate/stability-days Updates have not met minimum release age requirement

Details

CI / Security Scan (pull_request) Successful in 42s

Details

CI / Dockerfile Package Check (pull_request) Successful in 17s

Details

CI / Visual Tests (pull_request) Successful in 2m9s

Details

CI / Checks (pull_request) Successful in 8m21s

Details

CI / Journal Image Smoke Test (pull_request) Successful in 13m46s

Details

CI / E2E Tests (pull_request) Successful in 6m16s

Details

Cancel superseded CI / Cancel in-flight CI (pull_request) Successful in 10s

Details

CD Staging / Tear Down PR Preview (pull_request) Successful in 28s

Details

f4fd496c9b

renovate scheduled this pull request to auto merge when all checks succeed

2026-09-09 21:02:57 +00:00

renovate merged commit 5571609003 into main

2026-09-09 21:29:42 +00:00

renovate referenced this pull request from a commit

2026-09-09 21:29:43 +00:00

chore(deps): Update production (non-major) (#138)

renovate deleted branch renovate/production-(non-major)

2026-09-09 21:29:52 +00:00

No reviewers

No labels

dependencies

major

security-pin

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

trails-cool/trails!138

No description provided.

Rows
Columns

chore(deps): Update production (non-major) #138

Release Notes

v2.3.4

@​logtape/file

v10.74.0

Bundle size 📦

v10.0.2

Bug Fixes

v4.6.0

.validate()

z.properties()

fromJSONSchema()

z.iban()

z.withParser()

Faster CommonJS

Memory retention in recursive schemas

Bug fixes

⚠️ Error maps run on the first read of error

⚠️ z.emoji() rejects component-only strings

⚠️ Numeric enum options no longer include the reverse mappings

⚠️ base64 patterns

⚠️ The email pattern dropped its lookaheads

⚠️ Chained checks no longer overwrite each other in JSON Schema

⚠️ Metadata members materialize on first read

Commits

Configuration

`v2.3.4`

@logtape/file

`v10.74.0`

`v10.0.2`

`v4.6.0`

`.validate()`

`z.properties()`

`fromJSONSchema()`

`z.iban()`

`z.withParser()`

⚠️ Error maps run on the first read of `error`

⚠️ `z.emoji()` rejects component-only strings